Privacy notice

Who is responsible

This notice is for Homecode, the public name of the website published at sortmyhouse.co.uk. The operator of that site is the data controller for personal data the site processes. The legal name, registered office and any Information Commissioner’s Office (ICO) registration number will be added only when the owner supplies them. Until then, those details are unpublished rather than implied.

This notice is written for people in the United Kingdom and refers to UK GDPR and the Data Protection Act 2018. It does not describe California or other non-UK regimes.

What this notice covers

It describes processing that the published application actually does today. It does not promise a process the code does not implement. If that changes, this notice should change with it.

What we process, and why

Most pages are static publishing. You can read them without creating an account. The site does not offer user registration, a customer account or a first-party mailing list.

When you use a lookup tool, the browser sends an ordinary web request. The production server reads the Cloudflare connecting-IP header, or the first X-Forwarded-For value if that Cloudflare header is absent, and may also read the Cloudflare country header. Those values are used to identify the client connection for the address-tool rate limiter. They are not used to build a marketing profile.

We process this information to operate the site, to limit abuse of the lookup endpoints, and to diagnose request failures. We do not sell it.

Postcode and address lookups

The address tool and the postcode comparison tool use GET forms. If you submit a postcode, that postcode appears in the page URL as a query parameter. If you then choose a property, the address tool uses an opaque selector rather than printing a full address in the selector itself.

The application does not write a first-party search log of the postcodes or addresses you look up. The in-memory rate limiter described below stores a hashed connection identifier and counters. It does not store the postcode.

That is not the same as saying a postcode never appears in any log. See the sections on failed-request logs and Cloudflare.

Rate limiting

The address search and report endpoints share a short-lived budget: 60 units per 60 seconds, with search costing 1 unit and a report costing 2. The limiter hashes the connection identifier with SHA-256 and a server-side salt, then keeps the hash, the counters and timestamps in memory.

Those hashed entries are dropped when their window ends or when they have not been seen for 120 seconds. The limiter does not persist the raw IP address or the postcode you typed.

Failed-request logs

If the Node server fails to handle a request, it writes the HTTP method, the request URL and the error to the process error log. The URL can include a query string. On the address and comparison tools that query string can contain a postcode.

The application does not define a retention period or a redaction rule for those error lines. Treat that as a current limitation, not as a promise that failed lookups are invisible.

Cloudflare

The production server is written to sit behind Cloudflare: it reads Cloudflare connecting-IP and country headers when they are present. Cloudflare, as the content delivery and security layer, can see IP addresses, requested URLs (including query strings) and standard request metadata.

Cloudflare processes that information under its own terms. This notice does not control Cloudflare’s retention. Cloudflare may also set its own security cookies. Those are Cloudflare’s cookies, not a Homecode analytics identifier.

Cookies and analytics

The published Homecode application does not set its own tracking cookies and does not run a first-party analytics collector. There is no cookie banner because this site is not using a first-party analytics cookie.

Your browser, your network and Cloudflare may still keep their own logs or cookies. We do not describe those as Homecode analytics.

How long we keep data

Rate-limit hashes and counters are held in memory for at most 120 seconds after last use, and they are also dropped when their 60-second window ends.

Failed-request logs have no retention rule in the application code. Operator-held server or Cloudflare logs, if any, follow those operators’ own retention. This notice does not invent a deletion timetable for logs we do not control in code.

We do not keep a first-party customer database of people who used the lookup tools.

Your rights under UK GDPR

You can ask for access to personal data we hold about you, for correction, for erasure, for restriction of processing, and to object to processing. Where the conditions in UK GDPR are met, you can also ask for data portability.

Because this site does not run user accounts, we may need enough information to find any record that actually exists. For many visits there will be nothing in a first-party store to retrieve beyond short-lived rate-limit hashes that expire on their own.

To make a request, use the contact channel on the contact page once it is published. We will not ask you to use a US-style “do not sell” form; that is not the UK framework.

Complaints

You can complain to the Information Commissioner’s Office if you are unhappy with how personal data has been handled. The ICO is the UK supervisory authority. Details are on the ICO website at ico.org.uk. This paragraph does not claim that Homecode has published an ICO registration number.

Changes to this notice

If the site starts to collect more personal data, or stops logging something this notice describes, the notice should be updated on the same change. The review date at the bottom of this page is the date this wording was last checked against the published code.