Privacy
Gaffwise · last updated 11 October 2026
Gaffwise is a small tool for people buying a home in the UK. This page explains what it keeps about you and what you can do about it.
In plain English
- We keep only what you and your household put in — your email address, the homes you're weighing up and your figures — so you can see it again.
- Only the people in your household can see it.
- No adverts, no tracking you around the web, and we never sell or share your data.
- A few trusted services help run the site (Supabase stores it, Vercel hosts it, Google signs you in), mostly in London.
- You can download your data or delete your account yourself, any time.
- Questions? Contact mario24jsp@gmail.com.
Who runs it
House Hunt runs this copy of Gaffwise and is responsible for your data (the “controller” under UK GDPR). Contact: mario24jsp@gmail.com.
What we keep
Your Google sign-in
Your email address and Google's account number, plus when you signed in. We ask Google for nothing else — no access to your mail, contacts, calendar or files.
Why: to sign you in and keep your household's data yours.
Your household
Who is in it, their role and when they joined, and invite links (kept only as a fingerprint, never the link itself).
Why: so the people buying together share one search.
Your buyer figures
Only what you choose to give: cash, income, mortgage rate, fees, whether you're a first-time buyer, and what matters to you.
Why: to work out what you can afford and how hard to negotiate. We treat these as sensitive: only your household can read them.
Homes and your notes on them
Address and location, listing details, notes, viewings, agent answers, offers, comparables, checklists, and a dated snapshot of each assessment.
Why: it's the point of the tool — to weigh up homes and remember what you knew when.
Places you travel to
Optional. A label and an address or postcode, e.g. “Work”.
Why: to estimate journey times from each home.
Short-lived server logs
Which pages were asked for, when, and any errors. Sign-in tokens, email addresses, postcodes, locations and your data are stripped out first.
Why: to keep the site working and secure.
Everything your household enters is visible to everyone in that household and no one else — the database checks this for every record. Household members see each other's role and join date, not each other's email address.
Why we're allowed to
Almost everything is kept because you asked for the service and it can't work without it. The logs are kept because running a working, secure site is a fair reason.
The legal bit: lawful basis for each
| What | Lawful basis (UK GDPR) |
|---|---|
| Google sign-in | Contract — it is how the service you asked for works. |
| Household | Contract. |
| Buyer figures | Contract. Financial details are not special category data, but they are treated as sensitive. |
| Homes and notes | Contract. |
| Places you travel to | Contract (optional). |
| Server logs | Legitimate interests — running a working, secure site. |
Who helps us run it
- Supabase stores your data and handles sign-in, in London.
- Vercel hosts the site. The app runs in London; pages are delivered from wherever is nearest you.
- Google signs you in. Google's own privacy policy covers your Google account.
- We count page visits with Vercel Web Analytics, which doesn't use cookies or identify you.
Where exactly, and transfers outside the UK
- Supabase: the region this deployment chose — London, AWS
eu-west-2, per its setup guide. - Vercel: the app's functions run in London (
lhr1). Its edge network, logs and Web Analytics (page-view counts without cookies) are run by Vercel Inc. in the US. - Supabase, Vercel and Google are US companies. Where your data reaches the US it is covered by the UK–US data bridge or the UK's international data transfer addendum to their standard contractual clauses, under their data processing agreements.
Public data we look up for a home
To fill in details about a home or area, we send a postcode, location or address — never your name or email — to public services:
- postcodes.io where a postcode is
- HM Land Registry sold prices
- police.uk street crime
- OpenStreetMap parks, schools, shops; finding a street
- Transport for London journey times
- EPC register energy certificates
- Bank of England mortgage rates
- Listing sites a link you paste
More detail on these
- postcodes.io: postcode location and local authority.
- HM Land Registry: sold prices and the house price index.
- OpenStreetMap (Overpass): parks, schools, shops and stations nearby.
- OpenStreetMap (Nominatim): when you look a property up by street or area name rather than a postcode, the words you typed are sent to find where it is.
- The EPC register: only where it is configured.
- The Bank of England: published mortgage rates — nothing about you is sent.
- A listing site: only when you ask the app to read a listing link you pasted.
- Your browser loads the map from OpenStreetMap's tile servers and the map code from cdnjs (Cloudflare), which see your IP address as any website does. Links to Google Maps and listing sites open those sites; nothing is sent until you click one.
How long we keep it
- Your account and household dataUntil you delete it
- Assessment snapshotsThe latest 50 per property
- Invite linksWork for 7 days
- Sign-in cookiesUp to 30 days
- Logs and backupsA few days
The fine print
- Older assessment snapshots are deleted as new ones are made.
- An invite record is deleted 30 days after it was used or expired.
- Sign-in cookies: an hour for the session, 30 days for staying signed in.
- Logs and backups at Supabase and Vercel are kept for the short periods their plans set (typically days), then overwritten.
Your rights
Under UK GDPR your data is yours. Most of this you can do yourself when signed in:
See it
Right of access. Household → Download my data gives you a file of everything you can see.
Take it with you
Right to portability. The same download is a standard JSON file other tools can read.
Fix it
Right to rectification. Edit anything on its page; your figures are on Your profile.
Delete it
Right to erasure. Delete a home from its page, or use Household → Delete my account.
Pause it
Ask for its use to be restricted while something is sorted out.
Object
You can object to us using it — for example, in the server logs.
For anything you can't do yourself, contact mario24jsp@gmail.com. We'll reply within one month.
What happens when you delete your account
If you are your household's only member, everything in it is deleted. If others share it, your membership and sign-in are deleted and the shared search stays with them.
Cookies
We only use the few small files this site needs to keep you signed in and safe — no advertising or tracking, so there's no cookie banner. Nothing is set until you start signing in.
We count page visits with Vercel Web Analytics, which doesn't use cookies or identify you. Nothing is kept in your browser's local storage.
Technical details
All are first-party and strictly necessary.
hh_at- Signed-in session · 1 hour
hh_rt- Stay signed in (refresh) · 30 days
hh_csrf- Proves a form was sent from this site · 30 days
hh_gflow- Google sign-in in progress, then removed · up to 10 minutes
hh_pkce- Google sign-in in progress, then removed · up to 10 minutes
hh_next- Page to return to after sign-in, then removed · up to 10 minutes
hh_profile_seen- Welcome step already seen · 1 year
hh.open.*- Session storage, property page only: which sections are open · until the tab closes
No advertising, analytics or tracking cookies. Vercel Web Analytics counts page views without cookies.
Questions or complaints
Contact mario24jsp@gmail.com first. If you're unhappy with how your data is handled, you can complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.
Changes
If this changes, this page will say so and the date at the top will move.