Privacy

Public. If you post a housing need and tick the consent box, the needs board shows a banded summary: household size, bedrooms needed, budget range, roughly how long, a broad area, and whether you have pets. If you post housing, the board shows the title, general area, bedrooms, bathrooms, price, how long it is available, your description, and whether pets or accessibility features are mentioned.

Never public. Your name, email address, phone number, exact address, accessibility requirements, and any private note. There is no public page and no public interface that returns these — the public views do not select those columns at all.

Untick the consent box and your request is not on the board at all. You can still browse housing and send messages.

Conversations are between the two participants. The database refuses a message write from anyone who is not a participant in an open thread, so this is enforced by the data layer rather than by the interface.

An administrator can read a conversation only while an open report filed by one of its two participants names that conversation. A report from a non-participant does not grant access. Administrators cannot write into anyone’s conversation.

Operators work from summaries that contain no name, email, phone or notes. Seeing your contact details is a separate, deliberate action that requires choosing a reason from a fixed list, and it writes a permanent record of who looked, at which request, when, and why.

Application accounts, including administrators, cannot edit or delete that record.

Hosting and the database are provided by Vercel and Supabase, who necessarily process the data you submit in order to run the site. Authentication is handled by Supabase.

Where the site links to an outside organisation — a property manager, a fundraiser, a resource page — Spokane Fire Housing sends no account, form, listing or household data. The outside site receives ordinary connection metadata, as any website does when you visit it, and applies its own privacy policy. Outbound links are marked so your browser does not tell the destination which page you came from, and this site additionally sends a no-referrer policy with every page, so no request your browser makes from this site carries the address of the page you were on — not to an outside site, and not to this site’s own analytics.

Analytics. Vercel Web Analytics counts visits to this site’s public pages — the boards, the information pages and the sign-in pages. Only page views are measured: no custom events are enabled anywhere in this site, so nothing this site chose to describe about you is sent.

Pages behind a sign-in are excluded entirely. On the administrator area, your own posts, your conversations, the reporting form, the sign-in callback and the set-a-new-password page, the analytics script is not loaded at all — not loaded and silent, but absent — so those pages produce no analytics request of any kind. A page that is not on the approved public list is treated the same way, whether or not anyone remembered to name it.

What this site decides to send for a measured page is one web address: this site’s own address followed by an approved public path, checked against a fixed list before it is sent — for example https://spokanefirehousing.com/looking. The site’s address is part of it because the measurement is sent to this site’s own server, which already knows which site it is; what the address never contains is a question mark and anything after it, anything after a #, or the identifier of a particular listing. Alongside that address the analytics client adds the page’s route pattern — “/housing/[id]”, the shape rather than the listing — a timestamp, its own version number, and the address of the page you came from, which is empty for any move within this site because of the no-referrer policy described above. Query strings and anything after a # are removed, so a search you typed on the housing board is not transmitted. The one address containing a record identifier — an individual listing page — is reported as “a listing page” rather than as that listing. Anything that does not match the list is not sent in a reduced form; it is not sent at all.

This site does not intentionally include query strings, form contents, messages, account details, names, email addresses, phone numbers, addresses or record identifiers in an analytics event, and the checks described above run in your browser before any request is made.

Vercel, like any server, additionally derives information from the request itself. Its documentation states that a data point may carry the event timestamp, the URL and dynamic path, the referrer, an approximate location (country, region, city), the device operating system and version, the browser and version, the device type, and the analytics script version. It states that visitors are identified by a hash computed from the incoming request rather than by a third-party cookie, that this is discarded after 24 hours, and that the result is aggregated. Those are Vercel’s statements about Vercel’s product, published at vercel.com/docs/analytics/privacy-policy, and this page repeats them rather than making promises on Vercel’s behalf.

Email delivery and spam protection providers are not yet configured. When any of them are, this page will name them before they are switched on.

A session cookie keeps you signed in, and is cleared when you sign out. The authentication library stores the session in a SameSite=Lax cookie that the site’s own JavaScript can read — it is not marked HttpOnly, because the sign-in code in your browser has to read it. In production it is marked Secure, and the site uses HTTPS and HSTS. The Content Security Policy limits which scripts may run.

SameSite=Lax means another site cannot quietly use your session in a background request, but it does not mean the cookie is never sent when you arrive from elsewhere: following an ordinary link to this site does send it, which is what keeps you signed in when you click through from a search result or a message.

There are no advertising or tracking cookies. Analytics sets none either: Vercel’s documentation states that Web Analytics uses no third-party cookies and identifies visitors by a hash of the incoming request instead.

A housing need expires after 30 days and a listing after 21 unless you renew it. Closing a post is final and takes it off the board immediately.

Records of moderation decisions and of the contact-detail disclosures described above are kept deliberately and are not editable from the application, because a record an operator can quietly change is not a record.

To correct or delete your information, write to the support address at the top of this page from the address on your account.

This site is for adults arranging housing. Do not create an account if you are under 18. It is not designed for children and does not knowingly keep information about them.

No online service can promise it will never be breached. What this site does instead is hold as little as possible: the public boards carry banded summaries, contact details sit behind an audited action, and nobody — including the people running it — browses households’ phone numbers as a matter of routine.

Anything you type into a message is visible to the person you send it to. Think about that before sharing an address.