Purly

Privacy Policy

Draft of 2 August 2026. Not yet in force.

This is a DRAFT FOR LAWYER REVIEW. It is not yet a binding policy. It was written by the Purly team to describe honestly what the app actually does today, so that a qualified lawyer can review it. A lawyer has not yet approved it. Purly is not live and holds no real user data yet. Please do not rely on this page until this notice is removed.

14 open items in this draft

Everything below marked [GAP] is unfinished. We list them here so nothing is hidden in the body text.

  1. Who the legal owner of Purly is — not yet decided
  2. A dedicated privacy email address — not yet created
  3. Automatic deletion of ID documents — built but not yet switched on
  4. How long we keep everything other than ID documents — not yet set
  5. Getting a copy of your data — no automatic way yet
  6. Deleting your account — no automatic way yet
  7. Withdrawing your consent — no way to do this yet
  8. Our system for spotting and reporting a data breach — not built yet
  9. The legal basis for storing your data outside your country — lawyer to confirm
  10. Kenya may treat property details as sensitive data — lawyer to confirm
  11. Whether we are registered with your country's data regulator — not yet
  12. A minimum age for using Purly — not yet set
  13. Removing the Google Fonts request from the app — not done yet
  14. Telling you about a safety flag, and appealing an automatic block — not built yet

1. Who we are

Purly is an app for finding, listing and managing property. This policy explains what we do with your personal information.

[GAP 1] The company or person legally responsible for Purly has not been decided yet. A real policy must name them, give their address, and say whether they are registered with the data protection regulator. We will not invent a name here.

2. What we collect, and why

We only collect what the app needs to work. Here is each thing, and the reason for it.

Your account

Your email address, the name you choose to display, and optionally your phone number, a profile photo and a short bio. We need your email to sign you in. Purly has no passwords. We email you a link, and clicking it signs you in. That is the only way to sign in.

Your listings

If you post a property: the title, description, price, photos, the city and area, and a map pin. We also store the exact street address and exact map point separately, and we keep those private. The public listing only shows an approximate location.

Searching and saving

Your saved searches and saved (favourited) properties. A saved search can include a location and a price range. We use saved searches to email you when something matching appears.

Messages and viewings

The messages you send to other users, and any viewing you request or host, including the time and any note you add.

Verification documents

If you ask to be verified, we collect the documents needed for the type of verification you chose. This can include a national ID, a passport, a title deed or other ownership document, a business registration, or an agent licence. Section 3 explains how we handle these, because they need extra care.

Safety information

To protect people from fraud we keep: reports made about listings or users, results of our automatic checks, and a "fingerprint" of each listing photo so we can spot the same photo being reused. If you take a photo inside the app, we also record where the phone was when the photo was taken. Section 5 explains this.

Technical information

We count how often your account calls certain parts of our system, so that nobody can overload or abuse the service.

3. Your ID and ownership documents

This is the most sensitive information Purly holds. We treat it differently from everything else, and you should know exactly how.

  • They are stored in a private area. There is no public web address for your document. It cannot be reached by guessing a link. The storage area has no public read access at all.
  • Only two kinds of people can view it: you, and a Purly reviewer. Nobody else. Other users can never see it.
  • A reviewer must pass two-factor authentication first. A reviewer signs in with their email link and must then enter a code from an authenticator app. Without that second step the system refuses to show them any document.
  • Every view is logged. When a document is opened we record who opened it, why, and when. That record is kept even after the document itself is deleted.
  • The viewer blocks screenshots. On Android, screens that display an ID, a title deed or a private message are marked secure. The system blocks screenshots and screen recording on those screens.
  • The document is never saved onto the reviewer's phone. It is held in memory only while being viewed, and is not written to storage or to any image cache.
  • Access is by a short-lived link. Each view uses a one-off link that expires within a few minutes. Our server checks you are the owner or an approved reviewer before creating it.

