Download for iPhone

Privacy policy

Effective date: September 15, 2026

Habibi Stay is provided by Mangla & Co LLC, a Virginia limited liability company. This is the canonical privacy policy for the Habibi Stay app and the Habibi Stay website.

Information the app handles

The app handles the phone number used to verify your account; profile information you provide, such as your name, city, email, preferred language, a short note about yourself, hosting preferences and exact address; the name and phone number of an emergency contact, if you choose to give one; the relationships and private people you choose to save; possible hosts you note, and whether your connections may ask you about them; questions you send or receive about a city; stay requests, dates and participant roles; request and Connector notes; safety reports and blocking state; an optional device notification token; a coarse record of when your account was last active; and limited security, access, quota and audit records.

An exact Host address and phone number are served only to the Guest after an accepted stay. They are not sent to a Connector or unrelated member.

An emergency contact is optional. If you give one, it is visible only to you. Habibi Stay never serves an emergency contact name or phone number to another member, including a Guest staying with you, and it is removed when you delete your account. Please only enter someone who is content for you to hold their details.

Contacts discovery

Contacts access is optional. If you choose it, the iPhone app normalizes phone numbers from your Contacts and sends them to Habibi Stay over encrypted TLS connections in bounded batches for a transient membership check. Contact names remain on your device. The response contains only your opaque local contact reference and an on-app yes/no result. It does not return a member's name, city, user ID, Host status, roles, profile, network, relationships or availability.

Habibi Stay does not store the raw phone numbers or local contact references from this discovery request. It keeps server-keyed phone fingerprints, request identifiers, bounded counters, decisions and timestamps for abuse prevention for no more than 35 days. A member who already knows a phone number may still learn the one-bit fact that the number belongs to an eligible Habibi Stay account, subject to strict rate and rolling quotas.

If you review and save a person, that creates a separate private record in your account. Saving alone sends nothing and creates no relationship, and the person is never told that you saved them.

Possible hosts

You can note someone who might be able to host in a city: their name and the city, and, if you choose, a phone number, how you know them and a private note. Noting someone sends them nothing and creates no account or relationship. The name, phone number, relationship and note stay yours. Nobody else can read them, including that person if they later join.

For each note you choose whether your connections may ask you about that city. If you allow it, a member you are connected with who searches that city, or a place close to it, can see that you may know someone who could host there, and can ask you. They see your name and the city and nothing about the person you noted: not their name, phone number, how you know them, your note, or how many people you have noted. It is not a listing or a room, and it does not say that anyone is available. Notes saved before this was introduced, and notes saved from app versions that do not show this choice, are not shown this way until you turn it on.

A question sent to you this way reaches only you. Habibi Stay never contacts the person you noted. The question carries the asker's name, the city, any dates and any message they add. You can say you will help, which records only that you are helping outside the app and shares nothing, or you can say no. When a question arrives you get one push notification, provided you have notifications turned on. It says only that someone asked you a question about a stay, not who asked or where. It is not sent if the question has been withdrawn, if you have turned the choice off or deleted the note, if you are no longer connected, or if either of you has blocked the other. Every question also waits for you in the app. We check again every time: turning the choice off, deleting the note, removing the connection or blocking stops anyone new from seeing or asking, and blocking also hides earlier questions between the two of you. Deleting a note removes the name, phone number, relationship and note you saved. A finished question keeps its message for no more than 90 days.

Invitations

Saving someone privately and inviting them are separate choices.

Habibi Stay never sends a message to invite anyone. No SMS and no email, to member and non-member alike. For someone who is not a member we could not even if we wanted to: we do not keep their phone number, only a keyed fingerprint of it, which cannot be turned back into a number to message. Somebody who is already a member can get one push notification, described below, and that is the only message Habibi Stay itself ever sends about an invitation. When you invite someone who is not a member, your iPhone opens your own messaging apps and you send the message yourself, from your own thread. We record only that you say you reached out, and only after your phone reports that you sent something. We cannot tell whether it arrived, and nothing in the app claims that it did.

If that person later joins with the same phone number, they are shown that you invited them, and they choose whether to accept. If they are already a member, we send them one push notification, provided they have notifications turned on; if they do not, the request simply waits for them in the app, as it always did. Either way they see only your name, your initials and when you asked. Accepting connects you both. Declining ends it and tells you nothing beyond the invitation no longer being open.

That notification says only that somebody asked to connect. It does not say who: no name, no initials, not even how many people have asked. Opening it takes them to their circle in the app, which is where they find out, and only then. We check again at the moment of sending, so nothing is sent if the request has been withdrawn or has lapsed, if either of you has blocked the other, if the person who asked has been suspended, or if that number has asked us to remove it. Asking the same person again does not send a second one.

