Privacy policy

Who we are

HomeforU is a property marketplace for India. It is run by Lakshya Pratap Singh. For the personal data this page describes, we decide why and how it is used: in the words of the DPDP Act, we are the Data Fiduciary.

For any question about this policy, to use one of your rights or to complain, write to the contact page of this website.

When you browse

You can read and search the public pages without telling us who you are. This is what still happens when you do:

• No cookies. The public pages set no cookies and read none. They show no advertising, run no analytics and load no script or widget from an advertising, analytics or social-media service.
• Server logs. Like any web server, ours writes a line for each request: your IP address, the date and time, the address that was asked for, the answer code, the size of the answer, the page that linked to it and your browser's name and version (the user agent). We use the logs to run the service, find faults and stop abuse. The unsubscribe secret of an alert email, the query of a request to the alerts service and the list of homes you saved (described below) are replaced by a placeholder before the line is written. When the hidden anti-spam field of a form is filled in, which only a program does, our API also notes the sender's IP address in its own log (shortened for the alerts form). We have not yet set a fixed time after which logs are deleted; we keep them only as long as we need them for these purposes.
• Request counters. To stop abuse, our web server and our API count requests per IP address for a short time, in memory. The counters are not saved in our database.
• The map. The map of the search page is drawn from map tiles that your browser fetches directly from tile.openstreetmap.org. That service sees your IP address and the part of the map you look at, and its own privacy policy applies to it. We send it nothing else.
• Your browser's storage. The homes you save with the heart and the last places you chose in the search box are kept in your browser's local storage, on your device (see the next section). It is not a cookie; it stays on your device, except for the one case described in the next section. The pages that alert emails open also keep the secret of the link in your browser tab, in its session storage, so that a reload still works; it is removed when you close the tab.

Homes you save with the heart

A home you save with the heart is kept only in your browser, on your device: its listing number, when you saved it and its price then, for up to 100 homes. The list expires 90 days after you last changed it, and you can clear it at any time by clearing the site's data in your browser. The last 6 places you picked in the search box are kept the same way.

When you open the saved homes page, your browser sends the listing numbers to our server so that it can answer with each home's current details and price. Our API only answers: it does not store the list, and the numbers are not written to our server log. If you later ask for price-drop emails for your list, the numbers are stored as described under email alerts.

Enquiries to an agency

The form on a property page sends your enquiry to the agency that listed the home.

• What we collect. Your name and mobile number (both required) and, if you wish, your email address, a message of up to 2000 characters and a preferred date if you ask for a site visit. We also record which home you asked about and when.
• Why. To pass your enquiry to that agency, so that it can contact you about the home by phone, WhatsApp or email and arrange a visit. You send the form yourself; sending it is your request to be contacted. The agency's system also gives each enquiry a score, worked out from how complete your details are, whether you asked for a visit, how long your message is, whether the home is for sale and whether you enquired more than once. The agency sees it as hot, warm or cold, to decide whom to contact first.
• Who sees it. The agency that listed the home, which gets a notification in its account and, if its email notices are on, an email with these details, and HomeforU's administrators, who can see every enquiry. The email goes through our email provider (see Who else handles your data). We do not send you a confirmation email.
• How long. We do not delete enquiries automatically: an enquiry stays in the agency's list until the agency or we delete it. Write to the contact page of this website and we will delete yours from our system. Once an agency has contacted you, what it keeps is its own business; ask it directly.

Email alerts and saved searches

On the search page you can ask for an email when new homes match a search, and for price-drop and no-longer-available notices about homes you saved. To get them you give your email address, tick a box that is never ticked for you, and confirm by pressing a button on the page that our confirmation email links to. Until you confirm, we send only the confirmation email.

What we collect and keep

• Your email address and the language you chose.
• The searches you save (their filters, a name and how often you want emails) and the homes you save for alerts, with their price when you saved them.
• The record of your consent: the version of the notice you agreed to and a code of its exact words, when you ticked the box and when you confirmed, how you did it, the first part of your IP address (the last number of an IPv4 address is dropped; an IPv6 address keeps its first 48 bits) and your browser's user agent text. Each time you agree, confirm, withdraw or delete is added to a consent log with the same details.
• Dates: when we last emailed you, and when you last confirmed, pressed “Keep my alerts” or changed something on the manage page. They decide when we ask whether you still want the emails.
• A record of the homes we have already told you about, so that you are not told twice.
• Copies of our emails in the sending queue: the text of an email is removed as soon as it has been sent; its address, subject and result stay for a while (see the table).
• We do not track whether you open an email or click a link: the emails contain no tracking images, and the links to homes are the same for everyone. The photos of homes in an email are loaded from our own server, at the same address for everyone, so they do not identify you; like any request to our server, a request for a photo is written to the server log.

