Privacy Policy – FreeCouchSurf

FreeCouchSurf is a free hospitality network that helps travellers find a couch and lets hosts open their homes. This page explains, in plain English, what data we collect, what we do with it, and what rights you have. We don't sell your data and we don't run advertising in the product.

1. Who runs this service

FreeCouchSurf is operated as an independent project. For any privacy question, write to jc@jaycuba.com. That address is also the data-controller contact.

2. Information we collect

Account & profile

When you sign up, we store your username, email and a one-way hash of your password (we never see the plaintext). On your profile you can optionally add: real name, age, gender, city, country, languages, occupation, education, interests, "about me" text, hosting status, accommodation type, house rules, social handles (Instagram, Telegram, website), profile photo, cover photo and additional gallery photos.

Location

If you choose to drop a pin (the "Pin me here" button) or grant the "use my location" permission, we store your latitude/longitude in your profile so other travellers can find you on the map. You can blur, change or remove your location at any time from Edit profile. The map page only ever shows hosts who have explicitly opted in by saving a location and setting hosting status to "yes" or "maybe". Travellers' coordinates are jittered ±4 km on the map so the marker shows an area, not an address.

Communications & activity

We store: the messages you send and receive, stay requests you create or respond to, reviews you write or receive, follows, BFF connections, RSVPs to events you make or organise, status posts you publish to the local feed, profile visits, and notifications generated as a result. These records are retained until you or the other party delete them, or until the account is removed.

Technical & security data

For each account we keep timestamps for created-at and last-active, plus session/auth tokens used to keep you logged in. Web-server logs may retain your IP address temporarily for abuse prevention and debugging.

3. Cookies & local storage

Session cookie (cs_token): keeps you logged in on the website for up to ~10 years unless you log out.
Mobile auth token (fcs_app_token, in localStorage): keeps you logged in inside the FreeCouchSurf mobile app. We use a token in storage instead of a cookie because mobile WebViews handle cookies unreliably.
Referral cookie (fcs_ref): if you arrive via a friend's invite link (?ref=…) we set a 30-day cookie so we can credit your friend on the leaderboard if you sign up.
Banner dismissal (tg_banner_dismissed, fcs_invite_dismissed): remembers that you closed a banner so we don't show it again.
We do not use advertising cookies, cross-site tracking pixels, or analytics that profile you across other websites.

4. How we use your data

To run the core hospitality features: showing hosts on the map, surfacing nearby travellers, routing messages and stay requests, displaying reviews and ratings, and powering the activity feed.
To send you transactional email — for example, when someone messages you, requests a stay, accepts/declines a request, or follows you. You can unsubscribe from non-essential mails by adjusting your settings or replying with "unsubscribe".
To compute the Top Inviters leaderboard — only invitees with a fully-completed profile (photo + about-me + city) are counted, and only public usernames and counts are shown.
To moderate and protect the community (spam, abuse, fraud, safety reports).

5. Sharing with third parties

We share the minimum necessary data with these service providers, and only to deliver the service:

OpenStreetMap (tile rendering) and Nominatim (reverse geocoding for "Pin me here" and status posts). When you load the map or pin yourself, your browser fetches map tiles from tile.openstreetmap.org and a one-shot reverse-geocode request from nominatim.openstreetmap.org.
LocationIQ (forward geocoding for the search box, when configured).
Appilix (push-notification SDK for the iOS/Android wrapper). Your username is passed to Appilix as a "push identity" so notifications can target your device. You can dismiss/disable notifications in your OS settings.
Email delivery (mail sent from jc@jaycuba.com). Standard SMTP envelope information (your email address) is processed by the outbound mail server.
jQuery, Bootstrap, Font Awesome and Leaflet are loaded from public CDNs. Loading these resources exposes your IP address to the CDN. We don't share any other data with them.

We never sell your personal data. We never share your data with advertisers.

6. Public vs private

The following are visible to anyone who can see the site (or any signed-in member, where relevant): your username, profile photo, cover photo, about-me, city/country, age, gender, languages, occupation, interests, hosting status, photos you upload to your gallery, status posts you publish, reviews you receive, your follower/following lists, and your aggregated stats. Your email address, password hash, and direct messages are not public. Stay-request details are visible only to you and the host involved.

7. Your rights

Wherever you live, you have the right to:

Access the data we hold about you. Most of it is visible right inside your profile and settings; for a complete export, email jc@jaycuba.com.
Correct any inaccurate data using Edit profile.
Delete your account — deletion is immediate and removes your profile, photos, status posts, messages, follow relationships, BFF connections, RSVPs, reviews you wrote and reviews about you, and notifications. Quoted text inside other members' messages may persist briefly — we'll purge it on request.
Object to specific processing or withdraw consent (e.g. by removing your location, dropping hosting status to "no", or unsubscribing from non-essential email).
Lodge a complaint with your local data-protection authority.

8. Children

FreeCouchSurf is not directed at children under 16. If you become aware that a child has shared personal data with us, please contact jc@jaycuba.com and we will delete the account.

9. Security

Passwords are stored as one-way bcrypt hashes; we never see them. Sensitive site traffic is served over HTTPS. We hash auth tokens server-side. No system is perfect — please use a unique, strong password, don't reuse credentials, and report any suspected compromise.

10. International transfers

FreeCouchSurf is a small project; servers and email infrastructure may be located outside your country. By using the service you consent to the transfer of your information to those locations.

11. Changes to this policy

If we make material changes we'll update the date at the top and, where appropriate, notify members in-product or by email. Continued use of the service after a change means you accept the updated policy.

12. Contact

Privacy questions, data-export requests, or anything else: jc@jaycuba.com.

By signing up, you confirm that you've read and understood this policy.