Privacy policy

apt. is a rental listings website operating in Sri Lanka. For questions about this policy or your information, write to hello@aptlk.online.

Only what the site needs to work. In practice that is:

• Your account — email address and password. Passwords are handled by our authentication provider and we never see or store them ourselves.
• Your contact details, if you list a property — the phone number you enter for WhatsApp and calls, and a display name.
• Your listings — everything you type in, the map pin you place, the address you display, and the photographs you upload.
• Enquiries — when you ask to contact a lister, we record which listing and when, and identify you to that lister so they can respond.
• Saved homes — the listings you favourite.
• Agency verification, if you are an agency and choose to submit it — your business registration type and number, the registered entity name, an optional tax registration number, and any document you upload as evidence. All of it is optional; without it your account works normally and simply carries no verification mark.
• Basic usage data — aggregate page views and performance timings, through Vercel Analytics. This does not use cookies and does not build a profile of you across sites.

We do not collect payment details, because nothing on apt. is paid for. We do not ask for your National Identity Card number, and you should not send it to us — a business registration document is about a business, and we do not need identity documents about a person.

• To show your listing to people searching, including its position on the map.
• To let a person who is interested reach you, and to email you that they were.
• To keep your saved homes and your own listings attached to your account.
• To understand which pages are used, in aggregate, so we can improve them.
• To send a one-time code by SMS, confirming the number you gave is yours and reachable.
• To check that an agency is a registered business before showing a verification mark.
• To detect and remove fraudulent or abusive listings.

A published listing is public. Its title, description, photographs, rent, terms, area and map pin can be seen by anyone, including search engines.

Your phone number is not public. It is shown only after somebody signs in and asks to contact you, which is deliberate — it keeps your number away from scrapers and means every enquiry is attributable. When someone does enquire, we tell you, and we share their email address with you so you can reply.

Your email address is never shown on a listing page.

Verification details are never published. Registration numbers, tax registration numbers and any document you upload are read by us to decide whether to show a verification mark, and by nobody else. What appears publicly is the mark itself — never the numbers behind it. Documents are kept in private storage, separate from listing photographs.

We use a small number of services, each doing one job:

• Supabase — database, sign-in and photo storage.
• Vercel — hosting and aggregate analytics.
• Resend — sending transactional email, such as confirming your address or telling you about an enquiry.
• Notify.lk — delivering the one-time code to your phone. They receive your number and the message; nothing else.
• OpenFreeMap and OpenStreetMap — map tiles and the transit, shop and school data behind walk times. Your browser requests map tiles directly from OpenFreeMap when you use the map.

These providers host data outside Sri Lanka. We do not sell your information, and we do not share it for advertising.

We use one kind of cookie: the session cookie that keeps you signed in. There are no advertising or tracking cookies, and so there is no consent banner to dismiss.

Listings stay until you remove them or they expire. Account information stays until you ask us to delete it. Enquiry records are kept so listers can see who contacted them.

One-time codes are short-lived and are discarded once used or expired. Verification documents are kept while the verification stands, so we can show why a mark was given, and deleted when an account is closed.

Sri Lanka’s Personal Data Protection Act gives you rights over information about you. You can ask us to:

• Show you what we hold about you.
• Correct anything that is wrong.
• Delete your account and the personal information attached to it.
• Stop sending you email.

Write to hello@aptlk.online and we will respond. Deleting your account removes your listings from the site.

apt. is not intended for anyone under 18, and we do not knowingly collect information from children.

If this policy changes we will update the date at the top. Material changes affecting how we use your information will be notified by email.

See also our terms of service.