Hamburg Housing Search · Data handling
Privacy Policy
This policy covers Hamburg Housing Search, its private housing-search worker and these information pages. It does not cover ONYX trading products. The project’s authorized operator administers the deployment on behalf of the connected account owner. For access, correction, deletion or privacy questions, contact the project using the email below.
1. Gmail access and data collected
The application uses Google OAuth; it does not ask for your Google password. The present IMAP/SMTP integration requires the restricted scope https://mail.google.com/, which permits reading, composing, sending and permanently deleting Gmail messages. The application does not implement permanent deletion or use that capability. No Drive, Calendar or Contacts scopes are requested by this connection.
The worker reads Inbox and configured Spam/Junk folders without intentionally changing read flags or labels. It obtains sender and reply addresses, subject, dates, message and thread-reference identifiers, authentication headers, message text and links. IMAP retrieves the complete message payload for parsing, so attachments may be transferred as part of that payload; the normal mail importer does not separately save attachment files. Parsed text can include personal details, apartment addresses, financial information or viewing times supplied in an email.
There is no housing-only filter before import. Unrelated messages in the monitored folders can also be read and their parsed content stored. The initial Inbox scan normally covers the latest 100 messages and later scans process new messages in batches; authorized audits can read historical records. Prefer a mailbox dedicated to the housing search.
2. Purposes of use
Gmail information is used to identify housing offers, match replies to applications, distinguish receipts from invitations or refusals, detect requests for documents or questionnaires, prevent duplicate actions, and send configured notifications. Authorized outgoing messages and viewing confirmations use the connected Gmail account. The system also keeps operational evidence needed to diagnose errors and reconcile uncertain deliveries.
We do not sell Gmail data, use it for advertising, advertising profiles, credit scoring or unrelated marketing, or use it to train general-purpose AI models.
3. Storage and protection
The worker stores parsed messages, application records and logs in its private Windows deployment on the operator-managed VPS. OAuth credentials and saved authentication material are protected with Windows DPAPI. Database content is not automatically encrypted by SQLite; access depends on the deployment’s Windows account, filesystem permissions and host security. Authorized maintenance may create local copies or backups. This is not a claim of end-to-end encryption or a security certification.
Connections to Google use TLS. Authentication tokens are kept out of the public website and public source repository. The static website has no access to the private mailbox database or OAuth credentials.
4. Recipients and third-party services
- Google: handles authorization and the Gmail connection under its own policies.
- VPS hosting provider: supplies infrastructure on which the private worker and its stored data reside.
- Telegram and configured chat members: receive housing-status information, such as the property, reply status, dates and relevant message details, when the account owner has authorized that notification channel. Chat membership determines who can see these messages.
- Landlords and rental platforms: receive relevant applicant information and correspondence only through authorized housing applications or replies. The mailbox as a whole is not forwarded to them.
- Authorized maintenance: the operator may inspect specific correspondence and use OpenAI Codex to assist with troubleshooting when the account owner authorizes that review. Relevant content included in such a review can be processed by that service; there is no routine worker integration sending the entire mailbox to an AI service.
- GitHub Pages: hosts only these public information pages. It may process visitor IP addresses and request information for hosting and security. The pages do not load advertising, analytics scripts, tracking pixels or external fonts.
Transfers of Google user data are limited to providing these disclosed, authorized features, security, or legal obligations. Human access is limited to the account owner’s authorized review, necessary security investigation or legal requirements. We do not share Gmail data with advertisers or data brokers. Third-party services may process data in countries other than the user’s country.
5. Retention, stopping access and deletion
The current deployment has no automatic retention deadline or self-service deletion screen. Stored records remain until the operator removes them. Revoking Google authorization stops future authorized access but does not erase previously stored records, backups, sent emails or Telegram notifications.
You can revoke the connection in Google Account connections. To stop the worker and request deletion, email the project from the connected account. After confirming the request and its scope, the operator must stop further processing and manually remove the relevant credentials, imported records, derived housing records, logs and operator-controlled backup copies, subject to any applicable legal retention requirement. Completion and any remaining limitation must be confirmed to you; there is no automatic deletion-time guarantee.
Removing SQLite rows alone may leave recoverable database or backup copies, so deletion must cover those copies as well. Copies already held by Gmail, landlords, rental platforms, Telegram or chat members follow those recipients’ controls and retention policies and cannot be guaranteed erased by this application. The app does not delete your original Gmail mailbox.
6. Google Limited Use and changes
Hamburg Housing Search’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This statement is a commitment, not a claim that Google has verified the application.
Material changes to data uses or requested permissions must be disclosed before they take effect, with renewed consent where required. You may contact the project to request access to or correction of your stored information and to raise a privacy concern.