Privacy policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Ardalan Ebrahimi, Pragpath Studio, Frankenallee, 14052 Berlin, Germany

Email: info@pragpath.com

HomiStart is operated by Pragpath Studio. We have not appointed a data protection officer, as we are not legally required to; for any privacy question, write to the address above.

• You can read all guides and community answers without an account.
• For an account we need an email address (or a Google/Apple sign-in) and a display name. All further profile details are optional and are never shown to other people.
• Usage analytics only run if you consent. We use our own analytics, not third-party tracking tools, and no advertising networks.
• We do not sell personal data and do not show ads.
• You can export your data and delete your account in your profile at any time.

When you open a page, your device sends technical data to our servers: IP address, date and time, the requested address, browser or app type and version, operating system and, where sent, the referring page. We need this data to deliver the service and to protect it against abuse (for example, rate limiting uses your IP address briefly in memory; we do not store IP addresses in our application database). Our hosting provider may keep server logs.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in a secure and stable service.

Operational monitoring. To detect outages and errors we use Microsoft Azure Application Insights. It records technical data about requests to our server (address requested, response code and time, server errors and performance data, and the browser/app type). Application Insights does not store your full IP address (it is masked by default) and the data is not used to build user profiles. Microsoft acts as our processor. Legal basis: Art. 6(1)(f) GDPR.

Error reports. If the app runs into a technical error, it sends the error message, the page route, app version and platform to our server so we can fix the problem. Before storing, the server removes details that could identify you (for example email addresses or tokens in the message), and identical errors are merged. These reports are not linked to your account. Legal basis: Art. 6(1)(f) GDPR.

Search. We store search terms, selected filters, number of results, country/city, language and platform to improve search. Search terms are not linked to your account or device. Please do not enter personal data into the search field. Legal basis: Art. 6(1)(f) GDPR.

Some pages load content directly from other providers into your browser or app. When this happens, your device connects to that provider, which therefore receives your IP address, the requested file, the time and your browser details. We have no influence on how they process this data.

Maps (OpenFreeMap)

Pages with a map (for example city and neighbourhood pages) load map tiles, fonts and symbols from tiles.openfreemap.org. OpenFreeMap is a free, open map service; it sets no cookies and needs no account or API key. Pages without a map do not contact it.

Photos (Wikimedia Commons)

Many photos are freely licensed images from Wikimedia Commons and are loaded from upload.wikimedia.org (Wikimedia Foundation, USA). Privacy policy of the Wikimedia Foundation (Opens {{site}} in a new tab).

Google / Apple sign-in

Only if these sign-in options are offered: the sign-in page then loads the provider’s sign-in script (accounts.google.com, appleid.cdn-apple.com). Data about your account is only passed on when you choose to sign in this way (see Your account).

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in showing maps and photos without operating our own map and image servers; for sign-in, Art. 6(1)(b) GDPR.

Sign-up with email

Email address, password (stored only as a secure hash, never in plain text), display name. If email is enabled, we send you codes to verify your address or reset your password; codes are stored as hashes and expire after a short time.

Sign in with Google or Apple

We receive a unique account identifier from the provider, your email address and whether it is verified and, with Apple on first sign-in, the name you choose to share. For Apple we also store the token needed to revoke the authorisation when you delete your account.

Sessions

To keep you signed in we store each session with a hashed token, platform, optional device name, app version and timestamps. You can see and end your sessions in your profile. Sessions expire 120 days after their last use.

Sign-up context

How you signed up (method, platform) and, if available, how you found us (campaign parameters, referring website, first page visited). This helps us understand which channels are useful.

Activity by day

For signed-in users we record on which days and on which platform (web, Android, iOS) the service was used, plus the app version and a "last active" time. We do not record what you did on those days in this record. It helps us measure whether the service is useful over time and keep it reliable.

Legal bases: Art. 6(1)(b) GDPR (providing the account you asked for); for sign-up context and activity by day Art. 6(1)(f) GDPR (legitimate interest in improving and operating the service). You can object at any time (see Your rights).

To build your plan you can tell us your destination country and city, your stage of the move, arrival date, reason for moving, work status, household, whether you have children and their age groups, your citizenship group, country of origin, language level, priorities, and your preferred languages. Only the destination is needed for a plan; everything else is optional.

We use these details only to select and order the tasks, deadlines and guides that apply to you. They are never shown to other members and are not used for advertising. We do not ask for special categories of data within the meaning of Art. 9 GDPR (such as health or religion). Please do not enter such data in free-text fields.

