Legal
Privacy Notice
What we collect, why we collect it, who else touches it, and how to get rid of it. We have tried to write this so that reading it is actually possible.
Last updated: 11 September 2026
Homing Star is a prototype
It is an early, free, work-in-progress project run by one person, and no company has yet been formed to operate it. These documents describe how it actually behaves today and are written in good faith, but they have not been reviewed by a lawyer. Nothing here is professional advice of any kind, the service is provided as-is, and you use it at your own risk. If any of that matters to your situation, please do not rely on Homing Star — and write to eamon.duffy0@gmail.com with anything you need answered directly.
The short version
This is a summary of the full notice below. It is here for readability and does not replace anything that follows.
- We never ask for bank logins, account numbers, card numbers, or a Social Security number, and we never run a credit check.
- There is no analytics, no advertising, no tracking pixels, and no third-party marketing code anywhere in this product.
- We do not sell your information, share it for advertising, or hand it to data brokers.
- You can use the Plan questionnaire as a guest with no account at all. Those answers stay in your own browser until you choose to create one.
- Nothing here can move, hold, or access your money. There is no bank connection to make.
Who we are
Homing Star ("we", "us") is an independent prototype, built and run by one person. No company has been formed to operate it, so there is no registered entity or trading address to name here yet. When that changes, this section changes with it.
In the language of data protection law we are the controller of the information described below, and we take that responsibility seriously whether or not there is a company attached to it.
Everything — questions, requests, complaints — goes to eamon.duffy0@gmail.com, which reaches a person directly.
What we collect
We collect what the product needs in order to do the thing you asked it to do, and we have tried to keep that list short enough to print in full. It falls into six groups.
- Account details. Your email address, the username you choose, and optionally your name. If you set a password we never see it — it is hashed by our authentication provider before it reaches storage. If you sign in with Google instead, we receive your email address, your name, and your profile picture URL from Google, and there is no password for us to hold at all.
- What you tell the Plan questionnaire. Who is buying and why, the area you are looking at, the kind of home you want, your income and how steady it is, what you have saved, what you set aside each month, and what you already owe. Where we ask about credit we ask for a range, and that question is optional.
- What we work out from those answers. Affordability ranges, monthly payment breakdowns, readiness verdicts, savings runways, and the dated snapshots that let you see how your position has moved over time.
- Shared journey data. If you plan with a partner, friends, or family, we store who is in the journey, who owns it, the invites you send, each member's own financial contribution, the posts and reactions on your journey wall, and an activity feed of who changed what.
- What you do on the Decide page. The search filters you set, and the listings you save.
- Technical records. Our hosting and database providers log IP addresses, timestamps, and request details as part of running the service and keeping it secure. We do not join those to your plan data to build a profile of you.
What we never collect
This list is a commitment about how the product is built, not a description of our current preferences.
- Bank login credentials. There is no bank connection anywhere in Homing Star, and no screen that asks for one.
- Bank account, routing, or payment card numbers.
- Your Social Security number, or any government identity number.
- Your credit file or credit score. No credit check is performed at any point, by us or on our behalf. The credit question asks you to pick a range, and you may skip it.
- Documents. We do not ask you to upload pay stubs, tax returns, or bank statements.
What we use it for
- Running the calculations you asked for, and showing you the results.
- Saving your progress, so you can stop halfway and come back on another device.
- Showing the other members of a journey you joined the shared picture that journey exists to produce.
- Keeping accounts secure, preventing abuse, and diagnosing faults.
- Meeting our legal obligations.
We do not use your information to advertise to you, to profile you for anyone else, or to introduce you to a lender, broker, or agent. We take no commission from anyone, so there is no third party on the other side of your data with an interest in it.
What other people in your journey can see
A shared journey exists so that everyone buying together sees the same picture, which makes joining one a deliberate act of disclosure. It is worth being precise about what that means.
- Every member of a journey can see the household totals and each individual member's financial contribution to them. That is the point of sharing a journey rather than each keeping a private plan.
