Coinquilino Privacy Policy

1. Who we are

The data controller is Coinquilino.
For any privacy question, or to exercise your rights, write to contact@coinquilino.app.
We have not appointed a Data Protection Officer.

2. What data we process and where it comes from

Data you give us

• Account: email and password, or sign-in with Google or Apple. The password is handled by Firebase Authentication and we never see it. Also your username, photo, gender, date of birth, role (looking for a home, offering a room, agency) and language.
• Seeker profile: city, budget, move-in date, length of stay, description and habits (for example whether you smoke). If you fill in the extended profile, you also add photos, school, job, languages, country of origin, lifestyle, roommate preferences and answers to profile prompts.
• Listings: photos, address, map point, price and home details.
• Messages and requests: what you write, the requests you send and receive, and your co-living teams.
• Trust and safety: references you give and receive, agency reviews, reports, and the people you block.
• Preferences and activity: favourites; settings such as incognito or refusing invitations; your daily request count; your invite code; the votes you give on the star-sign compatibility card; the chats and messages you hide; mandates you give to an agency (duration, exclusivity and the fee you record).
• Agency page: the agency details and contact details you enter.
• Verification (optional): phone number and face photo (see section 3).
• Feedback: the message you send us and the email you enter. With them we receive your user ID and username, your device model and name, your system and app versions, your time zone and your language.

To create an account you need an email address (or sign-in with Google or Apple), a username, a photo, your gender and your date of birth. Without these the app cannot create your profile. Everything else is optional. You can also look around as a guest. In that case the app creates an anonymous identifier through Firebase.

Data from your device

• Location, if you allow it. The app reads your position to work out your city and country. We store only the city and country, not the coordinates. Your position is also used to centre the map and, if you choose, to search for an address (see section 6).
• Your push notification token.
• Usage statistics and crash data (see section 9).
• Your device's advertising ID, and the technical data that Google's advertising SDK receives (see section 8).

Data from others

• From Google and Apple, if you sign in with them: your account's name, email address and, if there is one, photo. If your account has a name, that name becomes your username and the app does not ask you to choose another. If you want to change it, write to us. We do not use your account photo for your profile: we ask you to upload your own. The app does, however, save your Google or Apple account name and photo with every message you send, and the person who receives the message gets them on their phone.
• From other users: messages, references, reviews and reports that concern you. If someone reports you, we keep your email address with the report. We use it to recognise new accounts created with the same email.
• From Apple, Google and RevenueCat: the status of your subscriptions and purchases.
• Visits: we record when someone visits your listings or your profile (see section 5).

3. Identity verification: phone and face

Verification is optional. It gives you a verified badge.

Phone

• The SMS code is sent through Firebase Authentication (Google).
• Your number stays saved on your account. The app does not show it to other users.
• We also log each sending attempt, including the number, to fix problems and prevent abuse.
• These logs are not deleted automatically yet. If you ask, we delete them.

Face

A face photo is biometric data, a special category of data (Art. 9 GDPR). We process it only with your explicit consent, which we ask for on a screen before the check starts. Without consent, nothing is analysed or captured.

• On your phone: the camera asks you to turn your head, smile and blink. The analysis runs on your phone using Google ML Kit. We record no video and no audio.
• What we keep: one still photo of your face, stored in Firebase Storage (Google) and linked to your account. We also keep the check score, the number of steps completed and the dates. The app does not show the photo on your profile or to other users. Our team can view it to check the verification.
• How the decision is made: if the check on your phone passes, you get the badge right away, automatically. A member of our team may look at the photo afterwards and remove the badge if something does not match. If you think a decision is wrong, write to us and a person will review it.
• How long we keep it: we keep the photo until you ask us to delete it. For now, deleting your account in the app does not remove the photo automatically. Write to us, even after deleting your account, and we will delete it within one month. The score, steps and dates stored on your account are deleted when you delete your account. A copy of the score and steps stays in our verification logs (sections 9 and 12), and a copy of the score stays in the data attached to the photo, until you ask us to delete them.
• Withdrawing consent: you can do this at any time by writing to us, and we delete the photo and the copy in our logs. The verified badge is not removed automatically. Withdrawing does not make what happened before unlawful.