We also store what you do in your plan: task status, due dates and notes, saved items and searches, reminders, your document checklist (only whether a document is ready — we never ask you to upload documents) and values you save in tools such as the cost planner.

Legal basis: Art. 6(1)(b) GDPR — providing the personalised plan and tools you requested.

Questions, answers, comments, service reviews and housing listings you publish are public: anyone, including search engines, can see them together with your display name. Votes, follows, blocks and reports are stored with your account but are not shown publicly as yours.

When you rate a guide as helpful or suggest a correction, we store your feedback (and, for corrections, the text you write) to improve our content.

To keep the community safe we process reports, moderation decisions and sanctions (for example a temporary mute) and keep an internal log of moderation actions. See the community guidelines.

If you offer help to other newcomers or ask for help (buddy feature, where available), the details you add for this purpose — such as display name, languages, topics and a short note — are shared with the members involved, and the requests are stored to run the feature.

Legal bases: Art. 6(1)(b) GDPR (publishing what you asked us to publish) and Art. 6(1)(f) GDPR (a safe, spam-free community; defending legal claims).

We store in-app notifications (for example a new answer to your question) and your notification settings.

Push notifications (Android and iOS apps) are only sent if you allow them on your device. For delivery we store a device token, platform and app version and use Firebase Cloud Messaging (Google); on iOS, messages are passed on via Apple’s push service. You can turn push off at any time in your device or app settings.

Email. If we send you emails — for account security (verification codes, password reset) or, if you switch them on, notification emails — we use Microsoft Azure Communication Services (Email), data location Europe, which processes your email address and the message on our behalf (Art. 28 GDPR). Emails are sent from an Azure-operated sender address (…@…azurecomm.net) with the sender name HomiStart; we switch off open and click tracking.

Legal basis: Art. 6(1)(b) GDPR; for push notifications your device permission.

The AI assistant is currently not active. If we switch it on, we will update this policy beforehand. Where it is enabled and you choose to use it, the question you type and the context needed to answer it (for example your destination) are sent to OpenAI to generate an answer. We record usage data (feature, model, number of processed text units, response time, outcome) linked to your account, for example to enforce fair-use limits. Please do not enter sensitive personal data. AI answers can be wrong — always check the linked official sources.

Legal basis: Art. 6(1)(b) GDPR — providing the feature you use.

Only with your consent, our app creates a random installation ID and a session ID on your device and sends us events about how the service is used — for example which pages are viewed and which features are used (such as opening a guide or completing a task) — together with technical details (platform, app version, language, device class phone/tablet/desktop, the page route, referring website and campaign parameters). Events contain no free text you type. If you are signed in, events are linked to your account. We use our own analytics only; no third-party analytics or advertising tools are involved.

Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw consent at any time in the privacy settings of the app; we then stop collecting and remove the IDs from your device. Withdrawal does not affect processing carried out before it.

Server-side product events. When you complete certain actions (for example creating an account, completing onboarding or posting a question), our server records that event with your account ID — no data is read from or stored on your device for this. Legal basis: Art. 6(1)(f) GDPR (understanding whether the service works). You can object at any time by switching off analytics in your profile; we then record neither app nor server events for your account.

We also produce daily statistics (for example the number of events per day) that contain no identifiers. Accounts of our own team are marked and excluded. Your consent decision itself (granted or withdrawn, the policy version and the installation ID) is logged so that we can prove it. Analytics data is stored only in our own database in the EU; raw events are deleted automatically after 400 days.

We use no advertising or third-party tracking cookies. The following items are stored on your device:

np_rtCookie (httpOnly, only sent to /api/auth) · until you sign out, at most 120 days without use

Keeps you signed in on the website (secure refresh token). Strictly necessary (§ 25(2) no. 2 TDDDG).

np_langCookie · 1 year

Remembers the interface language you chose. Strictly necessary for a service you requested.

np.rtApp storage (Android/iOS apps only) · until you sign out

Keeps you signed in in the app. Strictly necessary.

np.signedInLocal storage · removed when you sign out

A simple marker that you are signed in, so the app can restore your session. Strictly necessary.

np.consentLocal storage · until you change your choice

Stores your analytics choice and the policy version it refers to. Strictly necessary to respect your choice.

np.installId, np.sessionLocal storage · only after consent; deleted when you withdraw it

Random installation and session IDs for usage analytics. A session ends after 30 minutes of inactivity.

np.firstTouchSession storage · deleted when you close the tab

The first page of your visit, referring website and campaign parameters, used once if you create an account (see "Sign-up context").

np.pendingActionSession storage · deleted when done or when you close the tab

Remembers an action you started before signing in (for example saving a guide) so it can be completed afterwards.