- Every member can see the journey wall — the posts, the reactions, and the activity feed showing who changed what.
- The person who created the journey owns it. Only the owner can invite people, remove them, or manage invite links. Other members can edit the plan data but cannot change who is in the journey.
- An invite link grants all of the above to whoever redeems it. Treat one like a key, and do not post it anywhere public.
- Nobody outside a journey can see anything inside it.
Who else processes it
We use a small number of service providers to run Homing Star. They process information on our instructions and for no purpose of their own. This is the complete list.
- Supabase — our database, authentication, and server-side functions. Effectively everything described above is stored here.
- Vercel — application hosting. Handles and logs the requests that serve the site.
- RentCast — property listing data for the Decide page. We send search criteria such as a location and a price range. We do not send your identity, your account, or your financial answers.
- OpenStreetMap — map tiles. When a map renders, your browser requests tiles directly from OpenStreetMap's tile servers, which necessarily reveals your IP address to them.
- Google Fonts — typefaces. Your browser fetches these from Google's servers on page load, which reveals your IP address to Google.
- Google — only if you choose to sign in with Google. That flow is between you and Google under Google's own privacy policy; we receive the result. If you keep the profile picture from your Google account, we store the address of that picture rather than a copy of it, so each time it is displayed your browser fetches it from Google's servers. Choosing to show your initial instead stops that, and you can switch at any time in Settings.
We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in US state privacy law.
No analytics and no tracking
Homing Star contains no analytics package, no advertising network, no tracking pixel, no session recorder, and no third-party marketing script. That is verifiable rather than aspirational: there is no such code in the application to disable.
The practical consequence is that we cannot tell you what you personally did on the site, because we did not record it.
Cookies and browser storage
- Authentication cookies. Set once you sign in, to keep you signed in. These are strictly necessary — the product cannot know who you are without them.
- Local storage. Holds your Plan draft while you are working as a guest, and remembers your light or dark theme choice. This never leaves your browser. Clearing your browser data clears it, and a guest draft cleared that way cannot be recovered by us, because we never had it.
We set no advertising or analytics cookies, which is why you are not being asked to dismiss a cookie banner.
How long we keep it, and how to delete it
- Account and plan data is kept while your account is open, because its whole purpose is to still be there when you come back months later.
- Dated affordability snapshots are kept for the life of the account, since the history is what makes the runway meaningful.
- Delete your account and we delete the personal information associated with it, except anything we are required to keep by law or need in order to resolve a dispute.
- Deleting your account does not delete a shared journey for the other people in it. Their contributions and the shared history remain theirs.
- To request deletion, write to eamon.duffy0@gmail.com.
Your rights
Depending on where you live, you may have the right to see the information we hold about you, correct it, delete it, obtain a portable copy, or object to particular uses. Where a right applies to you we will honour it, and we will not treat you differently for exercising it.
Make any of these requests at eamon.duffy0@gmail.com. We may need to confirm your identity first, which for an account holder normally means writing from the address on the account. If you think we have handled your information badly, you are entitled to complain to your local data protection authority.
How it is protected
- Every table holding your data enforces row-level security, so a request can only reach rows belonging to you or to a journey you are a member of. That is enforced by the database itself, not only by the application.
- Traffic is encrypted in transit, and data is encrypted at rest by our hosting providers.
- Passwords are hashed by our authentication provider and are never visible to us.
- Keys capable of bypassing those controls are held server-side only and are never sent to your browser.
No system is perfectly secure, and we will not pretend otherwise. If we discover a breach affecting your information we will tell you, and any regulator we are required to notify, as promptly as the law requires.
Age
Homing Star is not intended for children. You must be at least 18 to create an account. If we learn that we hold information from someone under that age, we will delete it.
Changes to this notice
If we change this notice we will update the date at the top. Where a change materially affects how we handle information you have already given us, we will tell account holders directly rather than relying on you to notice.
Questions, requests, and complaints all go to eamon.duffy0@gmail.com. There is no postal address to write to yet, because there is no company — see "Who we are" above.