Privacy
Not yet legally reviewed. Draft — written from this site's actual data handling and not yet reviewed by a lawyer.
This describes what this site actually stores and shows, written from the code that does it. The short version: your name, contact details and anything you write in a note are never on a public page, and the public boards carry banded summaries only.
What is public, and what is not
Public. If you post a housing need and tick the consent box, the needs board shows a banded summary: household size, bedrooms needed, budget range, roughly how long, a broad area, and whether you have pets. If you post housing, the board shows the title, general area, bedrooms, bathrooms, price, how long it is available, your description, and whether pets or accessibility features are mentioned.
Never public. Your name, email address, phone number, exact address, accessibility requirements, and any private note. There is no public page and no public interface that returns these — the public views do not select those columns at all.
Untick the consent box and your request is not on the board at all. You can still browse housing and send messages.
Messages
Conversations are between the two participants. The database refuses a message write from anyone who is not a participant in an open thread, so this is enforced by the data layer rather than by the interface.
An administrator can read a conversation only while an open report filed by one of its two participants names that conversation. A report from a non-participant does not grant access. Administrators cannot write into anyone’s conversation.
When an operator sees your contact details
Operators work from summaries that contain no name, email, phone or notes. Seeing your contact details is a separate, deliberate action that requires choosing a reason from a fixed list, and it writes a permanent record of who looked, at which request, when, and why.
Application accounts, including administrators, cannot edit or delete that record.
Third parties
Hosting and the database are provided by Vercel and Supabase, who necessarily process the data you submit in order to run the site. Authentication is handled by Supabase.
Where the site links to an outside organisation — a property manager, a fundraiser, a resource page — Spokane Fire Housing sends no account, form, listing or household data. The outside site receives ordinary connection metadata, as any website does when you visit it, and applies its own privacy policy. Outbound links are marked so your browser does not tell the destination which page you came from.
Email delivery, spam protection and analytics providers are not yet configured. When any of them are, this page will name them before they are switched on.
Cookies and session storage
A session cookie keeps you signed in, and is cleared when you sign out. The authentication library stores the session in a SameSite=Lax cookie that the site’s own JavaScript can read — it is not marked HttpOnly, because the sign-in code in your browser has to read it. In production it is marked Secure, and the site uses HTTPS and HSTS. The Content Security Policy limits which scripts may run.
SameSite=Lax means another site cannot quietly use your session in a background request, but it does not mean the cookie is never sent when you arrive from elsewhere: following an ordinary link to this site does send it, which is what keeps you signed in when you click through from a search result or a message.
There are no advertising or tracking cookies.
Keeping and deleting information
A housing need expires after 30 days and a listing after 21 unless you renew it. Closing a post is final and takes it off the board immediately.
Records of moderation decisions and of the contact-detail disclosures described above are kept deliberately and are not editable from the application, because a record an operator can quietly change is not a record.
To correct or delete your information, write to the support address at the top of this page from the address on your account.
Age
This site is for adults arranging housing. Do not create an account if you are under 18. It is not designed for children and does not knowingly keep information about them.
What this cannot promise
No online service can promise it will never be breached. What this site does instead is hold as little as possible: the public boards carry banded summaries, contact details sit behind an audited action, and nobody — including the people running it — browses households’ phone numbers as a matter of routine.
Anything you type into a message is visible to the person you send it to. Think about that before sharing an address.