Privacy Policy

This Privacy Policy applies to personal data we process when you visit our website, play the house habits game, create or use an account, purchase a licence, or otherwise interact with the Services. FlatMatch is a platform for finding housemates, so much of the information in a profile is intended to be seen by other Members. Please share only what you are comfortable with other Members seeing.

2.1 Information you provide. We collect the information you provide to us, including:

• Account information: your name, email address and password (stored only in hashed form by our authentication provider), and a record of when you accepted our Terms of Service.
• Profile information: age, gender and housemate preferences, occupation, biography, profile photo, city and neighbourhood, whether you have a room or are looking for one, budget, move-in date, lifestyle information (such as cleanliness, daily rhythm, work pattern, MBTI type and interests) and deal breakers (such as no smoking, or a halal or vegetarian kitchen).
• Location: if you choose to share it, an approximate location rounded to about 1 km, used to show distances. We do not store your precise location.
• Listings: room details, rent, availability, features, photos, and the people you list as housemates.
• Activity: requests you send, accept, decline or withdraw, matches, messages and photos sent in chats, read receipts, reviews, housemate confirmations, blocks and reports.
• Communications: messages you send to us, such as support requests and feedback.
• Signup channel: if a tagged link brought you to FlatMatch, the tags in that link (such as the group or campaign it was shared in), recorded with your account when you sign up.
• Waitlist information: if you joined our waitlist before the open beta, your name, email address, whether you had a room or were looking for one, any answer you gave, and the link that referred you.

2.2 House habits game. When you play the house habits game, we collect how much each scene bothers you, whether you indicated that you sometimes do it yourself (a “guilty” answer), and any dealbreakers you select. If you play without an account, your answers are stored only in your browser and are not sent to us unless you choose to save them to an account. Saved answers are used to calculate match scores. Other Members can see the scenes that bother you most and your dealbreakers, and, unless you turn it off on your profile, your housemate type and your average reaction in each category. Your “guilty” answers are never displayed to anyone, but they do influence match scores, so a score may indirectly reflect them. You can change or delete your answers at any time in the game.

2.3 Purchases. When you purchase a licence, PayPal processes your payment. We receive the order and payment identifiers, the amount, currency and status, and the name and email address that PayPal shares with us. If you purchase without an account, we also collect the email address you provide for delivery of your licence key. We do not receive your card or bank details. Licence keys are stored in encrypted and hashed form.

2.4 Information collected automatically. When you use the Services, we and our service providers automatically collect technical information, such as your browser and device type, pages visited and error reports (including the page path, without any link parameters, and browser details), and, if you enable notifications, push notification subscription details. Our hosting and infrastructure providers process IP addresses and similar connection data to deliver and secure the Services. For purchases without an account, we use a one-way, keyed hash of your IP address (not the address itself) to prevent abuse.

2.5 Sensitive personal data. Deal breakers such as “must be halal” or “must be vegetarian” may indicate religious or philosophical beliefs. Providing them is optional. By providing them, you explicitly consent to our processing them to display them on your profile and to match you with other Members. You may remove them at any time in Edit Profile.

We use personal data to:

• create and administer your account and provide the Services, including displaying your profile to other Members, calculating match scores, and enabling requests, matches, messages, listings, reviews and housemate confirmations;
• send service communications, such as account and password emails, licence keys and receipts, notifications you have enabled, and important notices about the Services or our policies;
• maintain the safety and integrity of the Services, including preventing fraud, spam and abuse, enforcing usage limits, reviewing reports, suspending accounts and complying with legal obligations;
• process purchases and maintain accounting records;
• analyse and improve the Services, for example by measuring sign-ups and diagnosing errors;
• respond to your enquiries and complaints, and establish, exercise or defend legal claims.

The account and profile information we request is necessary to provide the Services. If you do not provide it, we may be unable to provide the Services to you. Other information is optional.

By creating an account, joining the open beta, making a purchase, or otherwise using the Services, you consent to the collection, use and disclosure of your personal data as described in this Privacy Policy. You may withdraw your consent at any time as described in Section 9.

