Privacy Policy

1. Scope and accountability

This policy applies to personal information handled by HomeKiwi in connection with the website, submissions, verification, publication, correction requests, and business responses.

Operator and privacy lead: To be completed before launch. The privacy lead handles questions, access requests, corrections and complaints. These are practical policy drafts, not legal advice or a guarantee of legal compliance.

2. Information we may collect

Information you provide privately

• Your required first name, gender and verified email for a member account; a last name and an age range are optional. The gender question includes “Prefer not to say”. Gender and age range are used only as totals, to understand who the site serves, and are never published or attached to a post. The site does not ask for your birthday, home address or telephone number. An email code verifies mailbox access, not your legal identity or the accuracy of your contributions. Your public alias is separate from these details.
• Account verification and password-reset requests, expiry times, failed-attempt counters, consent and private security/session records. Passwords are never stored as plain text. Hosted password authentication is handled by Supabase Auth; the local trial uses salted password hashes on this computer.
• Details about a home-service visit, including province or territory, city, service month, work performed, price, duration, quoted terms, and your firsthand account.
• When you choose an invoice, it is previewed in your own browser. You can black out details before uploading; if you do, only the blacked-out copy is uploaded. For text-based PDFs, the browser may suggest the total, tax and service month for you to confirm. This reading happens on your device and nothing is sent until you submit.
• A required invoice for private review and an optional work photo. You may mask your name and home address before submitting. If you separately permit invoice publication, the editor may prepare a flattened, redacted image copy with customer and provider details removed. The uploaded original is never public.
• For comments: your public alias, private email, original comment, public or edited comment and publication permission. An invoice is not required for a comment.
• Information supplied in a correction request, privacy request, or business response.

Information collected automatically after launch

The hosting and anti-spam services may process technical information such as IP address, browser/device information, request time, URL and security logs. The application does not store visitor IP addresses or add advertising trackers. Its page-view counter stores only a UTC date, an allowed public page path and a count; no tracking cookies, persistent visitor identifiers or query strings are stored. Aggregated statistics are visible only to the administrator and measure page loads, not unique people. Turnstile limits spam on experience and comment forms; its provider may process browser signals and related security information.

Separately from analytics, member sign-in uses an essential HttpOnly, same-site session cookie, valid for up to seven days. The hosted cookie is also Secure and sent only over HTTPS. A hash of its random session token is stored privately; it is not used as a page-view tracking identifier. Signing out ends the current session; resetting a password revokes existing sessions. To limit abuse, sign-in, code-request and similar limits use private keyed hashes of the email address and of the visitor IP address. These hashes are not readable IP addresses and are deleted within about 24 hours of their time window ending; the raw IP address is not stored by the application. During sign-in, the visitor IP address is passed to the password-authentication service so its own abuse limits apply to each visitor.

Information we ask you not to provide

Do not submit unnecessary residential addresses, signatures, payment-card or bank information, government identifiers, account credentials, medical information, private contact details, or personal information about children. Redact these details before uploading.

3. Why we collect and use information

We will limit collection and use to purposes a reasonable person would consider appropriate, including:

• Receiving and reviewing a submission requested by you.
• Sending a thank-you / under-review email after receipt and an approval email after the record is first published. These are service messages, not marketing subscriptions.
• Confirming that an account is firsthand and seeking clarification or supporting context.
• Detecting duplicate, manipulated, misleading, abusive, or unsafe material.
• Redacting private information and editing for clarity without materially changing meaning.
• Publishing an approved, minimized service record with your permission.
• Handling corrections, disputes, business responses, security incidents, and legal obligations.
• Producing non-identifying local price ranges and statistics when enough comparable records exist.

We do not sell personal information. We will not add a contributor to a marketing list merely because they submitted a record.

4. What may become public

Experience records always require editorial approval. An approved record may include an alias, category, city, month, work, price, reported duration, disclosed incentives, account and selected work photo. A separately redacted invoice copy can be displayed only with the contributor's invoice-publication permission and editorial review. Permission defaults to No; old submissions without this permission cannot receive a public invoice. Original PDFs/images, real names and email addresses stay private. Public comments display their alias, date and text, not their private email. Comment review is on by default, but the administrator may allow new comments to appear immediately without prior review, and may later edit or remove them. Restoring review affects future comments, not existing public comments.