The link you send carries a signed reference to the invitation itself, never to the person you send it to, so opening it tells us nothing about them and creates no account. Whoever opens it is shown your first name, which is how the page can say who is expecting them, and nothing more: not your surname, not your city, not who else you know, and never the note you wrote. It is a label rather than a key. A forwarded link gets its holder no further than that name, because joining still means verifying the phone number you invited. The name stops appearing once the invitation is accepted, declined or lapsed, or if you delete your account, and a number that has asked us to remove it is never named by a link at all.

Someone who saved you privately and never reached out is never shown to you. Joining Habibi Stay does not tell you who has been holding your number in their address book. We also do not show your own private note about a person to that person.

An invitation that is never answered lapses after 30 days. Nobody is notified when that happens. A phone number that has asked us to remove it cannot be invited or matched at all.

How information is used

We use this information to verify access, provide DIRECT and VOUCHED stay journeys, enforce privacy and blocking, operate Contacts discovery, deliver necessary transactional updates, respond to support and safety reports, prevent abuse, measure overall use of the service in aggregate, and delete accounts. We do not sell personal information, use it for targeted advertising or permit cross-app tracking.

If you enable notifications, lock-screen copy is limited to a generic request-attention message, a request-updated message, a message saying that someone asked to connect with you, or a message saying that someone asked you a question about a stay. It does not include names, messages, city, dates, addresses, phone numbers, hidden Host details, safety reports or blocking details. A notification is never proof of authorization; the app rechecks your current account, access and request role before navigating. Notifications are optional and Request Center remains authoritative.

Habibi Stay does not use automated processing alone to make a decision about you that has a legal or similarly significant effect, and it does not profile you to predict your behavior. Suspending an account or acting on a safety report is done by an authorized person, and the action is audited.

Why we handle this information

  • To provide the service you asked for. Verifying your phone, running DIRECT and VOUCHED stay journeys, serving an exact Host address to a confirmed Guest, and sending necessary transactional updates. Without these we cannot operate Habibi Stay at all.
  • Because you chose it. Contacts discovery, notifications, an emergency contact and hosting details are each optional. We handle them only if you turn them on or provide them, and you can withdraw any of them.
  • To keep people safe and the service working. Blocking, reporting, moderation, abuse and quota controls, security and audit records, and the block-enforcement history described below.
  • To understand use in aggregate. We keep a coarse record of when your account was last active, no finer than the hour, so we can see how many members use and return to Habibi Stay overall. It measures the service, not you: it is never used to profile you, never shown to other members, and never shared.
  • Because the law requires it. Responding to a valid legal request, or keeping a record we are required to keep.

If you are somewhere whose law names these grounds, they correspond to contract, consent, legitimate interests and legal obligation.

Sharing and service providers

Information is shared with another Habibi Stay participant only when the current journey and role require it. We rely on Firebase and Google Cloud for authentication, database, hosting, logging and delivery infrastructure. The website also uses Buttondown for the updates list and Web3Forms for contact-form delivery. Apple processes two things on our behalf: Apple Maps serves the map tiles your device requests when you open Search, and the Apple Push Notification service delivers notifications to your device using a device token; neither carries your circle, your contacts, or your requests.

Email you send us passes through four more. Cloudflare receives every message addressed to a habibistay.app address and routes it. Mail to our general and privacy addresses is delivered into Google Workspace. Mail to our safety address is forwarded to a dedicated mailbox held with Proton, and Resend sends the automatic acknowledgement back to you. Between them they handle your email address, your name if you give one, and whatever you choose to write, including the contents of a safety report.

These providers process information on our behalf under their own service terms and retention controls.

Where information is processed

Habibi Stay is operated from the United States by a Virginia company. The application server and the database that hold your account both run in Google Cloud's us-east1 region in the United States, and Firebase, Google Cloud, Google Workspace, Buttondown, Web3Forms, Cloudflare, Resend and Apple are United States companies. Proton is Swiss, so mail to our safety address is stored in Switzerland. Signing up is open worldwide. If you use Habibi Stay from the United Kingdom, the European Economic Area or anywhere else outside the United States, the information described in this policy is transferred to the United States and handled there, except for mail to our safety address, which is stored in Switzerland.

We rely on the data processing terms that Firebase, Google Cloud, Google Workspace, Buttondown, Web3Forms, Cloudflare, Resend, Proton and Apple publish for their own services. We have not put separate transfer arrangements in place beyond those terms. We would rather write that plainly than imply a protection we have not arranged.

Security

Connections between the app, this website and Habibi Stay are encrypted in transit. Production access is limited to authorized people, safety cases are restricted, and actions taken on them are audited. Sensitive identifiers such as non-member phone numbers are kept only as server-keyed fingerprints rather than as numbers we could read or message.

