Privacy Policy

This policy explains what personal data My Home Journey collects, why we collect it, who we share it with and what rights you have. We have written it in plain English rather than legal boilerplate, because a privacy policy nobody can read protects nobody.

1. Who we are

My Home Journey is a service provided by Property Link Homes Limited, a company registered in England and Wales under company number 05234968, whose registered office is at 10–10a North Street, Ripon, North Yorkshire, England, HG4 1JY.

For the purposes of UK data protection law we are the data controller for the personal data described here. We are registered with the Information Commissioner's Office under registration number Z9113905.

For any privacy question, or to exercise any of the rights below, contact info@propertylinkhomes.com.

2. What we collect and why

We only collect what the service actually needs. Everything below is either given to us by you or generated by your use of the app.

3. Your financial information

Income, outgoings, savings and credit score are sensitive in the everyday sense, even though UK GDPR does not class them as “special category” data. We treat them accordingly: they are held under row-level security so that only your account and authorised Property Link Homes staff can read them, and they are encrypted in transit and at rest.

You enter these figures yourself and you can change or clear them at any time in the app. We do not obtain them from credit reference agencies and we do not run credit checks. The credit score shown is the one you tell us.

4. Who we share it with

We use a small number of suppliers to run the service. They process data on our instructions under a written contract, and cannot use it for their own purposes.

• Supabase — database, accounts and authentication. Your data is stored in their Ireland (EU) region.
• Vercel — hosting and delivery of the app, plus cookieless usage analytics if you have turned that on.
• Resend — sends the account emails (confirmation codes, sign-in codes, password resets). Receives your email address and the content of those emails.
• Cloudflare — the “are you human?” check on our sign-in and sign-up forms. Receives your IP address and browser information, not your account data.
• Your chosen estate agent — Property Link Homes staff and the agency you selected can see your profile and journey progress in order to support you.

We will also disclose data where we are legally required to, for example in response to a valid court order.

Password checking

When you set a password we check it against a public list of passwords exposed in known data breaches. This is done in a way that never transmits your password: your browser hashes it and sends only the first five characters of that hash to the Have I Been Pwned service, which cannot identify the password or you from it.

5. Where your data is held

Your account and journey data is stored in the European Union (Ireland). Some suppliers, including Vercel and Cloudflare, operate global networks and may process limited technical data such as IP addresses outside the UK and EU. Where that happens it is covered by the UK International Data Transfer Addendum or Standard Contractual Clauses, which are the safeguards UK law requires.

6. How long we keep it

• Account and journey data — while your account is open, and deleted when you delete your account.
• Security logs and failed sign-in records — up to 12 months, then deleted. Failed sign-in counters clear within days.
• Bug reports — up to 24 months after the issue is resolved.
• Records we must keep by law — for the period the relevant law requires, typically six years for financial and tax records.

Deleting your account removes your profile, journey progress, saved articles, targets and trusted devices immediately and permanently. We cannot recover it afterwards. You can delete your account in the app, or on the web — even if you no longer have the app — at Delete your account.

7. Your rights

Under UK GDPR you have the right to:

• Access a copy of the personal data we hold about you.
• Correct anything inaccurate.
• Delete your data (the “right to be forgotten”).
• Restrict or object to how we use it, including profiling.
• Portability — receive your data in a machine-readable format.
• Withdraw consent at any time, where we rely on consent.

You can exercise the main ones yourself, immediately, in the app: Profile → Privacy & Security has a one-click export of your data as a JSON file and your privacy choices, and Profile → Edit Account → Danger Zone deletes your account and data (or use our account deletion page). For anything else email info@propertylinkhomes.com and we will respond within one month, as the law requires.

8. Cookies and local storage

We do not use advertising or tracking cookies, and there is no third-party ad technology in this app. What we do use:

• Essential cookies — set by Supabase to keep you signed in, and a short-lived cookie used when staff view a client's account. Without these the app cannot work, so they do not require consent and cannot be turned off.
• Local storage on your device — remembers your theme, and holds a random token identifying this browser as one you have verified by email, so you are not asked for a code every time. This never leaves your device; only a one-way hash of the token is stored on our servers.
• A copy of your account on your device — so the app opens and works without a connection, it keeps a copy of your profile and journey figures on your phone or browser, plus any changes you made offline until they have been saved to our servers. This copy is removed when you sign out. Your phone's own lock screen and encryption protect it.
• Cloudflare Turnstile — sets a short-lived token while checking that sign-in attempts come from a real browser. Strictly necessary for security.
• Usage analytics — Vercel Analytics, which is cookieless and does not store anything on your device or build a profile of you. It is off by default and only runs if you switch it on in Profile → Privacy & Security.

9. How we protect it

• Encrypted in transit (HTTPS everywhere) and at rest.
• Row-level security in the database, so one account cannot read another's data.
• An emailed code required whenever your account is accessed from a new device.
• Passwords stored only as salted hashes, checked against known breach lists, never visible to us.
• Automatic lockout after repeated failed sign-ins, and bot protection on our forms.
• An audit log of security-relevant events.

No system is completely secure, and we do not claim otherwise. If a breach occurs that is likely to put your rights at risk, we will tell the ICO within 72 hours and tell you without undue delay.

10. Children

This service is for adults buying a home. It is not intended for anyone under 18 and we do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.

11. Changes to this policy

If we change this policy materially we will tell you in the app or by email before the change takes effect. The date at the top always shows the current version.

12. Complaints

Please come to us first at info@propertylinkhomes.com — most things are quickest to fix directly. You also have the right to complain to the Information Commissioner's Office at any time:

ico.org.uk/make-a-complaint · helpline 0303 123 1113

See also our Terms of Use.