4. Who can see what

  • Your live listing, its photos, its approximate location: anyone, including people who are not signed in. That is the point of a listing.
  • Your name, profile photo and bio: other signed-in users can see these.
  • Your exact address: only you, a Purly reviewer, and a person whose viewing you have confirmed.
  • Your phone number: only you and a Purly reviewer. We do not show it on your public profile.
  • Your messages: only you and the person you are messaging. See section 6.
  • Your saved searches and favourites: only you.
  • Your ID and ownership documents: only you and a Purly reviewer, as described above.
  • Whether you are verified, and what type: this is public. Anyone can see that an account holds a verification badge.

5. Automatic safety checks

Property fraud is common and it causes serious harm. Purly checks listings and messages automatically to try to catch it.

We automatically look for:

  • Text patterns common in scams, in listings and in messages.
  • Prices that are far outside the normal range for similar properties.
  • Photos that are duplicates of photos already used elsewhere on Purly.
  • A mismatch between the city you typed and where the map pin actually is.

These automatic checks never decide anything on their own. They only raise a flag for a person to look at. Every decision to warn a user, remove a listing, suspend an account or ban someone is made by a Purly reviewer, who must be signed in with two-factor authentication. The system will not record an enforcement decision without a named person behind it.

There is one exception, and we want to be clear about it. If an account was previously banned, our system can automatically stop that person creating a new account. That check runs without a person involved.

[GAP 14] We do not currently tell you if a flag has been raised about you, and there is no way to appeal an automatic block on creating a new account. A lawyer is advising us on what we must add here.

6. Messages

Two things to know.

The person you message can see what you send. That is obvious, but worth saying: treat a message as something the other person keeps.

We scan message text automatically for scam patterns. This is a pattern check, not a person reading your conversation. Purly reviewers cannot open your message threads: our system does not give reviewers a way to read message contents. If a scam pattern is detected, what a reviewer sees is the flag, not your whole conversation.

Please do not send ID documents, bank details or passwords through messages. Use the verification screen for documents.

7. Where your information is stored

Your information is stored outside Uganda, Kenya and Nigeria. We want to be direct about this rather than hide it in a long sentence.

Our database and files — Ireland

Purly runs on Supabase, which stores our database and all uploaded files on servers in Ireland, in the European Union. That includes your account, your listings, your messages and your ID documents.

Why Ireland? Our hosting provider does not offer any server region in Africa. We checked. So the data has to leave the continent whichever region we pick. Given that, we chose the European Union, because EU data protection law is strong and is widely recognised. We did not choose it for convenience.

Our emails — Resend and Amazon

Every time you sign in we send you a link by email. Those emails are sent through a service called Resend, which uses Amazon's email service. This means your email address, and the sign-in link itself, pass through that service. The sending happens from Ireland. Part of the service is reached through servers in the United States.

Things your phone contacts directly

Some parts of the app make your phone contact other companies directly. We do not control those companies and they are not working on our behalf. We are listing them plainly because your phone's IP address is visible to them.

  • OpenStreetMap (Nominatim). When you drop a pin while posting a property, your phone sends the exact coordinates to OpenStreetMap to look up the address. Your IP address goes with it.
  • OpenStreetMap tile servers. Whenever a map is shown, your phone downloads map images. This shows OpenStreetMap which area you are looking at, and your IP address.
  • Google Fonts. The app downloads its typeface from Google the first time it is needed. This shows Google your IP address. [GAP 13] We can remove this by including the font in the app itself. We have not done it yet.

What we do NOT do

We think this matters as much as the list above.

  • We do not sell your data. Not to anyone, ever.
  • There is no advertising in Purly and no advertising network receives anything.
  • There is no analytics. We do not use Google Analytics, Firebase, or any similar product.
  • There is no crash reporting and no third-party tracking of any kind.
[GAP 9] Each of Uganda, Kenya and Nigeria sets its own conditions for sending personal data abroad. Our lawyers are working out exactly which condition we rely on in each country, and what we must file with each regulator. Kenya requires proof to be given to its Data Commissioner. That has not been done yet.