No service can promise that a breach is impossible. If one happens and affects your information, we will tell you what we know at the time rather than waiting until the picture is complete.

Retention

  • Primary account information is deleted or anonymized within 30 days after an authenticated deletion request. Access is isolated immediately.
  • Ordinary notes on terminal requests are kept for no more than 90 days.
  • Confirmed-stay address and phone details are removed immediately after cancellation and no later than 30 days after completion.
  • Minimized completed-stay history is kept for no more than 24 months.
  • Closed safety reports, moderation actions and reporter-side suppressions are kept for no more than 24 months from closure or last relevant activity. Account-deletion tombstones are kept for no more than 24 months.
  • Contacts-discovery abuse and quota records have a global maximum of 35 days.
  • An invitation that is never answered lapses 30 days after you send it.
  • Invalid notification tokens and terminal notification routing/delivery records have a global maximum of 35 days. Active notification tokens are removed on sign-out, permission or access revocation, suspension or account deletion, and no later than 90 days without a device refresh.
  • Ordinary application and request logs target a 30-day maximum where the provider permits configuration. Database backups target a 35-day maximum. Provider-controlled security and delivery logs may follow the provider's documented schedule.

We do not automatically delete an account merely because it is inactive.

Blocking, reporting and safety

Blocking is enforced on the server. It removes current reachability, retires relationships and VOUCHED paths, closes active requests, cancels future stays and stops newly serving current profile, address and contact information. Unblocking does not restore a relationship or request. A completed stay may remain as minimized history without becoming a route to current information.

Participants can report received request, Connector or Host-note content. Reported content is immediately suppressed for the reporter, and authorized staff can suppress content, suspend an account and revoke sessions. Safety cases are restricted and actions are audited.

Habibi Stay also keeps the minimum block-enforcement history needed to prevent automatic relationship resurrection and investigate authorized safety incidents. It records only internal account identifiers, the times a block was placed or lifted and how many times it happened. It holds no name, no message and no content of any kind, it is not an active relationship, and it is not ordinarily user-visible. Because a block must stay enforceable even after one of the people involved leaves, this history is kept for as long as Habibi Stay operates and is not removed by account deletion.

Account deletion

The app provides whole-account deletion in Settings. It requires recent phone reauthentication and explicit confirmation. The account becomes unavailable immediately; provider deletion is retried if necessary and primary completion occurs within 30 days. Restored database backups must be reconciled against a separate deletion tombstone ledger before traffic can resume. Read the account deletion details.

Website information

If you sign up for updates, we receive your email address, city, optional name and the answers you choose to provide. If you use the contact form, we receive your name, email, selected topic and message. We do not use analytics, advertising tags or tracking pixels on this site. Hosting providers record standard security logs, which can include an IP address.

Updates-list and website-contact records are processed by the named providers and retained only as needed to operate the list or respond to the message, subject to those providers' controls. An unsubscribe stops future email from the list; it is not presented as proof that every provider backup was immediately erased. You may request deletion through the privacy choices page, and we will apply the controls actually available to us.

Your choices

You may ask to access or correct information, use in-app blocking and reporting, decline Contacts access, request removal of eligible non-user contact representations after verifying the phone number, or delete your account in the app. See Privacy choices and Non-user phone removal.

For privacy questions, write to privacy@habibistay.app. For a safety concern, write to safety@habibistay.app.

If you are outside the United States

Some places, including the United Kingdom, the European Economic Area and California, give people rights over their information, such as access, correction, deletion, portability and objection. Habibi Stay is a small company in an early release. We would rather tell you what we can actually do than publish a list of rights we are not yet staffed to answer on a fixed timetable.

What works today does not depend on us reading an email. The app gives you access to and correction of your own profile, deletion of your whole account, and blocking and reporting, and each takes effect immediately. For anything the app does not cover, write to privacy@habibistay.app and a person will read it and do what we are able to do. We do not promise a fixed response time, and we have not appointed a representative in the European Union or the United Kingdom.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we will not treat you differently because you exercised a choice. If you are not satisfied with how we handled a request, you may be able to complain to the data protection authority where you live.

Age

Habibi Stay is for adults. You must be 18 or older to create an account. The app is not directed at children, and we do not knowingly let anyone under 18 create an account. If we learn that an account belongs to someone under 18, we will delete it. Habibi Stay arranges for people to stay in each other's homes, so this is a safety line as much as a privacy one.

Changes

If this policy changes materially, we will update the effective date and provide an appropriate notice rather than relying on a silent edit.

Contact

privacy@habibistay.app Mangla & Co LLC