Legal
Privacy Policy
Version 1.1 · Last updated October 29, 2026
This policy explains what personal data HomiMade collects, why, who receives it, how long we keep it and what your rights are. It is written to the standard of the strictest privacy laws we follow, with notices for specific countries in section 11.
1. Who is responsible
Tibrcode Software Development, Abu Dhabi, United Arab Emirates, operates HomiMade and is the controller of the personal data described here. Contact for anything about your data: support@tibrcode.com.
2. What we collect
| Who | Data | Why |
|---|---|---|
| Everyone | Pages viewed and events in our own analytics, without cookies and without third-party trackers; approximate country from the network for "not available in your region" | Run and improve the service; respect regional limits |
| Account holders | Email, display name, country, the confirmation that you are 18 or older; sign-in data (one-time codes sent by email, and Google or Apple sign-in only where we offer it and you choose it); for staff, a two-step verification app | Accounts and security |
| Everyone: agreements you accept | The version, date and language of the Terms of Use, and of the seller or courier undertaking, that you accepted, and a fingerprint (hash) of the exact text you saw | Show what you agreed to, and answer legal claims |
| Everyone: bot protection | On sign-in and some forms, Cloudflare Turnstile reads technical signals from your browser (such as your network address and browser features) to tell people from automated programs | Stop automated abuse |
| Waitlist | Email, role, country, language, referral code | Tell you when HomiMade opens in your area |
| Sellers | Shop details; photos, videos and voice notes you upload (metadata such as location is removed); your WhatsApp number and payment link (shown only as described in the Seller Agreement); tax settings | Run your shop |
| Sellers: identity check | A photo of your identity document; we keep your legal name, document type and country, expiry date, whether you are an adult and a scrambled (hashed) form of the document number. We do not keep your date of birth. | Adults only; prevent fraud |
| Sellers: licences and permits | Photos or PDFs of the documents your area requires; holder names, business name, issuer, document dates, permitted activities, address on the document; the last four characters and a hash of the number | Local laws require licences or permits |
| Sellers: tax reporting (only where your area requires it, for example Canada) | Legal address, date of birth, tax identification number, business number | Platform reporting duties |
| Buyers and sellers: orders | The items, prices and totals; the delivery or pickup contact you give (name, phone, address and instructions); your note; the order history; your review and the seller's reply | Pass the order to the seller you chose, keep the order record, show reviews |
| Buyers and sellers: order chat | Your messages and photos (photos are re-encoded, so location and other metadata are removed); automatic warnings when a message looks like a scam | Let both sides agree on the order safely |
| Buyers: custom requests | What you ask for, the country and the city (from our list of places) sellers must be near, and reference photos (metadata removed) | Show your request to the shop you chose or to eligible sellers nearby |
| Everyone: discovery | The place you search from: your device's location (only when you press "Use my location") or a city you pick, rounded to about 100 metres and kept only in the page address, never stored by us; the words and filters you search with | Show what is made near you |
| Account holders: follows | The shops you follow | Tell you about their new drops (in the app, and by push if you turned it on) |
| Sellers: location | The exact place of your home or studio, which only you and our systems can see, and an optional public pickup point such as a mall | Show buyers your approximate area (never your home) and measure distances from it |
| Sellers: private details for orders | Exact pickup place, licence number and tax ID (shown only to buyers whose order you accepted, and on their receipts) | Complete accepted orders and receipts |
| Delivery partners (couriers) | Your public profile (name, kind of courier, city, description, services, vehicles, working hours, prices and the zones where you deliver; a radius zone is shown around a neighbourhood centre, never your exact base); your WhatsApp number (never public); your identity check and your company registration or courier licence, handled like sellers' documents above; the delivery requests you receive and answer, with the reasons you give; ratings from sellers and buyers | List you for sellers whose orders are in your zones; pass delivery requests to you |
| Buyers and sellers: deliveries by a courier | The courier the seller asked, the pickup time, the seller's note to the courier, an estimate, the delivery point the seller placed on the map, the delivery steps and any tracking link; your rating of the courier | Arrange the delivery with the courier the seller chose |
| Anyone who turns on notifications | The browser's push address and keys for this device; in the apps, the device's push token and the app version | Send order updates to this device |
| App users (Android and iOS) | The camera and your photos only when you choose to take or pick a photo (it is prepared on your phone, which removes its location and other metadata, before upload); your approximate location only when you press "Use my location" (never stored, as on the website). The apps contain no third-party trackers | The same features as the website, with your phone's camera, location, share sheet and notifications |
| Reporters | Your report and, if you give it, your email; a scrambled (hashed) form of your account, email or network address, so that how reliable your earlier reports were can count (the network address itself is not kept) | Handle reports and weigh them fairly |
| Buyers: food incidents | What you tell us about feeling ill after an order (what happened, when, how many people, whether someone needed medical care). The seller never sees these details; we keep them with the order's records for the food authorities | Pause food that may be unsafe and cooperate with the authorities |
| Senders of legal notices | Your name, email, reference, deadline and notice | Handle the notice |
| Everyone: trust and safety | Decisions about your content or account and their reasons, strikes (kept 180 days), appeals; signs of fraud such as the same phone number, payment link or identity document on several accounts, or a photo copied from another shop. We do not collect device fingerprints | Keep HomiMade safe and stop fraud |
| Everyone: errors | When a page fails on our servers or in your browser, the kind of page (for example "a shop page", never which shop) and the error message with e-mail addresses, numbers, codes and links removed; when your browser blocks something on a page for security, what kind of thing it blocked and from which site | Find and fix faults, and notice attacks |
3. Automated processing and AI
- We use AI services (Cloudflare Workers AI) to read identity and licence documents, to draft listings from your photos and voice notes, and to check listings and photos against our rules. We ask for your explicit consent before your documents or voice notes go to these services.
