Privacy policy

Homes District ("Homes District," "we," "us," "our") operates homesdistrict.com, a real estate marketplace serving the Orthodox Jewish (heimishe) community. Our contact for privacy matters is hello@homesdistrict.com.

Note: Homes District is currently operating under the trade name "Homes District." The governing legal entity will be identified here upon formation.

2.1 Information you provide directly

• Account information: your full name, email address, and password (stored as a cryptographic hash — we never store your plaintext password)
• Phone number: optional. It is not used for text messages — Homes District does not send any. What it is used for is described in Section 5.
• Profile information: bio, profile photo, brokerage affiliation, specialty tags, cities you serve (for agent profiles)
• Listing data: property address, description, price, photos, property details, and all other fields you complete when creating a listing
• Message content: the text and attachments of direct messages sent through the Platform between users
• Payment information: we do NOT receive or store your full credit card number. Promoted listing payments are processed by Cardknox/Sola Payments via their iFields system — an iframe that submits card data directly to Cardknox servers. We receive only a masked card number (e.g., XXXX-XXXX-XXXX-1234), a transaction reference number, and an authorization token.
• Communications with us: emails and messages you send to hello@homesdistrict.com or through support channels

2.2 Information collected automatically

• Usage data: pages visited, features used, listings viewed, searches performed, time and duration of visits
• Device and technical data: IP address, browser type and version, operating system, device identifiers, referring URL
• Cookie and tracking data: see our Cookie Policy for full details on what we set and how long it persists

2.3 Information from third parties

If you sign in via Google OAuth, we receive your name, email address, and profile photo from Google, subject to Google's Privacy Policy. We do not receive your Google password or access your Google account beyond authentication.

We use the information we collect to:

• Create and maintain your account and authenticate your identity
• Display your listings to potential buyers and renters
• Facilitate direct messaging between buyers, renters, and sellers
• Process promoted-listing payments (via Cardknox/Sola)
• Send transactional emails: listing submission confirmation, approval/rejection notifications, listing expiry reminders, new message notifications (via Resend)
• Analyze how the Platform is used to improve features and performance (via PostHog and Google Analytics 4 — only when you have consented to analytics cookies)
• Detect and prevent fraud, abuse, spam, and violations of our Terms of Service
• Comply with applicable law, respond to legal process, and enforce our Terms
• Respond to your support inquiries and requests

We do not use your personal information to make automated decisions that produce legal or similarly significant effects without human review.

We do not sell, rent, or share your personal information with third parties for their own marketing or advertising purposes. The only time an advertiser receives your contact details is when you type them into that advertiser's contact form yourself — explained plainly in Section 4.2 below.

4.1 Service providers (sub-processors)

We share data with the following vendors who process it strictly on our behalf, bound by data processing agreements:

• Supabase (AWS-hosted, us-east-1 region): database, authentication, and file storage. Your account data, listing data, messages, and photos are stored on Supabase infrastructure running on Amazon Web Services. Supabase Privacy Policy ↗
• Vercel: application hosting and global CDN. All web requests to homesdistrict.com route through Vercel's infrastructure. Vercel Privacy Policy ↗
• Resend: transactional email delivery. Resend receives your email address and the content of transactional emails we send you. Resend Privacy Policy ↗
• Cardknox / Sola Payments: payment processing for promoted listings. Cardknox processes card transactions and stores cardholder data in their PCI DSS-compliant environment. Homes District does not receive or store full card numbers at any point. Cardknox Privacy Policy ↗
• PostHog: product analytics. PostHog receives pseudonymized usage data (pages visited, features clicked, session recordings with all inputs masked) when you consent to analytics cookies. PostHog Privacy Policy ↗
• Google Analytics 4 (Google LLC): web analytics. When you consent to analytics cookies, GA4 receives usage data including pages visited, browser type, approximate city-level location (inferred from IP — not GPS), and device information. We use Google Consent Mode v2; no analytics data is collected before you consent. Google Privacy Policy ↗
• Cloudflare: CDN, DDoS security, and self-hosted map tile delivery (Protomaps). Cloudflare processes your IP address and request headers for routing and security purposes. Cloudflare Privacy Policy ↗