4. Why we use data and on what legal basis

Right to object. You can object at any time to processing based on legitimate interest by writing to contact@coinquilino.app. For visits, turning on incognito is enough. For statistics and crash reports, section 9 explains what the app can and cannot do yet.

5. What other people can see

In the app, we show other users only:

• your username and photo;
• your gender (also used in search filters);
• your age and star sign, but not your full date of birth;
• your seeker profile and extended profile;
• your listings, including the exact point you pick on the map;
• your verified or Gold badge;
• the references you have received;
• how quickly you usually reply;
• to Gold members, whether you have read their messages (read receipts).

The app does not show other users your email address, your phone number, your full date of birth or your face photo.

Who viewed you

When you open a listing or a profile, the app records the visit with your username, photo, city and user type. Before it starts, it shows you a notice explaining how this works.

• Listings: the person who published the listing can see your name, photo and city and invite you.
• Profiles: in the app, only Gold members see who visited their profile.

For now, recorded visits are not deleted automatically. Visits to your listings are deleted when you delete the listing or your account; the others stay until you ask us to delete them (section 12). You can turn on incognito for free in your profile settings. With incognito on, the app stops recording your visits under your name, and you cannot see who visited your profile. If you publish a listing, you still see who opened it, so that you can invite them. The app still counts, anonymously, how many times a profile is opened.

Rarely, the notice may not appear, or a visit may be recorded anyway, even with the details of the account used before. This can happen, for example, if the app cannot read your setting, or if someone switches accounts on the same phone without closing the app. If it happens to you, write to us and we will delete it.

On the website (public, indexed by search engines)

• Seeker profiles: username, photo, city, budget, length of stay, move-in date and description. Every published seeker profile also appears on the website, and for now there is no switch to hide it from the website only. To take it down, delete your seeker profile in the app or write to us. Search engines may take a few days to drop it from their results.
• Listings:
  • the host's name and photo, labelled "Privato" (private) or "Agenzia immobiliare" (real estate agency);
  • the address as it appears in the listing: the one you type, or the one the app works out from the map point, which can include the house number;
  • an approximate area on the map, not the exact point;
  • photos, price and description;
  • details of the home (size, rooms, bathrooms, floor, deposit, amenities, house rules and availability).

Agencies. Agency pages, including the contact details the agency enters, and reviews, including the reviewer's username and photo, can be seen by anyone who uses the app, guests included. If a listing is entrusted to an agency, requests about that listing go to the agency while the mandate is active, and the website shows the agency instead of the owner.

Reports. If several different people report the same user, a caution notice may appear on that user's listings and in chats with them.

New seeker profile. When you publish a seeker profile, up to 20 other users, usually in your city, may get a notification showing your username, city and budget.

You are responsible for what you publish. Don't put anything in your descriptions that you don't want to make public, such as a phone number, your home address or health information. In the app, the listing map shows the exact point you pick. If you live in the home you are renting out, put the point on the street rather than on your front door, and check the address the app works out from the map.

6. Who we share data with

We do not sell your data. For advertising, see section 8. We share data only with the providers we need to run Coinquilino:

• Google (Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Cloud Messaging, App Check, Crashlytics, Google Analytics and server logs): hosts and processes almost all the data described here.
• Google AdMob: shows ads. Its SDK starts on every device (section 8). For advertising it acts as an independent controller.
• Google ML Kit: runs the face check on your phone; ML Kit does not send images to Google. The still photo we keep is in Firebase Storage (section 3).
• Apple and Google: handle sign-in with Apple or Google, store payments, and your phone's service that turns your location, or the text you search for, into a city. We never receive your card details. For payments they act as independent controllers under their own privacy policies.
• RevenueCat: manages subscriptions on our behalf. It receives your user ID, the app's Firebase Analytics identifier, purchase events (product, price, dates, store), technical data about your device, and which version of the Gold page you saw.
• OpenStreetMap (Nominatim): receives the text you type into address search, or the map point (including your current location, if you choose to use it), together with your IP address.
• CARTO: provides the maps in the app and on the website, and receives map requests and your IP address.
• unpkg: on some website pages the map library is loaded from unpkg, which receives your IP address.
• Pexels: provides some blog images and receives your IP address when you open them.
• Real estate agencies: receive the requests about listings entrusted to them and handle them as independent controllers.
• Other users: as described in sections 2 and 5.
• Authorities: when the law requires it.