np.reloadedForChunkSession storage · deleted when you close the tab

Technical flag that lets the app recover once after an update.

np_themeCookie · 1 year · only if you choose a theme

Remembers whether you chose the light or dark appearance. Strictly necessary for a setting you made.

np.recent.v1, np.search.recent, np.journey.viewLocal storage · until you clear it

Recently viewed pages, your recent searches and your preferred plan view, shown only to you on this device. Never sent to us.

np.guideCache.v1Local storage · a limited number of guides

Copies of guides you opened, so they can be read offline. Never sent to us.

np.feedbackVoter, np.feedbackVotes, np.contentVotes, np.community.viewedLocal storage · until you clear it

A random ID so that a guide can be rated only once per device without an account, the ratings you gave, and which questions you already opened (so a view is counted once). The random ID is sent only with a rating and is not used for analytics.

np.community.answerDraft.*Local storage · deleted when you post or discard the draft

Unsent drafts of your answers, so you do not lose text. Never sent to us before you post.

Strictly necessary storage is based on § 25(2) no. 2 TDDDG; everything for analytics only on your consent (§ 25(1) TDDDG).

We use the following providers. Where they process data on our behalf, they are bound by a data processing agreement (Art. 28 GDPR).

Microsoft Azure

Microsoft Ireland Operations Ltd. — hosting of the website and the apps’ backend (Azure App Service), our database (Azure Database for PostgreSQL) and operational monitoring (Azure Application Insights), all in the data centre region West Europe (Netherlands).

Google

Sign in with Google (only if offered and you use it); Firebase Cloud Messaging for push notifications (only in the apps and only if you allow them).

Apple

Sign in with Apple (only if offered and you use it); delivery of push notifications on iOS.

OpenAI

AI assistant — currently not active; only where it is enabled and only when you use it.

Microsoft Azure Communication Services

Sending of account and notification emails (data location Europe; see Notifications and email).

OpenFreeMap, Wikimedia Foundation

Map tiles and photos loaded directly by your browser (see Maps, photos and sign-in scripts); these providers act on their own responsibility.

Public community content is visible to everyone. We disclose data to authorities only where we are legally obliged to. We do not sell personal data.

Our application and database are hosted in the EU. Google, Apple and OpenAI may process data in the United States or other countries outside the EU when you use the features listed above. Such transfers are based on an adequacy decision of the European Commission (Art. 45 GDPR, EU–U.S. Data Privacy Framework) where the recipient is certified, and otherwise on standard contractual clauses (Art. 46(2)(c) GDPR).

• Account, profile and plan data: as long as your account exists. When you delete your account, it is deleted or anonymised in one step.
• Public contributions: when you delete your account you choose whether your questions, answers and comments are removed or stay visible as "Former member".
• Sessions: end when you sign out and expire 120 days after their last use. Verification and reset codes expire after a short time.
• Usage events and search logs: the link to your account is removed when you delete it. Raw events and search logs are deleted automatically after 400 days; daily statistics without identifiers may be kept longer.
• Error reports: contain no reference to you; identical errors are merged and kept only as long as needed to fix the problem.
• Operational monitoring (Application Insights): deleted automatically after the retention period set in Azure (at most 90 days).
• Moderation records: as long as necessary to protect the community and to establish or defend legal claims.

Statutory retention obligations remain unaffected.

• Access and data portability (Art. 15, 20 GDPR): download a copy of your data in your profile.
• Rectification (Art. 16): edit your profile and contributions in the app.
• Erasure (Art. 17): delete your account yourself in your profile (privacy settings → delete account); this takes effect immediately.
• Restriction of processing (Art. 18).
• Objection (Art. 21) to processing based on legitimate interests, for example by switching off analytics in your profile.
• Withdrawal of consent (Art. 7(3)) at any time with effect for the future.
• Complaint to a data protection supervisory authority (Art. 77), in particular in the EU country where you live or work.

The supervisory authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, www.datenschutz-berlin.de (Opens {{site}} in a new tab).

For all other requests, write to info@pragpath.com.

Your plan is put together by fixed rules from the details you provide (for example: EU citizens do not need a residence permit). This is a recommendation you can change; it has no legal effect on you. We do not make automated decisions within the meaning of Art. 22 GDPR.

Connections are encrypted (TLS). Passwords, session tokens and codes are stored only as hashes. Access to personal data within our team is limited to people who need it, and moderation actions are logged.

Accounts are for people aged 16 and over. We do not knowingly process data of younger children.

We update this policy when the service or the law changes. The date at the top shows the current version. If a change affects your consent, we ask you again in the app.