4.2 Advertisers (sponsored lenders and service providers)

Some pages — for example the calculators and the listings page — show sponsored cards from lenders and other service providers. Here is exactly what an advertiser does and does not receive:

• Browsing is anonymous to advertisers. Viewing a page with a sponsored card, running a calculation, or clicking "Use in calculator" sends no personal information to the advertiser. We count ad views and clicks in aggregate (for example, "this ad was clicked 14 times this week") so advertisers can see how their ad performs — those counts contain no names, no contact details, and nothing that identifies you.
• Your contact details go to an advertiser only when you submit them yourself. If you choose to fill out an advertiser's contact form (such as "Get this rate"), the name, phone number, and optional email you type in are sent to that one advertiser so they can respond to you — and to no one else. We never attach your account email, phone number, calculator inputs, or any other information you did not type into that form.

4.3 Other disclosures

• Other users: when you send a message, the recipient sees your name and message content. When you publish a listing, your listing content is publicly visible. Your email is never directly exposed to other users; your phone number is exposed only in the circumstances described in Section 5.
• Legal compliance: we may disclose your information if required by valid law, court order, subpoena, warrant, or governmental request; or if we believe in good faith that disclosure is necessary to prevent fraud, protect the safety of any person, or enforce our Terms.
• Business transfers: if Homes District is involved in a merger, acquisition, or sale of substantially all of its assets, your information may be transferred as part of that transaction. We will notify you by email and post a prominent notice on the Platform before your information becomes subject to a materially different privacy policy.

Your phone number is optional, and Homes District does not use it to send you text messages — see Section 15. It is never displayed publicly on your profile or in listings.

Your email address is never exposed to other users through the messaging system under any circumstances.

Approved listings are publicly visible to all visitors, including users who are not logged in. The property address, photos, price, description, and all seller-provided details you include in a listing are displayed publicly.

View counts (total page views for a listing) are visible only to you as the listing owner — never shown publicly.

Save counts (how many users have saved a listing to their wishlist) are displayed publicly on the listing detail page as a social-proof signal.

Shabbos and Yom Tov notification scheduling

Out of respect for the communities we serve, Homes District delays delivery of non-urgent notifications (new-message alerts, listing and follow-up reminders) during Shabbos and Yom Tov. We use a conservative Eastern-Time schedule that brackets the observance — holding from before candle-lighting on the eve through after nightfall — and we deliberately err on the side of holding a notification a little longer rather than sending it too early. Time-sensitive messages (phone verification codes) are delivered immediately at all times.

This delay is best-effort, not guaranteed. You remain responsible for any time-sensitive communications during these periods.

Religious beliefs as sensitive data (NJDPA)

Homes District is designed for and marketed to the Orthodox Jewish community. Because of this, your use of the Platform — and in particular your use of features like the Shabbos notification pause — may reveal or confirm religious beliefs. Under the New Jersey Data Protection Act (NJDPA), religious beliefs are classified as sensitive personal data requiring explicit opt-in consent before processing.

We process religious-affiliation signals (such as enabling the Shabbos pause) only to provide the specific feature you requested. We do not use this information for targeted advertising, profiling, or any purpose unrelated to operating the Platform. We do not sell or share religious-belief data with any third party. Enabling the Shabbos notification pause constitutes your affirmative opt-in consent to process that religious-observance preference for the purpose of scheduling your notifications.

We do not market-segment, profile, or make automated decisions based on inferred religious affiliation.

• Account data: retained while your account is active, plus up to 30 days in rolling backups after deletion
• Listing data: active listings retained while your account is active. Expired or rejected listings remain visible in your dashboard. Deleted listings are removed from public view immediately; backup copies are purged within 30 days.
• Messages: retained while both parties' accounts are active, and for a reasonable period thereafter for legal compliance
• Payment records: transaction records retained for 7 years as required by tax and accounting regulations
• Analytics data: PostHog data per PostHog's default retention; GA4 data per Google's default (14 months). We do not retain raw IP addresses in our own systems beyond the session.