7. Transfers outside the EU

The app's database (Cloud Firestore) and its files, including photos and the face photo, are stored in the European Union. Most of our Cloud Functions, however, run in the United States: these are the servers that send notifications, build the website's pages, manage subscriptions and process uploaded photos.

• Google, Apple and RevenueCat may process data outside the EU. In these cases the transfer relies on the European Commission's Standard Contractual Clauses or, where the provider is certified, on the EU-US Data Privacy Framework.
• OpenStreetMap is based in the United Kingdom, which the EU recognises as providing adequate protection (adequacy decision).
• CARTO, unpkg and Pexels work differently. When you open a map, some website pages or some blog images, your device connects directly to their servers, which may be outside the EU, and sends them your IP address. We have no specific data transfer agreement with them.

To receive a copy of the safeguards we rely on, or to find out where they are published, write to us.

8. Advertising

The app shows ads through Google AdMob. We show no ads to Gold members, verified users, or people who already had the ad-free app.

• SDK start. Google's advertising SDK starts on every device when the app opens, including for people who see no ads, and before any consent request. It may send Google technical data about the device and your IP address.
• In the European Economic Area, the UK and Switzerland we use Google's consent tool (UMP). When you enter the app, the app asks Google whether your consent is needed. If Google shows its form, you can choose whether to agree.
• On iOS, wherever you are, we ask for tracking permission (ATT) when you enter the app.
• The ATT prompt and, when it appears, Google's form are shown to everyone, including Gold members and verified users.
• If you agree, Google may use your device's advertising ID for personalised ads. If you don't, or if the form does not appear, Google may still show non-personalised or limited ads.
• On Android outside these areas, no consent form appears. Google may use your advertising ID for personalised ads unless you reset or delete it, or turn off ad personalisation in your phone's ad settings.

How to change your choice:

• On iOS: Settings > Privacy & Security > Tracking.
• On Android: you can reset or delete your advertising ID in your phone's ad settings.
• Google's form: the app does not have an option to reopen it yet. You can limit personalised ads in the phone settings listed above, or write to us. If you clear the app's data or reinstall the app, the saved choice is reset and Google may show you the form again.

9. Statistics and diagnostics

Statistics in the app. We use Google Analytics to understand how the app is used, for example which screens are opened, which features are used and the cities or addresses you search for. With this data we send your user ID and some profile details:

• gender;
• age group;
• city and the country active in the app;
• user type;
• language;
• whether you are verified;
• whether you have the ad-free app;
• platform.

Collection starts when you open the app. For now the app does not ask for consent to statistics and has no switch to turn them off. We rely on legitimate interest. You can object by writing to us, and we will delete the statistics already linked to your user ID. For now, though, the app cannot stop collecting them for you alone: collection starts again the next time you open the app, until we add a switch. Google keeps this data for at most 14 months.

Crash diagnostics. We use Firebase Crashlytics to receive crash reports. Each report contains your user ID, your device model, the country active in the app and technical details of the error, including the state of the screen where it happened. Crashlytics keeps them for 90 days. You can object to this too, but the same limit applies: for now the app cannot stop sending reports for you alone. In our own database we also log some app errors and some verification steps, including the score and steps of the face check. These logs are not deleted automatically yet. If you ask, we delete them.

On the website. For now the website does not show a cookie banner. Every page you open sends a page view to Google Analytics. Google receives:

• the address and title of the page, and the page you came from;
• a random identifier stored in your browser, in the _ga cookie;
• your IP address;
• some technical information about your browser.

When you interact with the page (tap, scroll or type), Google's script loads and uses the same _ga cookie, plus a _ga_V7EB26RGN9 cookie that keeps track of your visits to the site. Google's advertising cookies are turned off. We rely on legitimate interest. You can block all of this in your browser settings or with a tracker blocker.

Server logs. For security, our servers (Google) record the IP address and browser of anyone who contacts them, from the app or the website. These logs are deleted after about 30 days.

10. Notifications

• Service notifications:
  • new messages, with a preview of the text;
  • requests;
  • visits to your listing or profile, and a summary of visits (daily for Gold members, weekly for everyone else);
  • new seeker profiles in your city (section 5);
  • new references you receive;
  • new reviews of your agency page;
  • changes to your co-living teams;
  • updates on agency mandates;
  • reminders when messages are waiting for your reply.
• Promotional notifications: during your first 30 days, the app schedules a few tips on your phone to help you get more out of it.
• How to turn them off: you can turn off all notifications in your phone settings. On Android you can also turn off single channels.