Why, and on what ground

Only to email you what you asked for: the confirmation, new homes that match a saved search (every day or every week, as you chose), price drops, a note when a saved home is no longer available, and, if you have not confirmed, pressed “Keep my alerts” or changed anything for 180 days, one message asking whether you still want the emails. We do not use your address for advertising, and we do not share it with agencies or anyone else for their own use. Our ground is your consent: the box you tick and the confirmation you give.

Stopping is as easy as starting

Every email has an unsubscribe link, and mail apps show their own unsubscribe button as well. One click on the page it opens is enough; there is nothing to type or remember. The manage page offers the same. The unsubscribe link in an email never expires; the link to the manage page works for 90 days. After you unsubscribe, no further email is sent.

How long we keep it

A keyed hash is a scrambled code of an address, made with a secret key that we keep. It contains no address and cannot be read as one.

Who else handles your data

We do not sell personal data and we do not give it to advertisers. These parties handle data for us or with us:

• Agencies. An agency receives the enquiries sent to it (see above).
• Email delivery. We use an email delivery service to send our emails: confirmations, alerts and the notice an agency gets about an enquiry. It receives the address, the subject and the text of each email in order to deliver it, and acts on our instructions. Write to the contact page of this website if you want to know which service it is.
• Hosting. Our servers and database are run for us by a hosting provider and hold all the data described on this page. Write to the contact page of this website for details.
• Map tiles. tile.openstreetmap.org, as described under When you browse.
• Error monitoring. When it is switched on, a service called Sentry receives reports of failures of our API. A report about the alerts service has its personal data removed before it leaves our server: the IP address, the query string and body of the request, cookies and headers, and any link secret or email address found in its text. A report about another part of the API is cleaned less: credentials, link secrets and email addresses are removed from it, but it can still carry other details of the request that failed.

Children

HomeforU is for adults. Email alerts are for people aged 18 or over, and the box you tick says so. We do not knowingly collect personal data about anyone under 18, and nothing on the public pages tracks visitors or shows them advertising. If you believe a child's data has reached us, write to the contact page of this website and we will delete it.

Your rights and how to use them

The DPDP Act gives you these rights. This is how to use them:

• See your data. On the manage page of your alerts, the download button gives you a file with everything we hold for the alerts: your address and language, your searches and saved homes, the record and the log of your consent (with the IP prefix and browser text we recorded) and the dates described above. For an enquiry to an agency or anything else, write to the contact page of this website.
• Correct it. On the manage page you can rename a search, change how often it is sent, switch price drops on or off, remove searches and saved homes, and change the language of the emails. To correct your email address, sign up again with the right one and delete the old data, or write to the contact page of this website.
• Delete it. On the manage page, the delete button removes your address, searches, saved homes and queued emails at once. We keep the consent log for 3 years, with a line saying that the data was deleted (it holds a keyed hash of your address, not the address) and, if you had unsubscribed, the keyed hash on the suppression list. To delete an enquiry or anything else, write to the contact page of this website.
• Withdraw your consent. Use the unsubscribe link in any email, or the stop button on the manage page. No email is sent to you after that.
• Complain to us. Write to the contact page of this website and say what happened and which email address or phone number it concerns. We will answer within 7 days.
• Complain to the Board. If you are not satisfied with our answer, you can complain to the Data Protection Board of India. The DPDP Act asks you to use our grievance route first.

How we protect it

What we do today to protect the data above:

• The links in alert emails keep their secret after the # sign, a part of the address that browsers never send to a server. The one exception is the one-click unsubscribe address that mail apps call themselves; it is hidden in our server logs.
• The text of an email, which contains those links, is removed from our sending queue as soon as the email has been sent.
• An address on the suppression list and in the consent log is kept as a keyed hash, not as an address. The IP address kept as proof of consent is shortened.
• You confirm an alert by pressing a button, not by opening a link, so a program that scans your mail cannot confirm for you.

No system is perfectly secure. If you think your data has been exposed, write to the contact page of this website.

Changes to this policy

When we change this policy we change its version and date at the top of the page. The notice next to the box you tick for email alerts has a version of its own, recorded with your consent; the current one is 2026-10-14. If we want to use your data for a purpose you have not agreed to, we will ask you first.