Privacy notice

Who is responsible for your data

The data controller for storytrace.life is Hana, writing as StoryTrace. I am an individual blogger, not a company. You can reach me at [email protected], by post at Blk 312 Choa Chu Kang Avenue 4, #03-56, Singapore 680312, or by phone at +65 6228 4386.

I do not sell personal data. I do not run mailing lists, accounts, or paid memberships on this site. The only routine way you share information with me is through the contact form, and optionally through analytics cookies if you consent to them.

What personal data I collect

When you browse the site — If you accept analytics cookies (see below), I may receive aggregated or pseudonymous usage data such as pages viewed, approximate region, device type, and referral source. I do not intentionally collect sensitive personal data through the blog itself.

When you use the contact form — I collect the name, email address and message text you submit, plus a timestamp and confirmation that you gave PDPA consent. I do not ask for your NRIC, payment details, or other identifiers unless you choose to include them in your message — please avoid sending sensitive information by email if you can.

Server logs — Like most websites, the hosting provider may automatically log technical data (IP address, browser type, request time) for security and troubleshooting. I do not use those logs to build profiles of readers.

Why I use your data

• Contact messages — to read and reply to you, and to keep a reasonable record of correspondence if you follow up later.
• Essential cookies / local storage — to remember your cookie preference for up to six months so the banner does not reappear every visit.
• Analytics cookies (optional) — to understand which posts are read and whether the site layout works on different devices, so I can improve the blog over time.
• Legal and security — to respond to lawful requests, protect the site from abuse, and maintain basic records where required.

Legal basis under PDPA

Under the PDPA, organisations and individuals who handle personal data in Singapore must have a recognised basis for collection, use and disclosure. For this site:

• Contact form data is collected with your consent, which you give by ticking the checkbox on Say hello before sending. You may withdraw consent at any time by emailing me; withdrawal does not affect messages already processed lawfully.
• Essential cookie preferences are processed on the basis of legitimate interests — running a simple, readable website with a remembered choice — balanced against your right to reject non-essential tracking.
• Analytics, if enabled, relies on your consent via the cookie banner or customise panel.

Cookies and similar technologies

Cookies are small text files stored on your device. This site also uses browser local storage for cookie consent (key: storytrace_cookie_consent), stored for six months unless you clear it sooner.

Essential — Required for the cookie banner to remember Accept, Reject or Customise. These are always active because the site cannot honour your choice without storing it.

Analytics (optional) — Only loaded if you choose Accept all or enable analytics in Customise. If you Reject all, non-essential analytics tags should not run. You can change your mind anytime by clearing site data in your browser and revisiting the banner.

Most browsers let you block or delete cookies in settings. Blocking essential storage may mean the consent banner appears on every visit.

Contact form handling

Messages are sent from the form on /contact.php to my inbox via /send.php. That handler checks a hidden honeypot field (named “website”) — if it is filled, the submission is discarded silently to reduce spam. It also requires the consent_pdpa checkbox to be ticked; submissions without consent are rejected and you are returned to the form with a notice.

Each successful submission includes your name, email, message, Singapore timestamp, and a note that consent was given. I read messages personally. I do not auto-reply with marketing content or add you to any newsletter.

How long I keep data

• Contact emails — kept only as long as needed to reply and for a reasonable follow-up period (typically up to two years unless the conversation is ongoing or a longer period is justified, for example a factual correction you asked me to keep on record).
• Cookie consent choice — up to six months in local storage, then the banner asks again.
• Analytics — retention depends on the analytics provider’s settings; I aim to use the shortest practical retention offered.

When data is no longer needed, I delete or anonymise it where I control the storage.

Who receives your data

I do not sell or rent personal data. Limited sharing may occur with:

• Hosting and email providers — who process data on my behalf to deliver the site and route contact messages.
• Analytics providers — only if you consent to analytics cookies.
• Authorities — if required by applicable law or to protect rights and safety.

Some providers may store data outside Singapore. Where that happens, I expect appropriate safeguards consistent with PDPA requirements.

Your rights

Under the PDPA you may, subject to exceptions in the Act:

• Ask whether I hold personal data about you and what it is used for.
• Request correction of inaccurate data.
• Withdraw consent for contact or analytics processing.
• Request access to data you provided, where reasonable.

Email [email protected] with the subject “PDPA request”. I will respond within a reasonable time. If you remain unsatisfied, you may contact the Personal Data Protection Commission (PDPC) in Singapore.

Security

This is a small personal site, but I take reasonable steps to protect data — HTTPS in production, a simple spam honeypot, consent checks before storing messages, and limited access to my inbox. No method of transmission over the internet is completely secure; please do not send passwords or highly sensitive documents through the contact form.

Children

The blog is written for a general audience and is not directed at children under 13. If you are a parent or guardian and believe a child has sent personal data through the contact form, contact me and I will delete it promptly.

Changes to this notice

I may update this page when the site changes — for example, if I add a new tool or adjust cookie categories. The “Last updated” date at the top will change when I do. Material changes will be reflected here in plain language; continued use of the site after an update means you have read the revised notice.

Links to other sites

Posts may mention external places or link out for context. Those sites have their own privacy policies. I am not responsible for how they handle data.