Rooms and flatmates, anywhere in India
Privacy Policy
MyFlat Homes is a marketplace for shared housing in India. People list a spare room or flat, other people post that they are looking for one, and the two sides connect. This policy explains exactly what personal data we collect to make that work, who can see it, how long we keep it, and how you get it deleted.
We do not sell your personal data. We do not share it with advertising networks. We do not run third-party advertising or analytics SDKs in the app.
1. Who is responsible for your data
MyFlat Homes is operated by the MyFlat Homes team, which acts as the data fiduciary for the personal data described here under India's Digital Personal Data Protection Act, 2023. For any privacy question, request or complaint, write to support@zygonich.com — that address is also our grievance contact and is monitored by a person, not an autoresponder.
2. What we collect
Everything in this table is collected because a specific feature needs it. Nothing here is optional-but-collected-anyway.
| Category | Fields | Why |
|---|---|---|
| Account | Email address, password, and phone number if you sign up with one | To create and secure your account. Authentication is handled for us by Supabase — your password is hashed by them and is never visible to us or stored on our servers. |
| Profile | Name, phone number, short bio, occupation, gender, date of birth, profile photo | So the other side of a match can tell who they are dealing with. Every field except your name and email is optional. Your date of birth is never displayed — we show an age in years. |
| Room listings | Title, description, rent and deposit, city, property and room type, furnishing, bedrooms, bathrooms, occupancy, amenities, availability date, and the photos you upload | To show your room to people searching in your city. |
| Finder posts | Budget range, city, the flatmate gender you are open to, an age range, lifestyle tags (cleanliness, pet-friendliness, food preference) and a free-text note | To show what you are looking for to people with a room in that city. |
| Enquiries | The message you send about a listing, and whether it was accepted or declined | To deliver your enquiry to the owner and let them decide on it. |
| Saved listings | Which listings you bookmarked | So your shortlist is there next time you open the app. |
| Technical | IP address, app or browser user-agent, request timestamps and error logs | To keep the service running, debug failures, and detect abuse. We also store the IP address and user-agent attached to an account-deletion request submitted from our website, so that we can spot someone abusing that form to target other people's accounts. |
We do not collect your precise location. Matching is city-level only: you pick a city and see the records in it. There is no GPS tracking, no background location and no radius search.
3. Who can see what
This is the part most people care about, so it is stated plainly.
Visible to other signed-in users
- Your display name, profile photo, age in years, occupation and bio
- Your listings and finder posts in full, including the photos and the city
Never visible until you choose
- Your email address and phone number. When someone enquires about your room, they see their own message and nothing else of yours. Contact details are released to them only once you accept that enquiry — and their details are released to you at the same moment. Decline it, and neither side learns anything.
- Your date of birth. Only a rounded age is ever rendered.
4. How we use your data
- To run the core product: publishing listings and finder posts, matching them by city, and delivering enquiries.
- To reveal contact details between two people once one of them accepts an enquiry.
- To keep the service secure — rate limiting, abuse detection and fraud prevention.
- To answer you when you contact support.
- To meet legal, tax and accounting obligations.
We do not use your data to build advertising profiles, and we do not make automated decisions that produce legal effects for you.
5. Who we share it with
Only these processors, only for the purpose named, and none of them may use your data for their own purposes:
| Who | What they receive | Why |
|---|---|---|
| Supabase | Email address, phone number, password hash, name | Authentication — sign-up, sign-in and session management. |
| Google Maps Platform | The city or place text you type into a search box | City and place autocomplete. No account identifier is sent with it. |
| Google Play | Whatever Google collects when you install or update the Android app | App distribution. Governed by Google's own privacy policy, not ours. |
| Apple App Store | Whatever Apple collects when you install or update the iOS app | App distribution. Governed by Apple's own privacy policy, not ours. |
Beyond those, we disclose personal data only when we are legally compelled to — a valid court order, a lawful request from a government authority, or where disclosure is necessary to protect someone's safety or our legal rights.
6. Where your data is stored
Your listings, profile and enquiries are stored in our own database on a server we control. Your authentication record is stored by Supabase. Some of these providers operate infrastructure outside India, which means your data may be processed abroad; we only use providers that offer contractual data-protection terms.
7. Security
- Passwords are hashed by Supabase and are never stored or seen by us.
- Every API call other than the public health check requires a signed, expiring access token.
- Contact details are gated behind an accepted enquiry at the database query level, not merely hidden in the UI.
- Access to production infrastructure is restricted to the operators who run the service.
No system is perfectly secure, and we cannot guarantee absolute security. If we ever discover a breach affecting your personal data, we will notify you and the Data Protection Board of India as required by law.
8. How long we keep it
- While your account is open — your profile, listings, finder posts, enquiries and saved listings are kept so the product works.
- When you delete your account — the data above is erased from the live database immediately. Copies may persist in our database backups until those backups are rotated, which happens within 30 days. We do not restore deleted accounts from a backup.
- Server logs — retained for a short operational window and then rotated out.
9. Your rights
Under the Digital Personal Data Protection Act, 2023, you can:
- Access the personal data we hold about you.
- Correct anything inaccurate — most of it you can edit yourself from your profile.
- Erase your account and data. See Delete your account, or use Profile → Delete account in the app for immediate deletion.
- Withdraw consent for any optional processing.
- Complain — write to support@zygonich.com first. If we have not resolved it to your satisfaction, you may escalate to the Data Protection Board of India.
We respond to rights requests within 30 days.
10. Children
MyFlat Homes is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has created an account, tell us at support@zygonich.com and we will remove it.
11. Changes to this policy
If we change this policy we will update the date at the top of this page and, for any change that materially affects your rights, notify you in the app before it takes effect. This page is always the current version.
12. Contact us
Privacy questions, data requests and complaints: support@zygonich.com
We aim to reply within 7 days and to resolve requests within 30 days.