Privacy Policy

Homebookin (“we”, “us”) operates the Homebookin mobile app and homebookin.com. For any privacy question, or to ask for a copy or deletion of your data, contact privacy@homebookin.com.

We only collect what the service needs to work:

• Account — name, email address, phone number, date of birth, and a password (stored only as a one-way hash, never in readable form). Optional profile details you add, such as an address, emergency contact or bio.
• Host identity (KYC) — if you sign up to host, your legal name and a photo of a government-issued ID document. An administrator reviews it to approve your host account.
• Listings & bookings — the property details, photos and ownership documents you upload as a host; the reservations, dates and guest counts you create as a guest.
• Messages — the content of messages you exchange with a host or guest through Homebookin.
• Approximate location — when you open a map, the app may use your device location to centre it and show nearby stays. Listing locations are shown to other guests only approximately (offset by a few hundred metres) until a booking is confirmed.
• Device & technical data — a push-notification token for each phone you sign in on, plus IP address and basic request logs, kept short-term for security and debugging. We do not use third-party advertising or analytics trackers.

• To create and secure your account and keep you signed in.
• To take bookings, calculate prices and payouts, and run the host review and identity-verification process.
• To let hosts and guests message each other and share contact details once a booking is confirmed.
• To keep the marketplace safe — detecting fraud, abuse and policy violations, and acting on reports.
• To meet legal and tax obligations where they apply.

We do not sell your personal data. We share it only:

• With your booking counterparty — a host and guest see each other’s first name and, once a reservation is confirmed, the contact details needed for the stay. Your government ID is never shown to other users; only Homebookin administrators can view it, through a short-lived link.
• With service providers who run parts of Homebookin for us, under contract and only for that purpose: Supabase (database, sign-in and file storage, hosted in the European Union), Resend (account emails such as password resets), Google Firebase (push notifications) and Google Maps (maps and location search).
• When the law requires it — to comply with a valid legal request, or to protect the rights and safety of users and the public.

Your account data is kept while your account is open. When you delete your account, we immediately erase your name, contact details, address, date of birth and ID photos, and take your listings down. Records of past bookings, payments, payouts, reviews and messages are kept in anonymised form (shown as “Deleted user”) because the other people involved and tax and accounting rules depend on them. Request logs are rotated within a short window.

• All traffic between the apps and our servers is encrypted with HTTPS.
• Passwords are stored only as a salted one-way hash.
• Every database table is locked so that it can only be reached through Homebookin's own checks; nobody can read another person's data directly.
• ID documents live in a private store and are only ever accessed through short-lived signed links by authorised administrators.
• Sessions use short-lived access tokens that renew automatically; changing your password signs you out everywhere.

• Access & correction — view and edit your profile, email, phone and date of birth in the app under Account settings.
• Deletion — delete your account yourself at any time: in the app under Account settings → Login & security → Delete account, or on the website under Account. You can also ask us at privacy@homebookin.com. Upcoming trips, hosted stays and unpaid earnings must be settled first.
• Location — you can deny or revoke the location permission in your device settings; maps still work, just not centred on you.
• Notifications — manage email, push and SMS categories under Account settings → Notifications.

Depending on where you live — for example under Kenya’s Data Protection Act or, for visitors from Europe and the UK, the GDPR — you may have the right to access, correct, delete or export your personal data, to object to how we use it, and to complain to your data-protection authority. Email privacy@homebookin.com and we will reply within 30 days. Because our service providers are based in other countries, your data may be processed outside the country you live in; we only use providers that protect it to the standard this policy describes.

Homebookin is not directed at children. You must be at least 18 to host and at least 13 to hold an account; accounts we learn belong to someone younger are removed.

If we change this policy we will update the date above and, for material changes, notify you in the app or by email before they take effect.