Privacy policy

1Who we are

HomePlanner ("HomePlanner", "we", "us") operates homeplanner.io and rates.homeplanner.io, the HomePlanner planning tools and the Ultimate HomeBuyers Guide. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

This policy explains what personal information we collect, why, how we hold it and how you can access or correct it. It applies to the websites, the app and the emails we send.

2The guide and the public site

You can read the guide, use the public calculators and see the rates strip without creating an account and without giving us an email address. The public pages set no advertising cookies, and no analytics cookies unless you accept them (see the next section). We keep server logs (IP address, browser, pages requested) for security and to keep the site running, and we delete them on a rolling basis.

If you arrive from a campaign link we record the campaign tags and the referring site so we can see which of our efforts bring people to the site. That is attached to your account only if you later sign up.

The borrowing power calculator works in your browser: what you type into it is not sent to us. If you choose to save your figures, they travel in the link to sign-up, in the part of a web address that browsers do not send to servers, and are kept in your browser until you create your account. They are then stored with your account like any other figures you enter, and deleted from your browser. Figures you never use are not imported after 30 days.

3Cookies and analytics

On homeplanner.io we count page views with Ahrefs Web Analytics, which sets no cookies and stores nothing in your browser. It receives the page you viewed, the referring page and basic browser details, and nothing that identifies you.

We also keep our own count of what happens on the public pages, in our own database: the pages viewed, the calculators used, the questions opened and the links into the app followed. Income goes into it only as a broad band, never the figures you enter. This sets no cookie. It keeps a random identifier in your browser's local storage so visits from the same browser can be counted together, and that identifier is not attached to your account.

We would also like to use two analytics services that do set cookies: PostHog, a product analytics service hosted in the European Union, and Google Analytics 4, Google's web analytics service. Neither loads unless you choose Accept on the cookie banner: until you choose, and for good if you decline, no PostHog or Google Analytics script is fetched and neither sets a cookie. Apart from the identifier above, the only thing stored is your choice itself, in your browser, so we don't ask on every page.

If you accept, PostHog sets a cookie holding a random identifier. It is set for homeplanner.io and its subdomains, so the same identifier is recognised on app.homeplanner.io and rates.homeplanner.io, which lets us see whether a visit to the guide led to a sign-up. PostHog records the pages you view, the links and buttons you click, errors the site runs into, and may record how a page was used (a session recording), with anything you type into a form masked in your browser before it is sent. If you use the calculator's email form we record only that it was sent, never the address or your figures. None of this is used for advertising or shared with advertisers.

If you accept, Google Analytics also sets cookies holding a random identifier, and we send it the same short labels as our own count above: which page, which calculator, which question, which link into the app. With each one Google receives the page address, the referring site and basic browser and device details. It never receives your name, email address, account or the figures you enter. When you follow a link into the app, the identifier travels with you so the visit and the sign-up can be joined up. Google may handle this data outside Australia. We use it only to measure how the site is used, not for advertising.

In the app, once you are signed in, we use PostHog to understand how the tools are used and to find errors. Those events are linked to your account (your user ID, email address and name). Session recordings in the app mask every piece of text and everything typed, so your figures are never recorded.

The app at app.homeplanner.io also sends Google Analytics 4 the same short event labels it records for itself, for example that a page was viewed or a task completed, so we can follow the journey from the guide through to the app in one place. Only the event name and those labels go to Google: never your user ID, email address, name, address or any amount. Google Analytics sets its own cookies holding a random identifier. This happens only on app.homeplanner.io itself, never in preview or test copies of the app.

You can change your mind at any time with Cookie settings, at the foot of every page of homeplanner.io. Declining stops PostHog and Google Analytics collecting on the public site from that moment. To remove cookies they have already set, clear this site's data in your browser.

4What we collect when you create an account

• Your name and email address, and a password we store only as a hash.
• What you tell us about your situation: which stage you are at, your income, expenses, savings and debts, the properties you are looking at and the tasks you complete. This is the whole point of the app and you can leave any field empty.
• If you choose to connect a bank account, transaction data supplied through our open banking provider, Basiq, under the Consumer Data Right. You decide which accounts, you can disconnect at any time, and we never see your banking login.
• Documents you upload, such as payslips or contracts, so that they are in one place for you.
• Messages you send us and the partners you contact through the marketplace.
• Feedback you send with the feedback button in the app, together with your account's user ID and email address so we know who sent it and can reply. The button only appears once you are signed in.

5Why we collect it

• To run the planning tools: borrowing power, budgets, eligibility for government schemes, and the purchase journey.
• To show you where you stand and what to do next.
• To introduce you to a marketplace partner, when and only when you ask us to.
• To send the emails you have asked for, such as the weekly rates digest, and important notices about your account. Every marketing email has an unsubscribe link.
• If you ask the borrowing power calculator to email you an analysis, we use your address and figures to send that one email and nothing else. We don't add you to a list or keep your figures; we keep a scrambled form of the address (a keyed hash) for two days, only to stop the form being misused.
• If you switch on rate alerts, we keep a copy of the figures a lender would assess (incomes, household, spending, card limits, loan repayments and HECS) with your alert, refresh it when you visit the Borrowing power page, and use it only to work out what a rate change does to your borrowing power. Switching alerts off stops the emails; deleting your account deletes the copy.
• To understand how the tools are used, in aggregate, so we can improve them.

6What we do not do

• We do not sell personal information, to anyone, ever.
• We do not pass your details to a partner unless you ask for an introduction.
• We do not use your financial information to advertise to you.
• Our calculators are estimates for planning. We do not give personal financial or credit advice and nothing on the site should be read as such.

7Who we share it with

The providers that run our infrastructure and services, under contract, for the purposes above: our database and authentication host (Supabase), our open banking provider (Basiq), our email service, our analytics (PostHog, Google Analytics and Ahrefs), and our feedback tool (DevLoop). Some of these providers store data outside Australia. Where they do, we take reasonable steps to make sure it is handled in line with the Australian Privacy Principles.

We will disclose information where the law requires it.

8How we protect it

Data is encrypted in transit and at rest. Access inside HomePlanner is limited to the people who need it to do their job. Passwords are hashed and never stored in clear text. If we become aware of a data breach likely to cause serious harm we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

9Your choices

• Access and correction: you can see and change most of what we hold about you from your profile. For anything else, email us.
• Deletion: you can delete your account from your profile, or email welcome@homeplanner.io and ask us to. We remove your personal information within 30 days, except where we must keep it by law.
• Facebook and Instagram: we use Meta's platform only to publish to our own Facebook Page and Instagram account, and we don't collect personal data from Facebook or Instagram users. If you have connected HomePlanner to your Facebook account, you can remove it at any time in Facebook under Settings, Apps and websites, or email welcome@homeplanner.io and we will delete anything we hold.
• Bank connections: disconnect at any time from the finances page. We stop receiving data immediately.
• Emails: unsubscribe from any marketing email using the link in it. We still send notices you need about your account.

10Complaints and contact

Write to welcome@homeplanner.io. We aim to respond within 14 days. If you are not satisfied with our response you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

We update this policy when what we do changes. The date at the top is the date of the current version.