Privacy notice

Accounts.Email address, a scrypt hash of your password (never the password), and the date the account was created. A session row stores a SHA-256 hash of an opaque token and its expiry. Saved views store a name and the map’s query string.

Contributions.Category, name, note, coordinates, and an optional email if you ask for a reply. The submission’s IP address is stored for abuse triage. The licence grant is recorded with the row.

Feedback. Kind, title, detail, optional email, the page it came from, and the IP address, for the same abuse reason.

Product analytics. An allowlisted event name, a small JSON payload (a layer id, a view id, a mode — never search text), the path, and a random per-tab id kept in sessionStorage. There is no IP column on this table and no link to an account.

Operational records. Request logs (path, status, duration, time), rate counters keyed by a hashof the caller’s address rather than the address itself, job runs for the extraction schedule, and an audit trail of operator actions.

Two, both httpOnly and sameSite-scoped, and neither is used for advertising or analytics:

• sgd_user — the account session, 30 days.
• sgd_admin — the operator console session, 8 hours.

Analytics uses sessionStorage, which dies with the tab. No third-party analytics, tag manager, advertising or session-replay service is loaded.

No profiling, no data sold or rented, no tracking pixels, and no third-party analytics. Map tiles and camera frames are fetched by the server and proxied, so your browser does not call the agencies directly.

• Rate-limit windows: 1 day (pruned by the maintenance job).
• Request logs: 30 days.
• Extraction job ledger: 180 days.
• Product events: 90 days, deleted by the maintenance job.
• Accounts, sessions and saved views: until you delete the account. Deletion is self-service on /account — it removes the account, its sessions and its saved views, and clears your email from any contribution or feedback you left. Contributions themselves stay on the map as public data.
• Contributions and feedback: retained for moderation history; the IP address is cleared after 90 days, and the optional email is removed on request.

You may ask for access to the personal data held about you, ask for a correction, and withdraw consent. Withdrawing consent for an account means deleting it, which is self-service on /account; the map still works signed out. You may also complain to the Personal Data Protection Commission of Singapore.

Data protection contact: no address is configured for this deployment yet — set NEXT_PUBLIC_CONTACT_EMAIL before launch.

The service is not directed at children under 13, and there is no parental-consent mechanism. Hosting has not been provisioned for this deployment; when it is, the storage region will be stated here. If data is stored outside Singapore, transfers will rely on the PDPA’s requirements for comparable protection.