Open2Place
Open beds. People needing housing. Connected.
Effective Date: 10/4/2026 Last Updated: 10/4/2026
This Privacy Policy describes how Open2Place collects, uses, shares, and retains information in connection with the Open2Place website, applications, and related services (the "Platform"). This policy is drafted from an audit of Open2Place's actual production implementation and describes real current practices; it is a business draft for attorney review, not final legal advice.
When you create an account, we collect your name, email address, and password (processed by our authentication provider, Supabase Auth -- Open2Place's own systems never see your raw password). We also record the role you select (seeker or provider) and, if you accept legal agreements, the specific document versions and timestamp of your acceptance.
Providers additionally submit business/organization information through provider onboarding (business name, contact details, website, organization type, service areas, description).
Providers submit property details (name, address/location precision, description, pricing, availability, room type, gender served, population tags, accessibility features, house rules, and photographs) to create public listings.
Seekers (or someone posting on their behalf) submit housing-request details (location, budget, move-in timing, housing-type and population preferences, and a free-text description) so providers can discover and respond to the request. Some request fields -- age range, gender, population tags, income/funding information, and accessibility/transportation needs -- can reflect sensitive or protected characteristics; see our Fair Housing & Non-Discrimination Policy for how this information is and is not used.
Direct messages between seekers and providers (contact requests, housing-need responses) are stored so both parties and Open2Place can reference the conversation, and may trigger an email (via Resend, our transactional email provider) and/or a push notification to the recipient.
Providers can maintain private notes, status, and follow-up information about their own leads in Open2Place's CRM tools. This information is visible only to the provider who created it and to Open2Place administrators -- it is never visible to the seeker/poster it concerns or to other providers. A structured, append-only activity log records status changes for audit purposes; it does not store the content of private notes.
Property photographs and Community & Events photographs are stored in Supabase Storage and are served publicly (these buckets are public-read by design, since listing/event photos are meant to be publicly visible). No other file-upload feature exists today -- there is no resume/ID/document upload or avatar upload anywhere on the Platform.
Open2Place's authentication provider (Supabase) sets a session cookie to keep you signed in. A separate first-party cookie (`o2p_qr_tid`) stores an anonymous identifier used solely to attribute a QR-code scan (e.g., from a shirt or flyer) to a later signup, for marketing-attribution purposes; it expires after 30 days. Theme preference (light/dark) is stored in your browser's local storage, not a cookie. No third-party advertising or tracking cookies are used.
Open2Place records first-party product-usage events (e.g., a search performed, a listing viewed, a message sent) in its own database to understand how the Platform is used. No third-party analytics service (such as Google Analytics) is used. [FLAG FOR OWNER/LEGAL REVIEW: no fixed retention or automatic deletion period currently exists for this analytics data -- a retention period should be decided and documented.]
If you enable push notifications, your browser's push service (operated by your browser vendor -- for example Google, Mozilla, or Apple, depending on which browser you use) issues a subscription endpoint and keys, which Open2Place stores so it can deliver notifications (new message, new match, CRM reminders, etc.) through that service. You can disable push notifications at any time; Open2Place also automatically removes a subscription once your browser reports it is no longer valid.
Open2Place uses Resend to deliver transactional emails (e.g., notifying you of a new message or response). Supabase Auth independently sends account-related emails (signup confirmation, password reset) using its own email delivery.
Provider subscriptions are billed through Stripe. Creating a subscription sends your email address and an internal Open2Place account identifier to Stripe to create a Stripe customer record; Open2Place stores only a reference to your Stripe customer/subscription IDs, never your card details, which Stripe collects and holds directly.
Supabase Auth manages account credentials and sessions.
Open2Place is hosted on Vercel; its database, authentication, and file storage are provided by Supabase.
Open2Place does not currently offer or use any identity, income, or background screening service. If this changes in the future, this Policy will be updated with the relevant provider, data flow, and required disclosures before such a feature launches.
Information is used to operate the Platform: creating and displaying listings and housing requests, enabling communication between users, providing provider CRM tools, processing subscriptions, sending relevant notifications, and understanding Platform usage to improve it.
Information is shared with other users only as necessary for the Platform to function (e.g., a seeker's housing request is visible to providers; a provider's listing is public). Information is shared with the third-party service providers described above (Supabase, Resend, Stripe, your browser's push service, Vercel) solely to provide their respective services to Open2Place. Open2Place does not sell personal information, and does not share information with third parties for their own independent marketing purposes.
Property listings, housing requests, messages, and CRM records are retained for as long as your account remains active. [FLAG FOR OWNER/LEGAL REVIEW: no separate fixed retention schedule currently exists for CRM notes or closed/expired housing requests -- a retention policy should be decided and documented.]
You may delete your account at any time from Account Settings. Deletion is immediate and permanent: your housing requests are deleted outright, and deleting your account removes your profile, property listings (and their photos), CRM records, contact requests, saved items, and push-notification subscriptions. This is not reversible and there is no grace period -- please be certain before deleting your account.
Open2Place relies on Supabase's infrastructure-level security (encryption in transit via HTTPS, and database access controls) and enforces row-level security policies so that, for example, a provider's private CRM notes are never readable by anyone other than that provider or an administrator. [Specific encryption-at-rest configuration should be confirmed with Supabase's current documentation before this section is finalized, rather than asserted here.]
Open2Place is not directed to, and does not knowingly collect information from, children under 13. If you believe a child has provided us information, contact us using the information below so it can be removed.
You can review and update your account information, manage push-notification permissions through your browser, and request account deletion at any time through Account Settings.
Open2Place may update this Privacy Policy. Material changes may require acceptance of the updated policy before continued use of affected functionality, consistent with our Terms of Service.
Questions about this Privacy Policy may be submitted through the contact information provided on Open2Place's Legal or Contact page.