- When you search in your own words, the words go to the same AI services to be read into filters (for example a category, a price or a day). That reading, and a numeric summary of the words used to rank results by meaning, are kept for 30 days for anyone who searches the same words, without any link to you. Titles and categories of public listings are summarised the same way.
- Decisions about documents are made by fixed rules from what was read. When the rules cannot decide, a person at HomiMade decides. You can always ask for a person to review a fix request.
- We do not use your data to train AI models, and the data we send to Workers AI is not used by Cloudflare to train its models.
4. Legal bases
We process personal data on these grounds, or their equivalent in the law of your country:
- Contract: to provide your account, your shop, your orders and the features you ask for.
- Consent: for the AI reading of your documents and voice notes, for notifications on your device, and for any marketing. You can withdraw consent at any time; this does not affect what was done before.
- Legal obligation: tax reporting where the law requires it, keeping records the law requires, and answering lawful requests from authorities.
- Legitimate interests: security, preventing fraud and abuse, keeping records of decisions and food incidents, and improving HomiMade. You can object to processing on this ground (section 9).
5. Who receives data
- Buyers and visitors see public shop and product information only. Documents, document numbers, addresses, tax numbers and dates of birth are never public.
- The other side of an order: a seller sees the buyer's delivery or pickup contact only after accepting the order, and for 7 days after it ends. A buyer sees the seller's exact pickup place, payment link, licence number and tax ID only after the seller accepts.
- Couriers: a courier the seller asks for a delivery sees only the areas, the distance and the time until they accept. Once they accept, they see the pickup details and the buyer's delivery contact and point, until 7 days after the delivery ends. The seller receives the courier's WhatsApp number when asking them; the buyer receives it once the courier accepts. HomiMade does not employ couriers, track them or handle payments to them.
- Push services of your browser (for example Google, Apple or Mozilla), and in the apps Google Firebase Cloud Messaging and Apple's push notification service, carry the short order notifications you turned on: a title such as "Your order HM-… is ready" and a link. They never contain addresses or messages.
- Service providers that process data for us, under contracts that limit them to our instructions: Supabase (database, files and live chat, in Frankfurt, Germany), Vercel (website hosting, with its servers for HomiMade in Frankfurt), Cloudflare (AI processing and bot protection), Resend (e-mail, in Ireland), and for notifications in the apps Google Firebase Cloud Messaging and Apple's push notification service. Exchange rates come from ExchangeRate-API and city names from GeoNames; no personal data is sent to them.
- Map images come from OpenFreeMap: when a map is shown, your browser asks their servers for the images of the area on screen, which lets them see your network address and that area. They receive nothing else from HomiMade.
- Authorities when the law requires it, for example after a food incident or a lawful order.
- We do not sell personal data, and we do not share it for advertising.
6. Ads
HomiMade shows no ads today. Before any ads are switched on, we will update this policy and the Cookie Policy and, where the law requires it, ask for your consent first.
7. International transfers
Data is stored in the European Union (Frankfurt, Germany). Some service providers may process it in other countries, including the United States. Where the law of your country requires safeguards for such transfers (for example the UAE and Saudi personal data protection laws or Quebec's Law 25), we rely on the providers' data processing agreements and standard contractual clauses, and we assess the transfer before it happens.