We may disclose personal data to the following categories of recipients:

• Other Members: your profile (including name, photo, age, occupation, biography, lifestyle information, interests, area, budget, move-in date, listing, housemates, reviews, your house habits game summary and your match score with them) is visible to signed-in Members who are shown it, such as in Discover. Your location is shown only as a distance. Members you are connected with (a match, a request you sent them, a listing you share or invited them to, or a review) may also be able to access the other details stored with your profile, including your gender preference and your approximate location (about 1 km). Members you are matched with can see when you are online. Messages are visible only to the participants in a conversation.
• Our staff: authorised staff can access account details (including your email address), reports and the conversation copies captured with them, and other information where needed to operate the Services, investigate reports and enforce our Terms. Staff access to accounts is recorded.
• Service providers: companies that process data on our behalf under contract, including providers of hosting, database, authentication, file storage, email delivery and web fonts, our payment provider (PayPal), and the push notification services operated by your browser vendor.
• Legal and safety: courts, regulators, law enforcement or other parties where we believe disclosure is required by law or necessary to protect the safety, rights or property of any person, or to investigate fraud or abuse.
• Business transfers: a buyer or successor in connection with a merger, acquisition or transfer of all or part of FlatMatch.

We do not sell personal data, and we do not display third-party advertising.

Our service providers may store and process personal data on servers located outside Malaysia. The countries concerned may not have data protection laws equivalent to those of Malaysia. By using the Services, you consent to such transfers.

• We retain account data for as long as your account remains active. When you delete your account, your profile, listing, photos, game answers, matches, messages, requests, notifications and notification subscriptions are deleted. Photos that another Member sent you in a chat belong to that Member's account.
• Reports, including the reported Member's name and email address and the copy of a conversation captured when a report is made, may be retained after either account is deleted for as long as reasonably necessary for safety, abuse prevention and legal purposes. Our record of staff actions may likewise keep the name and email address of an account that staff acted on.
• Purchase records are retained for as long as required for accounting, tax and legal purposes. When you delete your account, they are no longer associated with it, and the email addresses and payer details on them are removed. Purchases made without an account are not linked to an account; contact us to have their details removed.
• Feedback you send is kept without your name after you delete your account. Error reports are deleted after 90 days, notifications after 180 days, and waitlist entries 12 months after they were made.
• Backups and logs may retain copies of data for a limited period before being overwritten.

We implement reasonable technical and organisational measures designed to protect personal data, including access controls on our database, encrypted connections and restricted storage. However, no method of transmission or storage is completely secure, and we cannot guarantee the security of personal data.

Subject to applicable law, you have the following rights and choices:

• Access and correction: you can view and update most of your personal data in Edit Profile. You may also request a copy of the personal data we hold about you, or ask us to correct it, by contacting us. We will respond within the time required by the PDPA and may charge a fee where permitted by law.
• Withdrawal of consent and limiting processing: you may remove optional information, disable notifications, block other Members, or ask us to stop processing your personal data for a particular purpose. If you withdraw consent that is necessary for the Services, we may need to close your account.
• Account deletion: you can delete your account at any time from Edit Profile.
• Complaints: please contact us first. You may also lodge a complaint with the Personal Data Protection Commissioner of Malaysia.

We use cookies and browser storage (such as local storage) only to keep you signed in, to remember your settings and game progress, to remember the tagged link that brought you here until you sign up, and to count visits without identifying you. We do not use advertising or cross-site tracking cookies.

The Services are intended only for individuals aged 18 or older. We do not knowingly collect personal data from anyone under 18. If you believe a minor is using the Services, please contact us and we will remove the account.

We may update this Privacy Policy from time to time. When we do, we will post the updated version on this page and update the “Last updated” date above. Your continued use of the Services after an update takes effect constitutes your acceptance of the updated Privacy Policy.

FlatMatch is responsible for the personal data described in this Privacy Policy. If you have any questions, requests or complaints about your personal data, please contact us at support@flatmatch.org.