Privacy policy
This policy explains what HomeTour IRL collects through provider profiles, short videos, discussions, reactions, and private messages, and how that information is used. It is a working site policy and should be reviewed by an attorney for the locations where the service operates.
Information you provide
- Business accounts: HomeTour IRL stores your account email, display name, salted password hash, and a hash of your recovery code. Passwords and recovery codes are not stored as readable text. A secure, HTTP-only cookie keeps your business session active for up to 30 days. Login attempts are rate limited using hashed identifiers. Account emails stay private unless separately added to a public profile. Password recovery uses the code shown when an account is created or reset; email resets are not available yet.
- Other sign-in features: the site receives an authenticated ChatGPT account identifier and, when available, display name and email for account security and support. Email addresses are not shown in private-message threads.
- Provider profiles: business or property name, category, service area, contact details, website and application or quote links, profile description, price, credentials, photos, videos, and blank application forms.
- Community activity: comments, emoji reactions, comment reports, and the account identifier associated with each action.
- Private messages: message text, sender display name, conversation participants, timestamps, and read status. A conversation is visible to the customer and the provider account linked to that profile.
- Guest conversations: Visitors may start a provider message without ChatGPT sign-in. HomeTour IRL stores a random session identifier in a secure, HTTP-only browser cookie for up to 30 days so the same browser can return to the conversation; the cookie token is stored as a hash on the server. Access is tied to that browser and may be lost if its cookies are cleared or the visitor switches devices.
- Privacy requests: the request type, details you submit, and the signed-in account email and identifier so the site owner can review it.
What is public
Approved provider profile details, uploaded profile photos, short videos, and blank application PDFs are publicly viewable. Contact fields are labeled as public in the provider form. Short comments and reactions are visible to visitors. Private messages are not displayed on public profiles or in the public feed.
How information is used
HomeTour IRL uses this information to operate accounts, profiles, uploads, search and category feeds, conversations, moderation, safety controls, and support. Authorized site administrators may access stored records to investigate reports, review provider submissions, address privacy requests, and maintain the service.
Service providers and legal requests
Information is processed by the hosting, database, file-storage, and sign-in providers needed to run HomeTour IRL. Information may also be disclosed when required by law or when reasonably necessary to protect users, the service, or legal rights. HomeTour IRL does not sell profile or message data.
Retention and security
Records and files are retained while needed to provide the service, preserve moderation history, protect the community, and meet legal obligations. The site uses access controls and stores provider access codes as non-reversible hashes. No online service can promise perfect security; do not send Social Security numbers, financial account details, completed applications, or identity documents through the site.
Your choices and requests
You can choose what public contact details and content to include in a provider profile, update a profile you control, and stop using the messaging and discussion features. Use the form below to request access to, correction of, or deletion of information associated with your signed-in account. Submitting a request creates a record for administrator review; it does not automatically delete data. Some information may need to be retained for safety, legal, or moderation purposes.