Privacy Policy

Account information

When you sign in with Google, Apple, or Facebook we receive your name, email address, and profile photo from that provider.

Listing content

Text, photos, price, dates, and location information you submit when posting a sublet listing.

Usage data

Pages viewed, search queries, and interaction events collected automatically to improve the service.

Device & log data

Browser type, IP address, and timestamps recorded in server logs.

Provide the service

Display your listings to other users and allow you to browse listings.

Authentication

Verify your identity and maintain your login session.

Communication

Send transactional emails such as listing confirmations or support responses.

Improvement

Analyse usage patterns to fix bugs and improve features.

Legal compliance

Meet obligations under applicable law and respond to lawful requests.

Firebase (Google)

Authentication, database, and hosting. Data is stored in Google Cloud. See google.com/policies/privacy.

Facebook Login

Optional sign-in method. We receive only your public profile and email. See facebook.com/policy.php.

Google Sign-In

Optional sign-in method. See policies.google.com/privacy.

Apify

We use Apify to collect publicly available Facebook group posts. No personal data is sent to Apify beyond what is publicly visible.

We do not sell your data

We never sell or rent your personal information to third parties.

Service providers

We share data only with the infrastructure providers listed above, under strict data processing agreements.

Legal requirements

We may disclose information if required by law, court order, or to protect the rights and safety of users.

Active accounts

We retain your data for as long as your account is active.

Listings

Listings are retained until you delete them or your account is removed.

Logs

Server logs are automatically purged after 90 days.

Access

You may request a copy of the personal data we hold about you.

Correction

You may update your name or email through your account settings.

Deletion

You may request deletion of your account and all associated data at any time.

Portability

You may request your data in a structured, machine-readable format.

Session cookies

Used to keep you logged in during a browsing session.

No tracking cookies

We do not use advertising or cross-site tracking cookies.

Age requirement

SubHub is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

Encryption

All data is transmitted over HTTPS/TLS.

Access controls

Database access is restricted to authenticated service accounts with the minimum required permissions.

Limitations

No system is perfectly secure. In the event of a breach we will notify affected users as required by law.

Notification

We may update this policy from time to time. The "Last updated" date at the top of this page will reflect any changes. Continued use of SubHub after changes constitutes acceptance.