We implement administrative, technical, and physical safeguards to protect your personal information, consistent with our obligations under the New York SHIELD Act (NY Gen. Bus. Law §§ 899-aa and 899-bb). Safeguards include: encrypted data transmission (HTTPS/TLS 1.2+), cryptographically hashed password storage (via Supabase Auth), database-level row-security policies, access controls restricting data access to personnel with a need to know, and periodic review of security practices.

In the event of a data breach affecting New York residents' private information, we will notify affected individuals and the required state authorities (NY Attorney General, NY Department of State, NY State Police, applicable consumer reporting agencies) within the timeframes required by NY Gen. Bus. Law § 899-aa — generally no more than 30 days after discovery.

No system is completely secure. If you discover a potential security vulnerability, please report it responsibly to hello@homesdistrict.com before public disclosure.

Biometric data: Homes District does not collect, generate, or process biometric identifiers or biometric information. Photographs uploaded to listings or profiles are stored as images only — we do not perform facial recognition, facial-geometry mapping, or any other biometric analysis on them.

The Platform is not directed to children under 13 years of age, and we do not knowingly collect personal information from children under 13 without verifiable parental consent. If we learn that we have collected personal information from a child under 13, we will delete it promptly.

If you are a parent or guardian and believe your child under 13 has provided personal information to us, contact us immediately at hello@homesdistrict.com. This policy is consistent with the Children's Online Privacy Protection Act (COPPA, 15 U.S.C. § 6501) and the FTC's 2025 amended COPPA Rule.

Depending on your state of residence, you may have some or all of the following rights:

• Access: request a copy of the personal information we hold about you
• Correction: update or correct inaccurate information (most can be updated directly in account settings)
• Deletion: request deletion of your personal information; you may also delete your account from Settings → Account → Delete account
• Portability: request your personal data in a structured, commonly used, machine-readable format
• Opt-out of analytics: decline analytics cookies via the banner on first visit; see our Cookie Policy
• Email unsubscribe: use the unsubscribe link in any marketing email, or manage preferences in Settings → Notifications

To exercise any right, email hello@homesdistrict.com with "Privacy Request" in the subject. We will acknowledge within 5 business days and respond within 45 days (extendable by 45 additional days for complex requests, with notice to you).

We will not discriminate against you for exercising any privacy right.

New York residents

New York residents have rights under the NY SHIELD Act and the NY Privacy Act (where applicable). You may request access to, correction of, or deletion of your personal information as described above. In the event of a breach involving your private information, we will notify you as required by NY Gen. Bus. Law § 899-aa.

New Jersey residents

Under the New Jersey Data Protection Act (NJDPA, effective January 15, 2025), New Jersey residents have the right to: (1) confirm whether we process personal data about you and access it; (2) correct inaccuracies; (3) delete personal data; (4) obtain a portable copy in a readily usable format; (5) opt out of targeted advertising, sale of personal data, and profiling for decisions with significant effects; and (6) appeal our response to a rights request within 60 days of receiving our response. We honor Global Privacy Control (GPC) browser signals sitewide as an automatic opt-out of targeted advertising and analytics sharing. Note: as of July 15, 2026, the NJDPA's notice-and-cure grace period has ended — enforcement is now immediate. To exercise NJDPA rights or submit an appeal, email hello@homesdistrict.com with "NJDPA Request" in the subject.

Connecticut residents

Under the Connecticut Data Privacy Act (CTDPA, effective July 1, 2023, as amended by SB 1295 effective July 1, 2026), Connecticut residents have the right to: (1) confirm whether we process your personal data and access it; (2) correct inaccuracies; (3) delete personal data you provided or that we obtained about you; (4) obtain a portable copy of your data; and (5) opt out of (a) the sale of your personal data, (b) targeted advertising, and (c) profiling for decisions that produce legal or similarly significant effects. We do not sell your personal data. We treat religious affiliation, disability status, and gender-identity information as sensitive data processed only with your opt-in consent. We do not use your personal data to train any large language model or AI model. We honor Global Privacy Control (GPC) browser signals as a valid opt-out of sale and targeted advertising. To exercise these rights, email hello@homesdistrict.com with "Connecticut Privacy Request" in the subject. We respond within 45 days (extendable by 45 additional days with notice). If we deny your request, you may appeal via the same email; if we deny your appeal, you may submit a complaint to the Connecticut Attorney General at portal.ct.gov/ag.

