Privacy Policy

HostelNama ("HostelNama", "we", "our", or "us") operates the website at https://hostelnama.com. This Privacy Policy explains what data we collect from you, how we use it, and your rights regarding that data.

We collect only the data necessary to operate the Platform. We do not sell your personal data to third parties.

Browsing requires no account. You can search and view every hostel listing without signing up. A free student account is needed only when you contact a hostel host (reveal their WhatsApp or phone number), report a listing, or want your saved favourites to follow you across devices.

Data you provide when you create a student account:

• Name and email address — when you sign up with email, or shared by Google when you use "Continue with Google".
• Password — stored only as a secure hash by our authentication provider (Supabase); we never see or store your actual password.

Data you provide voluntarily:

• Name and WhatsApp number — when you submit a hostel suggestion via the "Suggest a Hostel" form.
• Hostel name, area, and your role — when submitting a hostel suggestion.
• Report details — when you report an issue with a hostel listing (reports are tied to your account).
• Saved favourites — hostels you heart are stored with your account when you are logged in (see Section 6).

Data collected automatically:

• Click events — when you click a hostel card or reveal a host's contact. Card clicks by visitors without an account are anonymous; when you are logged in, clicks are linked to your account to prevent abuse and keep hostel statistics honest.
• Page views and session data — collected by PostHog analytics (see Section 5).
• IP address and browser information — logged by our server for security and abuse prevention.

Data we do NOT collect:

• We do not require account registration to browse or search the Platform.
• We do not collect payment information from students — accounts are free.
• We do not track your location without your explicit browser permission.

We use the data we collect to:

• Create and operate your student account (verify your email at signup, log you in, and let you reset your password).
• Show you host contact details when you request them, and keep your saved favourites in sync across your devices.
• Accept and follow up on listing reports, which are tied to your account for accountability.
• Follow up on hostel suggestions you submit.
• Display popularity metrics (aggregated click counts) on hostel listings.
• Detect and prevent abuse of the Platform (rate limiting, spam prevention, duplicate-click filtering).
• Understand how the Platform is used so we can improve it (analytics).
• Respond to your enquiries sent to our contact email.

We do not use your data for advertising, profiling, or sale to third parties.

We do not sell, rent, or trade your personal data. We may share data only in the following limited circumstances:

• Service providers — Supabase (database and account authentication), Resend (delivery of verification and password-reset emails), and Google (only if you choose "Continue with Google"), each processing data on our behalf under their own privacy policies.
• Legal compliance — if required by law, court order, or government authority in Pakistan.
• Protection of rights — if necessary to protect the safety, rights, or property of HostelNama or its users.

Your email address is never shared with hostel owners or managers — contacting a host happens from your own WhatsApp or phone, on your terms.

We use PostHog, a privacy-friendly analytics platform, to understand how the Platform is used. PostHog is configured with the following privacy settings:

• Anonymous profiles only — we do not create profiles for users who have not identified themselves.
• No autocapture — events are recorded manually; we only track what we explicitly choose to.
• No cross-site tracking.

We also record click events in our own database (hostel card clicks and contact reveals). For visitors without an account these are tied to hostel IDs only, not to any person. When you are logged in, they are linked to your account — this is what lets us stop scripts from inflating a hostel's statistics, and it is never shared with hostel owners in identifiable form.

If you prefer not to be tracked by PostHog, you can block their domain (us.i.posthog.com) using a browser extension such as uBlock Origin.

HostelNama does not use tracking cookies.

We use localStorage (your browser's local storage) to save hostels you mark as favourites. If you are not logged in, this list stays on your device only. When you log in or sign up, your local favourites are merged into your account so they follow you across devices; they also remain on your device after you log out.

If you have a student account, your login session is also kept in localStorage so you stay signed in between visits. Logging out clears it.

We use sessionStorage to deduplicate click events — preventing a single page refresh from being counted as multiple clicks. This data is cleared when you close your browser tab.

PostHog may set its own cookies for session identification. These are governed by PostHog's privacy policy.

• Account data (name, email, saved favourites) — retained for as long as your account exists; deleted when your account is deleted.
• Report data (complaint and reporting account) — retained for as long as necessary to investigate and resolve the report.
• Lead / hostel suggestion data — retained for up to 12 months or until actioned by our team.
• Click events — retained in aggregate for analytics purposes; raw rows may be periodically purged.
• Server logs — retained for up to 30 days for security monitoring.

You may request deletion of your data by contacting us at contact@hostelnama.com.

We take reasonable technical and organisational measures to protect your data, including:

• All data in transit is encrypted via HTTPS/TLS.
• Database access is protected by Row Level Security (RLS) — no unauthenticated direct access.
• Admin access requires two-factor verification (password + allowlist) and short-lived tokens.
• Rate limiting on all write endpoints to prevent abuse.

However, no system is completely secure. We cannot guarantee absolute security of data transmitted over the internet.

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate data.
• Deletion — ask us to delete your personal data, including your student account and everything tied to it, subject to legal obligations.
• Objection — object to processing of your data in certain circumstances.

To exercise any of these rights, email us at contact@hostelnama.com. We will respond within a reasonable timeframe.

The Platform is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected such data, please contact us and we will promptly delete it.

We may update this Privacy Policy from time to time. The effective date at the top of this page will reflect the most recent revision. We encourage you to review this Policy periodically.

Continued use of the Platform after changes are posted constitutes your acceptance of the updated Privacy Policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact us at: contact@hostelnama.com