11. Ranking and automated decisions

• Feed. The order of listings and seeker profiles in the feed is calculated automatically, using similar criteria with different weights:
  • how recent they are (for listings this carries the most weight; for verified users, newness lasts longer);
  • how quickly and how often the person who published replies;
  • how complete they are (photos, description, details);
  • trust signals (verification, references);
  • a Gold subscription, which gives a small boost;
  • the interest received (views, favourites, requests) relative to the age of the listing or profile;
  • a penalty when messages are left unanswered;
  • a small random variation each day.
• Request limit. Each day (Italian time) you have 3 free requests.
  • Some don't count, such as an invitation to your room sent to someone who had already visited it.
  • If a request is declined, or the listing is deleted, on the same day, the request is given back to you.
  • Gold members are not bound by the 3-a-day limit.
• Verification. 3 references unlock free verification. The badge is given automatically after the face check (section 3).
• Reports. If several different people report the same user, a caution notice may appear (section 5). Reports are counted together across all accounts linked to the same email address.

We believe none of these processes has legal or similarly significant effects on you. In any case, you can ask for a person to review your case: write to us.

12. How long we keep data

13. Deleting your account

You can delete your account from your profile settings ("Account Removal"). If you sign in with email and password, the app may ask you to enter your password again. If you sign in with Google or Apple and the deletion does not go through, write to us and we will complete it.

You can also ask us to delete your account and data without the app: write to contact@coinquilino.app from the email address you registered with.

Deleting from the app removes:

• your sign-in account;
• the profile data stored on your account, namely email, phone, date of birth, blocks and verification result;
• your seeker profile;
• your listings, with their photos, counters and visits.

For now, deleting from the app does not automatically remove:

• your profile photo files and your face photo;
• the copy of your verification score and steps in our logs;
• if you created your account with email, a copy of the email address used to verify it;
• the messages you sent, with your Google or Apple account name and photo if you sign in that way;
• the requests you sent and received, and your teams;
• the references and reviews you wrote or received;
• your agency page, which stays visible, and its reviews;
• agency mandates and the edit history of listings;
• your favourites, preferences and request count;
• your compatibility votes and the chats and messages you hid;
• the role you chose, your invite code and some profile-related counters;
• the visits you made and the visits to your profile;
• logs, feedback and your purchase history at RevenueCat.

Write to contact@coinquilino.app, even after deleting your account, and we will delete or anonymise all of this within one month. The only exception is reports about you, which we may keep to protect other users (section 12).

Deleting your account does not cancel your Gold subscription. To cancel it, use the subscription settings in the App Store or Google Play.

14. Your rights

You have the right to:

• access your data;
• correct it;
• have it deleted;
• restrict how it is processed;
• receive it in a portable format;
• withdraw any consent you have given, at any time.

Right to object. You can object at any time to processing based on legitimate interest (section 4) by writing to contact@coinquilino.app. For visits, turning on incognito is enough. For statistics and crash reports, section 9 explains what the app can and cannot do yet.

In the app you can, on your own:

• edit your profile and listings;
• delete your seeker profile and listings;
• turn on incognito;
• refuse invitations;
• block other users;
• delete your account.

For everything else, write to contact@coinquilino.app. We reply within one month. If the request is complex we may extend this by two more months, and we will tell you within the first month. To protect your account, we may ask you to write from the email address you registered with, or to confirm the request in another way.

You also have the right to complain to the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or to the authority in the country where you live.

15. Minors

Coinquilino is for people aged 16 and over. The app does not accept a date of birth that shows a younger age, but it does not verify the age you give. If you know that someone under 16 is using the app, write to us and we will remove the account.

16. Security

We use reasonable measures to protect your data:

• encrypted connections;
• access rules on the database and on files;
• Google's infrastructure.

No system is 100% secure, though. Keep your password safe and don't share your account.

17. Changes

We may update this policy. The version in force is always the one published at coinquilino.app/en/privacy, with its date. If the changes are important, we will let you know with a notice.

Contact: contact@coinquilino.app