Privacy Policy

Homly is operated by ShoukanLab, a trading name. There is no registered company behind it at present; the service is run by its founder, based in Dammam, Saudi Arabia.

For anything on this page — a question, a correction, a copy of your data, or a complaint — write to iyark2002@gmail.com. We aim to reply within 30 days.

Everything below is either something you typed into the app or something the app needed in order to work. We collect nothing in the background, and there is no advertising or analytics software in Homly at all.

Everyone with an account

• Phone number. Required. It is how you sign in and how we reach you about a job.
• Email address. Optional, unless you are an administrator.
• Password. Stored only as a bcrypt hash. We cannot read your password and cannot tell you what it is.
• Your name, and for professionals a display name and an optional short bio.
• One-time codes sent by SMS or email to confirm your phone or address, and short-lived sign-in tokens. Sign-in tokens are stored hashed, not in the clear.

If you are booking work

• The job address and its coordinates. A professional cannot quote for work without knowing where it is, and we match requests to people nearby, so the location is stored with the request.
• What you wrote about the problem, how urgent it is, and any photos you attached.
• A default address, if you save one.
• Your bookings, ratings and any complaints you raise.

If you are working through Homly

• Identity documents: the front and back of your national ID or Iqama, and a selfie holding it. This is the most sensitive thing we hold. We ask for it because customers let strangers into their homes, and a marketplace that does not check who its professionals are is not one worth trusting.
• Business details, if you register as a business — the business name, commercial registration number, and how many technicians you have.
• Where you work: your service area, base coordinates, and the categories of work you take.
• Your record on the platform: jobs completed, quotes sent, average rating and number of ratings.

Location

The app asks for your device location only when you tap the button to centre the map on where you are. You can refuse and place the pin by hand instead; nothing stops working. We do not track your location in the background, and the app has no permission to do so.

Notifications

If you allow notifications, we store a token identifying that installation of the app so we can send you one. It is deleted when you sign out or uninstall.

Payment

Homly records the amount of a job, whether it was paid, and how it was settled. We never see or store card numbers. Payment happens between you and the professional; Homly is not a payment processor and holds no card details.

• To run your account and let you sign in.
• To match a request to professionals near it, and to let them quote for the work.
• To verify that a professional is who they say they are, before customers let them into their homes.
• To send one-time codes, and notifications about your jobs.
• To settle disputes. If a job goes wrong, the record of what was agreed is how we work out what happened.
• To detect and stop fraud and abuse of the platform.

We process this because it is necessary to provide the service you asked for. Where the law requires your consent — device location and notifications — the app asks, and you can say no.

The professional you engage

When you accept a quote, that professional sees your name, what you wrote about the job, the address, its coordinates and any photos. They need it to turn up and do the work. Professionals who have not been engaged see the request and its general area, not your identity.

Companies that run our infrastructure

These process data on our instructions to keep Homly working. They do not use it for anything of their own.

• Neon — the database.
• Render — hosting for the Homly service.
• Cloudflare R2 — storage for photos and identity documents.
• Google Maps Platform — showing the map, searching for an address, and turning a map pin into a street name.
• Amazon Web Services — sending SMS and email.
• Google Firebase Cloud Messaging — delivering push notifications.

Some of these operate outside Saudi Arabia, so your data may be processed abroad.

Nobody else

We do not sell your personal data, and we do not share it with advertisers or data brokers. We would disclose data if the law or a valid order from a Saudi authority required it, and we would tell you unless we were forbidden from doing so.

• Your account and job history — for as long as your account exists.
• Identity documents — until your account is deleted, then removed from storage. We keep the fact that a document was approved or rejected, not the image.
• Notification tokens — until you sign out, uninstall, or the device stops accepting them.
• One-time codes — minutes. They expire and are unusable afterwards.
• Records of administrator actions — kept after an account is deleted, without the personal details, so that decisions like a suspension remain accountable.

In the app, go to Account → Delete account. You are asked for your password to confirm it is you, and the account goes immediately. Nobody has to approve it.

Deleting your account removes:

• your name, phone number, email address and saved addresses;
• your identity documents, from our storage as well as our records;
• your notification tokens and every signed-in session;
• your notifications and any unused verification codes.

Your past jobs stay, without you attached to them. The requests you posted, the quotes exchanged, the bookings that followed and the ratings left on both sides remain on the system with your details stripped out. They are not solely yours: the professional on the other side of a job has their own legitimate record of it, and a rating average would quietly change if a past customer could erase their review by closing an account.

Deletion is refused while you have a booking that has not finished, and the app will say so. Someone is expecting you to turn up or to be paid, and replacing their counterparty with “Deleted user” mid-job would strand them. Cancel or complete it first.

If you cannot sign in, email iyark2002@gmail.com with the phone number you registered, and we will do it for you.

No system is perfectly secure, and anyone who tells you otherwise is selling something. What we do:

• Everything travels over an encrypted connection.
• Passwords are stored as bcrypt hashes and sign-in tokens as hashes, so a copy of our database does not hand anyone your password.
• Identity documents sit in private storage. They are never publicly linkable, and are reachable only through a signed link that expires within minutes.
• Uploaded files are checked by reading their actual contents, not by trusting the name or the type the app claims.
• Staff access is limited by role, every administrative action is written to an audit log, and those actions are rate-limited.

Under the Saudi Personal Data Protection Law you may ask us to show you the personal data we hold about you, correct it if it is wrong, delete it, or stop a particular use of it. You can also withdraw consent for location or notifications at any time in your phone's settings.

Write to iyark2002@gmail.com. We will not charge you and we will not ask why. If you think we have handled your data badly, you can complain to the Saudi Data & AI Authority (SDAIA).

Homly is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has registered, tell us and we will remove the account.

If we change how we handle your data we will update this page and change the effective date at the top. If the change is significant we will tell you in the app rather than hoping you re-read this.