This Policy explains what data the Home Rate app collects, why we use it, and what rights you have. Operator: Home Rate. Privacy contact: privacy@homerate.app.
1. Who we are
Home Rate is a mobile service for property reviews by address. Data is processed to operate the App, ensure security, run analytics, and manage purchases.
2. What data we collect
2.1. Account data
- Firebase Authentication identifier (UID);
- email, name, profile photo — if you sign in with Google or Apple (per the provider's settings);
- user role (e.g., user, paid, moderator) for feature access.
2.2. Content and activity
- review and reply text, moderation results and statuses, ratings, searched addresses, and saved addresses/reviews;
- photos you voluntarily attach to reviews or submit as proof of residence, if those features are enabled;
- reactions (likes/dislikes), if you use them;
- notification settings for saved addresses (if enabled).
2.3. Technical and analytics data
- in-app events (screens, buttons, errors) via Firebase Analytics / Crashlytics;
- app installation and analytics session identifiers, device model, OS and App version;
- FCM token for push notifications — only when the notification feature is enabled and you grant system permission.
When a guest account is used through TestFlight, Xcode, or Simulator, we may automatically store a test-account label, launch environment, App version and build number, and the date the label was applied in its private profile. These data are linked to the account identifier (UID) and used for testing and administering the Service: administrators can distinguish and filter test accounts in the user directory. The label may remain after the guest account is registered. These technical data are not used for advertising.
2.4. Purchase data
- whether you have a subscription, the plan type, expiration, and revocation or refund status (via StoreKit);
- technical StoreKit transaction identifiers and a random appAccountToken linked to the account, used to verify purchases, restore access, and prevent one purchase from being transferred between accounts;
- Apple processes payment and card data; we do not receive or store card numbers.
2.5. Advertising and analytics settings
Advertising is disabled in the current release. The current app uses Firebase Analytics without IDFA collection support, disables IDFV collection by Analytics, and disables advertising storage, advertising user data, and ad personalization in Analytics. Analytics and crash diagnostics used to operate and improve the Service remain enabled; this does not mean that the App collects no data.
If advertising is introduced in a future release, we will update this Policy and request any required permissions before enabling tracking.
2.6. Location and maps
Address search uses Google Places / Maps. We may send search queries to the maps provider; we do not keep precise GPS tracking running without your action in the App.
2.7. Automated review and reply moderation
New and resubmitted reviews and replies are screened for safety before they can become public:
- the server first performs local automated checks for email, international and Ukrainian phone-number, apartment-number, and current military or operational-data patterns;
- if those checks identify potential personal data or military-sensitive content, the text is not sent to OpenAI and remains non-public or is blocked under the safety policy;
- otherwise, the review or reply text is sent to the OpenAI Moderation API to classify potentially harmful content;
- we do not intentionally attach your UID, email, profile name, or saved addresses to the OpenAI request. However, any information you include in the review or reply itself may be processed as part of that text;
- a clean result may be approved automatically; ambiguous text waits for a moderator, while explicit signs of current military or operational disclosure may be blocked automatically before publication.
We retain the review or reply text, its status, and limited moderation-result categories in Firestore for moderation and audit purposes. The internal audit log does not duplicate the full review text, the secret API key, or the complete OpenAI response.
These checks look for patterns, including some disguised contacts. They cannot detect every item of personal or sensitive information. Do not include personal or military-sensitive information in reviews or replies. Photos are not sent to OpenAI Moderation; reviews with new photos require human moderation.
3. Why we use data
- to provide and improve App features;
- content moderation and abuse prevention;
- notifications about new reviews for saved addresses (for subscribers);
- processing subscriptions and restoring purchases;
- showing ads to free users (if enabled);
- analytics, stability, and bug fixes.
Legal basis (GDPR): performance of a contract (providing the Service), legitimate interest (security, analytics), and consent (push, ad tracking, optional features).
4. Who we share data with
- Google / Firebase — hosting, database, auth, analytics, crashlytics, messaging;
- Apple — Sign in with Apple, In-App Purchase;
- Google — Sign-In, Maps, Places, AdMob (where applicable);
- OpenAI — processing review and reply text only through the Moderation API for automated content-safety screening;
- other providers — only when needed and under appropriate data processing agreements.
According to OpenAI's current API documentation, API data is not used to train models unless the customer explicitly opts in, and the /v1/moderations endpoint lists no customer-content retention for abuse monitoring or application state. Current processing terms are described in OpenAI's API data controls documentation.
We do not sell your personal data to third parties in the sense of "selling a customer base".
5. Storage and security
Data is stored in Firebase (the region depends on project settings). We apply Firestore access rules, HTTPS, and role restrictions. No system is 100% secure; report incidents to privacy@homerate.app.
The application database is in Firebase Europe (Belgium); the default photo storage is in the United States. Authentication, analytics, diagnostics and other providers may process data in other locations. Local drafts are encrypted, kept for 30 days after the last edit and isolated by account; signing out alone does not delete an explicitly saved draft. Private session caches are cleared on sign-out or account change; clearing a cache does not erase copies held by a provider or another recipient.
6. Retention
Deletion is processed in stages: access is blocked and cleanup retries until completion. Unpublished reviews/replies and attached photos are removed; published text may remain only after identity removal and a safety check. A minimal coded deletion record may be kept for up to 90 days after completion to prevent restoration of deleted data. Active deletion records remain until cleanup completes. Disaster-recovery copies must be isolated and scrubbed before reuse. The currently inspected project has no scheduled database backups or point-in-time recovery; storage soft-deletion can retain removed bytes for seven days. Independently downloaded copies may persist outside our control.
On 11 October 2026 we saved Analytics retention settings of two months for both event and user-level data, without resetting the user period on new activity. Google states that setting changes take effect after 24 hours; standard aggregate reports can have different retention. Crashlytics keeps crash traces and related installation identifiers for 90 days before beginning removal. Provider deletion and backup processes may take additional time.
The approved retention targets for unpublished content and notification history are 90 days, and for feedback/moderation audit 180 days. Automatic age-based cleanup for these categories is still being implemented; account deletion already removes related private data. A documented safety or dispute hold may retain only necessary evidence with limited access and periodic review.
7. Your rights
Depending on applicable law (including GDPR / Ukraine's "On Personal Data Protection" law) you may:
- access your data;
- correct inaccurate data;
- delete your account and related private data (in-app feature or by email request); published reviews and replies may remain only in anonymized form;
- restrict or object to processing (where applicable);
- withdraw consent for push / ad tracking in iOS settings;
- lodge a complaint with a supervisory authority.
8. Children
The Service is not intended for children under 16. We do not knowingly collect children's data. If you believe a child has provided data, contact us for deletion.
9. International transfers
Providers (Firebase, Google, Apple, OpenAI) may process data on servers outside Ukraine/the EU with appropriate safeguards (standard contractual clauses, etc.).
10. Changes to this Policy
We update this page when features change (advertising, subscriptions, push). The date at the top reflects the current version.
11. Contact
Email: privacy@homerate.app
General support: support@homerate.app