8. How long we keep things

Verification documents

Our intention, already built into the system, is to delete a verification document 90 days after it is approved, or 30 days after it is rejected.

[GAP 3] We must be honest: this automatic deletion has never actually run. The deletion job is built and installed but has not been switched on, so no document has been deleted by it. Also, a document that is still waiting for review currently has no deletion date at all. Switching this on is a priority before Purly is open to real users. Until it runs, please assume a document you upload stays until you ask us to remove it.

Everything else

[GAP 4] We have not yet set retention periods for account details, listings, messages, viewings, notifications, saved searches or safety records. Today they are kept until you ask us to remove them. Real periods must be set before launch.

Some records are deliberately kept longer, because deleting them would defeat their purpose. Our record of who viewed an ID document is kept even after that document is deleted, so that the record of access survives. Records of enforcement decisions are also kept.

9. Your rights

Data protection law in Uganda, Kenya and Nigeria gives you rights over your information. All three give you broadly these rights. Below, each right is followed by how it actually works today. Where the app cannot do it yet, we say so.

See what we hold about you

You can see most of it in the app: your profile, listings, messages, viewings, saved searches and favourites.

[GAP 5] There is no button to download everything at once, and some records are not visible to you in the app — including the log of who viewed your ID document, any safety flags about you, and any enforcement decision. Email us and we will do it by hand.

Correct something wrong

You can edit your profile and your listings in the app at any time. For anything else, email us.

Delete your account and data

[GAP 6] There is no working delete button yet. The app's "Request Account Deletion" screen tells you to email us, and that is accurate — it does not delete anything by itself. We handle requests by hand and aim to complete them within 30 days. We have no automatic system, no request log and no automatic timer yet.

You can delete your saved searches and favourites yourself, in the app, immediately.

You cannot currently delete a message you have sent. Please keep that in mind before sending.

Object to how we use your data

You can object to our safety checks. Email us and a person will consider it. We may refuse if stopping the check would leave other users exposed to fraud, and we will explain if so.

Withdraw your consent

[GAP 7] There is no way to withdraw consent in the app yet. This matters, because consent that cannot be withdrawn is not proper consent. Email us and we will act on it by hand. Building this is a priority.

Complain to the regulator

You can complain to the data protection regulator in your country. You do not need our permission.

  • Uganda: Personal Data Protection Office (PDPO).
  • Kenya: Office of the Data Protection Commissioner (ODPC).
  • Nigeria: Nigeria Data Protection Commission (NDPC).
[GAP 11] Purly is not yet registered with any of these regulators. Registration is in progress. A finished policy must state our registration details.

10. Kenya: an extra note

[GAP 10] Kenya's data protection law includes "property details" in its list of sensitive personal data. If that covers ordinary property listings, then listing a property in Kenya may involve sensitive data and stricter rules. Our lawyers are confirming this. We are flagging it now rather than waiting, because it may change what we ask Kenyan users to agree to.

11. If there is a data breach

If someone gets access to your data without permission, the law requires us to tell the regulator quickly — immediately in Uganda, and within 72 hours in Kenya and Nigeria — and to tell you if the risk to you is high.

[GAP 8] We do not yet have a system that detects a breach, records it, or notifies anyone within those deadlines. This must be built before launch. We would rather say this than imply a protection we do not have.

12. Children

[GAP 12] We have not set a minimum age for Purly, and the app does not ask your age. Purly is meant for adults renting, buying, selling or managing property. A minimum age must be set before launch.

13. Changes to this policy

If we change this policy we will post the new version here and update the date at the top. If a change materially affects your rights we will tell you in the app or by email before it takes effect.

14. Contact us

For anything about your privacy, or to make any request above, email purlyhomes@gmail.com.

[GAP 2] A dedicated privacy address on our own domain has been decided but not yet created. Until it exists, the address above is the only route, and it is a general mailbox rather than a proper data protection contact channel.
← Back to Purly