Privacy Policy
This policy is written to reflect what Helping Hands’s codebase actually collects and stores today, aligned with Singapore’s Personal Data Protection Act (PDPA). It is a real working draft, not filler text — but it is not a substitute for review by a qualified lawyer before the platform launches publicly.
What we collect
When you create an account: your email address and password (the password is stored only as a hash, by our sign-in provider), your display name, and (if you choose to add one) a profile picture. If you use the support inbox or save items, those messages and bookmarks are kept with your account. When you post a listing: the listing content itself (title, description, location, contact details you choose to share — WhatsApp number, email, or a link), and, if you post on behalf of an organisation, that organisation’s name and UEN. If you apply for an NGO or student-group check, the supporting documents you upload are stored in a private file store that only you and our moderators can access. When you post a listing, we also briefly log the IP address the request came from, purely to prevent spam (see Retention below) — we do not otherwise track your device or location.
How we use it
To show your listings and profile to other users of the platform, to check NGO/student-group status where you’ve applied for it, to let moderators review reported content, and to prevent abuse (spam posting, false claims of being a registered organisation or student group). We do not sell personal data, and we do not use it for advertising.
Who we share it with
Your display name, listing content, and (if checked) your organisation’s name are visible to anyone browsing the site — that visibility is the point of a public noticeboard. Contact details you add to a listing are shown to anyone who opens it, so use a group number or a school or organisation email rather than a personal one. Documents you upload for a check are visible only to you and to moderators/admins reviewing your application, never to the public.
These companies process data for us, under their own data processing terms, and are not independent recipients of it:
| Company | What for | What it receives | Where |
|---|---|---|---|
| Supabase | Database, file storage, sign-in | Everything you save on the site | [confirm the project region] |
| Vercel | Hosting; page-view and speed statistics | Pages you open, your IP address, browser type | [confirm the function region] |
| Anthropic | AI advisor; AI support writing a listing | What you type into those tools | [confirm] |
| Groq | Quick check (part of the AI advisor) and scheme summaries | Your Quick check answers and any note you add | [confirm] |
| Tavily | Searching official government pages | The words you search for | [confirm] |
Please don’t type your NRIC number, health details or other people’s names into the AI tools or the search box. Helping Hands doesn’t keep a copy of what you type into them, but the companies above handle it under their own policies.
Data retention & deletion
Listings are set to expire automatically 5 months after posting, or on the day after a sign-up-by date if the poster set an earlier one. Posters can renew a listing from My portal to keep it up, and can archive or delete it manually at any time. Deleting a listing marks it as removed in our systems rather than instantly erasing the database row — this lets us investigate abuse reports and keep an audit trail of moderator decisions, and is standard practice for platforms with public-posting moderation. IP addresses logged for spam prevention are kept only briefly (on the order of hours) and are not linked to your account. Documents you upload for a check are retained for as long as your checked status is active, and can be deleted on request.
Deleting your account. In your portal, under Profile, “Delete my account…” removes your account and the personal data on it: your listings are archived with the contact details and name taken off them, the files you uploaded (check documents, profile picture) are deleted, and your profile, organisations, saved items and messages are erased. Moderation records (who approved or removed what) are kept, without a link back to you. If you can’t sign in, contact the Data Protection Officer below.
Operational logs are short-lived: spam-prevention records are deleted after about two hours, the one-visit-per-day marks after three days, and the scrambled (hashed) IP address on a report after 90 days.
Children and young people
Accounts are for people aged 13 and over. If you are under 18, please ask a parent, guardian or teacher before you post. Never put another child’s name, photo, school or home address in a listing. If you think a child’s details have been posted, use “Report this listing” on the listing and we will look at it first.
Your rights
Under the PDPA, you can ask what personal data we hold about you, ask us to correct it, withdraw consent for us to use it, and (per the retention section above) request deletion. To exercise any of these, contact our Data Protection Officer at helpinghandsinsg@gmail.com.
Security
Access to personal data is restricted by row-level security rules in our database — ordinary users can only read/edit their own account and listings, and only approved moderators/admins can access moderation tools. Documents uploaded for a check sit in a private file store, not publicly accessible by URL guessing.
Changes to this policy
If this policy changes in a way that affects how your data is used, we’ll post an update here with a new effective date rather than changing it silently.
Effective date: [insert date before launch]. Last reviewed: 2026-10-05 (drafted; pending legal review, including the age limit above and the data-location column).