California residents (CCPA/CPRA)

Although Homes District does not currently meet the mandatory CCPA/CPRA thresholds (we do not exceed $26.6M annual gross revenue, do not process personal data of 100,000+ California consumers annually, and do not derive 50%+ of annual revenue from selling personal information), we voluntarily provide California residents the following disclosures:

• We do not sell your personal information
• Analytics cookies (PostHog, GA4) may constitute "sharing" for cross-context behavioral advertising under CPRA — you may opt out via the cookie banner or GPC signal
• You have the right to know, delete, correct, opt-out of sale/sharing, limit use of sensitive personal information, and non-discrimination
• We do not knowingly sell or share personal information of consumers under 16 years of age

Submit California requests to hello@homesdistrict.com with "CCPA Request" in the subject.

Residents of other states

As of June 2026, approximately 20 US states have enacted comprehensive consumer privacy laws (including Colorado, Virginia, Texas, Oregon, Montana, Indiana, Minnesota, and others). Most of these laws apply only above specific thresholds (typically 100,000 state residents or revenue from selling personal data) that Homes District does not currently meet. Regardless, we will honor verifiable requests to exercise access, correction, deletion, portability, and opt-out rights from residents of any US state to the extent required by applicable law. We honor Global Privacy Control (GPC) signals sitewide as an opt-out of sale and targeted advertising — this single control satisfies the universal-opt-out requirement across all states that require it. Email hello@homesdistrict.com with your state and right you are requesting.

Homes District does not sell your personal information to third parties for money or other valuable consideration.

Homes District does not share your personal information for cross-context behavioral advertising. Analytics cookies (PostHog, Google Analytics 4) may qualify as "sharing" under certain state privacy laws. To opt out: (a) decline analytics cookies via the banner on your first visit; (b) clear localStorage for homesdistrict.com and refresh to see the banner again; or (c) configure your browser to send a Global Privacy Control (GPC) signal — we process GPC signals as an automatic opt-out.

Homes District is based in the United States. Your information is processed primarily in US-based infrastructure (Supabase on AWS us-east-1, Vercel). If you access the Platform from outside the United States, your information may be transferred to and processed in the US, where data protection laws may differ from your country of residence.

We use cookies, localStorage, and similar technologies for authentication, functionality, and (with your consent) analytics. For a full list of cookies we set — their names, providers, purposes, and retention periods — see our Cookie Policy.

Transactional emails

Transactional emails (listing submission confirmation, approval/rejection, expiry reminders, new-message alerts, password reset) are sent in connection with your use of the Platform. They are necessary for platform operation and cannot be unsubscribed from without closing your account. Sent via Resend. All emails include our business name and a valid reply address, compliant with CAN-SPAM (15 U.S.C. § 7701).

Marketing emails

Any marketing emails we send include a one-click unsubscribe link and our mailing address. We process opt-out requests within 10 business days and do not send commercial emails to anyone who has opted out.

SMS messages

Homes District does not send SMS text messages. Account verification and all notifications are delivered by email.

The Platform contains links to third-party websites, including partner services on our Partners & Tools page. We are not responsible for the privacy practices or content of those sites. When you leave homesdistrict.com, this Privacy Policy no longer governs your data.

Our Partners page includes affiliate and referral links. Homes District may receive compensation when you sign up through those links. This is disclosed prominently on the Partners page, consistent with FTC Endorsement Guides (16 C.F.R. Part 255). See Section 12 of our Terms of Service for full affiliate and RESPA disclosure.

We may update this Privacy Policy from time to time. For material changes, we will notify registered users by email at least 14 days before the change takes effect and update the "Last updated" date at the top of this page. Continued use of the Platform after the effective date constitutes acceptance.

For non-material changes (typo corrections, clarifications that do not alter data practices), we will update the "Last updated" date without advance notice.

For privacy questions, rights requests, data deletion, or to report a security issue: