Privacy policy

The short version

• You can use the site without an account or giving us any personal data.
• Saved deals and settings are kept in your own browser.
• If you give us your email (account, newsletter, a form), we use it only for that purpose.
• We don't sell your data. Ad and analytics cookies are used only if you accept them.
• You can ask to see, correct or delete your data at any time: email hello@spill.sg.

What we collect

• Saved deals and settings. Deals you save, brands you follow and your settings are stored in your browser (local storage). They stay on your device unless you sign in.
• Account (optional). If you sign in, we keep your email address, an optional name, your saved deals, followed brands and email preferences so they work across devices.
• Newsletter (optional). Your email address, when and where you signed up, and when you confirmed or unsubscribed.
• Notifications (optional). If you allow push notifications, your browser gives us a technical address for sending them (a push subscription), plus the deals and brands you want reminders for. It does not contain your name or email.
• Forms you send. Problem reports, deal tips, picture removal requests, business enquiries and contact messages, with whatever you write in them (for example your name, email, phone or company).
• Spam protection. When you send a form, we store a one-way hash of your IP address (not the address itself) so we can block abuse. We may also use Cloudflare Turnstile to check you're not a robot.
• Anonymous counters. We count deal views, clicks to the brand, saves and code copies per deal. These counts contain no personal data.
• Error reports. If a page breaks, your browser may send us the error message, the page address and your browser type, so we can fix it.
• Location. If you use the map and allow it, your browser uses your location to sort deals by distance. It is used on your device and we don't store it.
• Server logs. Our host keeps standard logs (such as IP address, browser type and pages requested) for security, for a short time.

Why we use it

• To run the site: show deals, keep your saved deals, and sync them if you sign in.
• To send what you asked for: reminders, deal alerts or the newsletter.
• To reply to your messages, fix wrong deals, review tips and handle removal or privacy requests.
• To keep the site safe: prevent spam, abuse and fraud, and fix errors.
• To understand which deals are useful (anonymous counts, and analytics if you accept it).
• To show ads that keep the site free (personalised only if you accept ad cookies).
• To meet legal obligations.

By giving us your data for one of these purposes, you consent to us using it for that purpose. You can withdraw consent at any time (see Your rights).

Cookies and local storage

Essential: we use your browser's local storage to remember saved deals, settings, your sign-in and your cookie choice. These are needed for the site to work and don't track you across other sites.

Ads and analytics (only with your consent): if ads (Google AdSense) or analytics are switched on, we ask first. Until you choose "Accept all", Google tags run in a restricted mode with ad and analytics cookies turned off (Google Consent Mode). If you choose "Essential only", you may still see ads, but they won't be personalised using cookies.

Right now no ad or analytics cookies are in use, so there is nothing to choose. If we switch them on, we will ask you first.

Who we share it with

We don't sell or rent personal data. We use these service providers to run the site:

• Vercel (hosting; servers worldwide, company in the US).
• Supabase (database and sign-in; our data is stored in the Singapore region).
• Resend (sending emails such as reminders, sign-in links and the newsletter; US).
• Google AdSense (ads, if switched on) and Google Analytics or Vercel Web Analytics (visit statistics, if switched on). See how Google uses data from sites that use its services.
• OneMap by the Singapore Land Authority (map tiles on the Nearby map; your browser loads them directly).
• Instagram (Meta) (some deal pictures are shown with Instagram's official embed, which loads from Instagram and is covered by Meta's privacy policy).
• Cloudflare Turnstile (spam check on forms, if switched on).

We may also share data if the law requires it, or to protect the safety of our users or the site. Brands only see anonymous counts, never who you are, unless you contact them yourself.

Data stored outside Singapore

Our main database is in Singapore, but some providers above (such as Vercel, Resend and Google) process data in other countries, mainly the United States. When that happens we rely on the providers' contractual commitments so that your data gets a standard of protection comparable to the PDPA.

How long we keep it

• Saved deals in your browser: until you remove them or clear your browser data.
• Account: until you delete it or ask us to. We delete it within 30 days.
• Newsletter: until you unsubscribe. We then keep only your email on a do-not-send list so we never email you again by mistake.
• Push subscriptions: until you turn notifications off or the subscription stops working.
• Contact messages, reports, tips and requests (with the IP hash): up to 12 months after we've dealt with them.
• Error reports: up to 90 days.
• Anonymous counters: as long as useful, since they contain no personal data.

Your rights

Under the PDPA you can:

• Access the personal data we hold about you and ask how it has been used in the past year.
• Correct data that is wrong or incomplete.
• Withdraw consent, for example unsubscribe from emails, turn off notifications, change your cookie choice, or ask us to delete your account and messages.

Email hello@spill.sg or use the contact form (topic "Privacy request"). We may ask you to confirm it's you. We aim to reply within 30 days. Withdrawing consent may mean we can't provide some features (for example, reminders by email).

Data Protection Officer

Our Data Protection Officer handles all privacy questions and requests. Contact: hello@spill.sg. If you're not satisfied with our reply, you can contact the Personal Data Protection Commission.

Do Not Call

We don't make marketing calls or send marketing SMS or WhatsApp messages to Singapore phone numbers, so the Do Not Call Registry does not apply. Marketing emails (the newsletter) are sent only if you sign up, and every one has an unsubscribe link. If a business gives us a phone number in an enquiry, we use it only to reply to that enquiry.

Security

We use encrypted connections (HTTPS), keep form data in a database that browsers can't read directly, store only a hash of IP addresses, and limit who has access. No system is perfectly secure; if a data breach affects you, we will tell you and the PDPC where the law requires it.

Children

Spill is meant for a general audience and is not aimed at children. If you are under 13, please don't give us personal data (such as signing up or sending a form) without a parent or guardian's consent. Parents can ask us to delete a child's data at hello@spill.sg.

Changes to this policy

We may update this policy as the site changes. We'll change the "Last updated" date above, and for important changes we'll show a notice on the site or email people who have an account or newsletter subscription.