Version one withholds provider and homeowner identities, logos, employee names and identifying document details. Anonymization reduces exposure but cannot guarantee nobody will recognize an event from its circumstances. Naming providers in a later version would require a separate policy decision and appropriate new consent; it will not automatically reveal identities behind existing records.

The public version will not intentionally include a contributor's home address, private email or phone number, signature, payment information, account number, invoice number, precise household location, or an ordinary technician's unnecessary personal information.

Public material can be copied, indexed by search engines, archived, or shared by others. We cannot guarantee complete deletion from third-party copies after lawful publication.

5. Service providers and disclosures

Information may be processed by vendors that help provide hosting, file storage, email, security, or technical support. They should receive only the information needed for their service and be subject to appropriate confidentiality and security requirements.

Hosting, database, file storage and anti-spam: To be completed before launch.

Contact mailbox: To be completed before launch.

Notification email service: when live sending is configured, Brevo processes the recipient email, notification message, reference number, and approval link. We do not send invoices, attachments, the private contributor name, or the service narrative to the email API. Delivery status and message copies are retained privately to handle failures and prevent repeat sends. Local mode stores previews only and sends no email. The provider may retain delivery logs under its own policies; delivery to an inbox cannot be guaranteed.

Registration and password reset: Brevo also sends short-lived verification codes. The production application stores keyed code hashes rather than readable codes; only the local trial keeps private, clearly marked email previews. Supabase Auth processes the email and password for hosted password storage and sign-in. Your name, gender and age range stay in the site's private profile database and are not sent to Supabase by this integration. Final authentication-provider and region details: To be completed before launch.

Cloud services may process information outside Canada. The final provider and location information must be checked before collection opens. Do not assume that this site offers Canada-only data storage.

Personal information may also be disclosed when required by law, to obtain legal advice, to address a credible safety or security concern, or to investigate suspected fraud or misuse. We will not disclose a contributor's identity to a reviewed business merely because the business asks; any disclosure will be assessed under applicable law and the circumstances.

6. Retention and deletion

• Member profiles are retained while needed to operate the account. Contact the privacy operator for access, correction or deletion requests. On a verified deletion request, the editor deletes the member profile, sessions and hosted sign-in record, and reviews your posts and comments for removal; profile details and independently needed publication evidence may have different retention requirements. A profile request does not automatically remove copies of content already saved by other people.
• Verification codes expire after 10 minutes and allow at most five attempts. Password-setup grants also expire after 10 minutes and are single-use. Expired challenge records and local email previews become eligible for deletion 24 hours after expiry and are cleaned on subsequent code-request activity; no background cleanup job is installed. Expired sign-in sessions are removed during subsequent account activity.
• Rejected, withdrawn or no-longer-needed pending submissions are reviewed for deletion within 90 days, subject to legal retention requirements. Hiding or rejecting a record does not itself delete the private evidence.
• Evidence supporting a published record may be retained while the record is public and for up to 12 months afterward to manage corrections or disputes.
• Information may be retained longer when reasonably necessary for security, legal obligations, an active dispute, or the establishment, exercise, or defence of legal claims.
• Where applicable Canadian privacy law (for example PIPEDA, or a provincial law such as BC PIPA) requires information used to make a decision directly affecting an individual to be retained for a minimum period, that requirement takes priority over shorter schedules.
• When retention is no longer reasonably necessary, information will be destroyed or de-identified.

7. Safeguards

Safeguards include private queues, server-side authorization, private original attachments, consent checks, explicit public-copy selection, image-only flattened invoice copies with metadata removal, input/upload limits, and recorded editorial changes. The editor manually checks every public-copy page, including provider identity. This is not automatic identification or a guarantee that no detail was missed. The operator must protect credentials, maintain backups and review retention. Uploads are not automatically virus-scanned.

No online system is completely secure. Contributors should keep their own originals and submit only the minimum material needed to support a record.

8. Access, correction, consent, and complaints

You may ask what personal information we control about you, how it has been used or disclosed, and request correction of an error. You may also withdraw consent, subject to reasonable notice and legal or evidentiary obligations. We may need to verify your identity before responding.

A contributor may request removal of a public record. The request will be considered under the Correction and Response Policy; removal is not automatic when continued retention or an explanatory correction is reasonably required.

Submissions are limited to adults aged 18 or older. The site is intended for a general audience and does not knowingly solicit personal information from children.

9. Privacy Contact

Drafted with reference to the BC Personal Information Protection Act. This policy may change before launch and as the service, hosting, or legal requirements change.