8. How long we keep data
| Data | Kept |
|---|---|
| Identity document photos | Deleted 30 days after the final decision |
| Licence and permit files | Deleted 30 days after a refusal, or 12 months after the document expires or is replaced |
| Uploaded originals (before processing) | Deleted within a day |
| Photos you no longer use | Deleted after 7 days |
| Decision records and audit log | 6 years |
| Order chat photos | Deleted 90 days after the order ends |
| Reference photos of custom requests | Deleted 90 days after the request |
| Delivery or pickup contact of an order | Deleted 180 days after the order ends (where the seller's receipts must name the buyer, the name stays on the order record) |
| The exact delivery point of a courier delivery, the seller's note and the tracking link | Reduced to an area of about 5 km, and removed, 180 days after the delivery ends |
| Records under a legal or food incident hold (an order's, a shop's or a person's) | Kept until a person at HomiMade releases the hold or its date passes, then deleted on the usual schedule |
| Strikes | 180 days |
| Order records, history, chat text and reviews | Up to 6 years after the order ends, for the parties' records, for tax and consumer law, and to cooperate with authorities after food incidents or reports |
| Searches read by AI (the words and the filters read from them, without any link to you) | 30 days |
| Error records (the kind of page and a cleaned message, without personal data) | 14 days |
| Your shop's exact location | Until you change it or close your shop |
| The shops you follow | Until you unfollow them or delete your account |
| Account data | Until you delete your account: it is deleted 7 days after you ask (section 9) |
| The record that an account was deleted (its random identifier and the dates, no name or e-mail) | 6 years |
| Records of the agreements you accepted (version, date, language and a fingerprint of the text) | 6 years after your account ends, to answer legal claims |
| Copies of your data you downloaded | Removed from our storage within a day |
| Shop and courier names in links (handles) of deleted accounts | Reserved for one year, so that nobody else can use links you shared |
9. Your rights
Access, correction, deletion, export, objection, and withdrawal of consent, subject to local law. Write to support@tibrcode.com, or use these tools directly:
- Download your data: Account → Download your data gives you a JSON file with everything we hold about you (once every 10 minutes).
- Delete your account: Account → Delete your account, in the apps or at homimade.com/account/delete. At once, you are signed out everywhere, your shop and delivery profile are no longer shown, open requests are closed, and orders that have not started are cancelled (the other person is told). 7 days later we delete your account, your profile, shops, products, photos, documents, identity check, delivery profile, the reviews you wrote, requests, follows and notifications. Signing in again before then cancels the deletion.
- What we keep after a deletion, without your name or contact details: orders in the other person's history (items, amounts, dates, status), with your address and phone number removed; chat messages in those orders, on the schedule in section 8; decisions about content and their reasons; product-safety notices and food incident records; the audit log. If a legal or food incident hold covers your records, or an order is still under way, the deletion waits until it ends. We keep these records because the law requires it, to establish or defend legal claims, and to cooperate with food and other authorities.
- If you are not satisfied with our answer, you can complain to the data protection authority of your country.
10. Security
Private storage for documents; short-lived links; access logs; two-factor sign-in for staff; row-level access rules in the database; document numbers stored only as salted hashes.
11. Regional notices
- United Arab Emirates (Federal Decree-Law 45 of 2021): you have the rights in section 9, including access, correction, deletion, restriction, objection and portability. Write to support@tibrcode.com.
- Saudi Arabia (Personal Data Protection Law): you have the rights in section 9. Your data is stored outside the Kingdom with the safeguards in section 7. You can complain to the Saudi Data and Artificial Intelligence Authority (SDAIA).
- Canada and Quebec (PIPEDA and Law 25): the person in charge of the protection of personal information is Tibrcode's managing director, reachable at support@tibrcode.com. We assess the privacy impact of transferring data outside Quebec before it happens. You can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, to the Commission d'accès à l'information.
- United States (state privacy laws): HomiMade does not sell personal data, does not share it for cross-context behavioural advertising and does not use sensitive data to infer characteristics about you. You can use the rights in section 9 and appeal any refusal by writing to support@tibrcode.com.
- India (Digital Personal Data Protection Act 2023): our grievance officer is Tibrcode's managing director, reachable at support@tibrcode.com. If your grievance is not resolved, you can complain to the Data Protection Board of India.
- Singapore (PDPA): our data protection officer is reachable at support@tibrcode.com.
- Europe: HomiMade is not yet open in Europe. Before it opens, we will appoint the representatives the law requires and update this policy.
12. Children
HomiMade accounts are for adults (18+). We do not knowingly collect data from children.
13. Changes
We will tell you about important changes before they apply.