Privacy Policy

FreeHomeSwaps (the “Service”) is operated by FreeHomeSwaps. We are the “data controller” for the personal data processed through the Service, in the sense of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, and — where it applies — Regulation (EU) 2016/679 (the “EU GDPR”).

For any privacy-related question or to exercise your rights described in Section 9, contact us at hello@freehomeswaps.com.

We collect personal data only as needed to run the Service. The categories are:

a) Account data

• Email address
• Password (stored as a hash, never as plaintext)
• Display name
• Email-confirmation status and timestamps

b) Profile data (optional, supplied by you)

• Profile photo
• About-you text
• Social-link URLs (Facebook, Instagram, LinkedIn)
• Email-notification preferences

c) Listing data (when you publish a home)

• City and (optionally) neighborhood — never a precise street address
• Bedrooms, sleeps capacity, amenity tags
• Free-text description and “looking for” note
• Photos of your home
• Travel windows you are open to (date ranges or month picks)
• Wishlist of cities, countries, or regions you’d like to visit

d) Activity data

• Listings you save
• Messages you exchange with other users
• Filter and search activity, where it’s persisted in URL state

e) Technical data, collected automatically

• IP address
• Browser type, device type, operating system
• Approximate geographic region (derived from IP)
• Server logs of pages visited and requests made
• Cookies — described in Section 10. We use a minimal set: a session cookie to keep you signed in, and one helper cookie (hs_has_listing) that helps us route you to the right page after login.

We do notcurrently process “special categories” of personal data (Art. 9 UK GDPR — health, biometrics, political opinions, religion, sexual orientation, etc.) and ask that you not include such data in free-text fields, photos, or messages.

The table below maps each purpose to the legal basis under Article 6 of the UK GDPR (and, where it applies, the EU GDPR).

• Creating and operating your account — performance of a contract (Art. 6(1)(b)).
• Publishing your listing and matching it to other users — performance of a contract (Art. 6(1)(b)).
• Sending transactional emails (account confirmations, password resets, message notifications) — performance of a contract (Art. 6(1)(b)).
• Sending the “new listings match your wishlist” email — legitimate interest (Art. 6(1)(f)) in informing you about content directly relevant to the service you signed up for. You can opt out at any time from your account settings.
• Keeping the Service available, secure, and fraud-free — legitimate interest (Art. 6(1)(f)).
• Complying with legal obligations (responding to lawful requests from authorities, preserving accounting records) — legal obligation (Art. 6(1)(c)).
• Defending legal claims — legitimate interest (Art. 6(1)(f)).

Where we rely on legitimate interest, we have weighed it against your rights and freedoms and concluded our interest does not override them. You can object to any processing based on legitimate interest by writing to hello@freehomeswaps.com.

We do not sell your personal data, and we do not share it for advertising purposes. We use a small number of trusted service providers (“data processors”) who act only on our instructions and are bound by data protection agreements:

• Supabase, Inc. — provides our database, file storage, and authentication infrastructure.
• Resend, Inc. — sends our transactional and notification emails on our behalf. Receives your email address and the email content for the duration needed to deliver the message.
• Other users of the Service — your listing, profile name, profile photo, about-text, social links (if you provide them), and the content of messages you send are visible to other signed-in users. Your email and password are never visible to other users.
• Public authorities and law-enforcement — when we are legally required to disclose data (e.g. a binding court order). We will notify you unless legally prevented from doing so.
• Acquirers — if FreeHomeSwaps is sold or merges with another entity, your data may be transferred to the acquirer, subject to this Policy.

Some of our service providers are based outside the United Kingdom and the European Economic Area (“EEA”) — primarily in the United States. Where data is transferred to a country that has not been deemed to provide an adequate level of protection, we rely on appropriate safeguards under applicable data-protection law — typically the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, and, for transfers from the EEA, the European Commission’s Standard Contractual Clauses (Decision 2021/914) — together with technical measures such as encryption in transit and at rest.

You can request a copy of the safeguards in place by writing to hello@freehomeswaps.com.

Retention is purpose-driven. As a guideline:

• Account, profile, and listing data — kept while your account is active. After you delete your account, we soft-delete the content immediately (it stops being visible to other users) and hard-delete it within 30 days, except where a longer period is required by law or to defend a legal claim.
• Messages between users — kept for 12 months after the last message, or until either party deletes their account, whichever comes first.
• Server logs containing IP addresses — kept for 90 days.
• Email-delivery logs— retained per our email provider’s policy, currently up to 30 days.
• Records required by law (e.g. accounting and tax records) — kept for the period mandated by applicable law, typically 6 years under UK law.

Anonymized or aggregated data that no longer identifies you may be kept indefinitely for analytics and product improvement.

We take reasonable technical and organisational measures to protect your personal data, including:

• HTTPS for all traffic between your browser and our servers;
• Password hashing using industry-standard algorithms (handled by Supabase Auth);
• Row-Level Security policies on our database so that users cannot read or modify other users’ data directly;
• Limited internal access to production systems;
• Regular software updates of our dependencies and the platform itself.

No system is perfectly secure. If we discover a personal-data breach that is likely to result in a risk to your rights, we will notify the UK Information Commissioner’s Office (and any other relevant supervisory authority) within 72 hours and inform you without undue delay where required.

FreeHomeSwaps is not directed at children. Our Terms of Service require users to be at least 18 years old. If you believe we have collected personal data from a minor, contact us at hello@freehomeswaps.com and we will delete it.

Under the UK GDPR — and the EU GDPR, where it applies, plus equivalent laws elsewhere — you have the right to:

• Access — obtain a copy of the personal data we hold about you;
• Rectify — ask us to correct inaccurate or incomplete data;
• Erase— ask us to delete your data (“right to be forgotten”), subject to legal retention obligations;
• Restrict — ask us to limit our processing in certain circumstances;
• Object — object to processing based on legitimate interest, including direct marketing;
• Portability — receive your data in a structured, commonly used, machine-readable format;
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing;
• Complain— lodge a complaint with the UK Information Commissioner’s Office (ico.org.uk) or, if you are based in the EU/EEA, with the supervisory authority of your country of residence or work.

To exercise any right, write to hello@freehomeswaps.com. We will respond within one month of receiving the request, as required by the UK GDPR. Some rights may be limited where they conflict with the rights of other users (for example, we cannot delete messages you sent to another user without affecting their record of the conversation).

We use a small set of cookies. None of them are used for advertising or cross-site tracking.

• Authentication cookies — set by Supabase to keep you signed in. Strictly necessary; cannot be disabled without breaking sign-in.
• hs_has_listing — a small helper cookie that records whether your account has an active listing, used to route you to the right page after sign-in. Strictly necessary for routing.

Strictly-necessary cookies do not require your prior consent under the UK Privacy and Electronic Communications Regulations (PECR) or the EU ePrivacy Directive. We do not currently use any analytics or other non-essential cookies. If we add them in the future, we will display a cookie banner that lets you accept, refuse, or manage your preferences before any non-essential cookie is set.

We do not subject you to decisions based solely on automated processing that produce legal effects on you or significantly affect you. Our matching and ranking of listings is automated, but its only outcome is the order in which listings appear in your search — it does not deny anyone access or services.

We may update this Policy from time to time. If we make a material change, we will notify you by email or by posting a notice on the Service before the change takes effect. The “Last updated” date at the top of this page reflects the most recent revision.

For any privacy question, request, or complaint: hello@freehomeswaps.com.

You can also reach the UK supervisory authority directly: Information Commissioner’s Office — Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF — ico.org.uk.

See also our Terms of Service.