The short version. You can read your whole estate page without an account, without a login, and without giving us anything. We only ask for personal data at four moments — claiming a quest prize, offering something to the pantry, posting to lost & found, and listing a business — and we delete it once it has done its job.
Who is responsible
Heartlanders is built and run by Augustine Jeow, trading as Kampong Labs, in Singapore. Under the Personal Data Protection Act he is the organisation responsible for personal data collected through this service, and he is its Data Protection Officer.
Questions, requests for a copy of your data, corrections and deletion requests all go to connect@kamponglabs.com. We aim to reply within 30 days, as the Act requires. If you are not satisfied with the response, you may raise it with the Personal Data Protection Commission at pdpc.gov.sg.
Resident Network Content Managers post events, notices and estate matters, and moderate what residents post. They can see what is on their own estate's page and the contact details attached to a pantry offer or a lost & found post on it. They cannot see data from other estates.
What we collect, and why
Nothing at all
WhenReading events, notices, weather, buses, hawker closures
WhyNo account is needed to read
How long we keep it—
Your email address
WhenYou finish a Kampong Quest and want the prize code
WhyTo email you the code, and to let the counter check it was issued
How long we keep it90 days after the code is redeemed or expires, then replaced with a placeholder
Your email address, item photos
WhenYou offer an item to Neighbours' Pantry
WhyTo tell you if the item was accepted, and to show the item on the shelf
How long we keep itEmail: 90 days after the item leaves the shelf. Photos: deleted with the item
Your contact method and value (e.g. a WhatsApp number), optional email, photo
WhenYou post to Lost & found
WhyYour contact detail is shown publicly on the board so a neighbour can reach you — that is the point of the post
How long we keep itContact details are erased 30 days after the post closes; posts expire after 14 days
Email address, password, business details, photos
WhenYou list a business on Marketplace
WhyTo run your listing and let you sign back in
How long we keep itUntil you ask us to close the listing
Name, email, organisation, message
WhenYou use an enquiry or "list your event" form
WhyTo reply to you
How long we keep it24 months
The postal code or block you typed
WhenOnly when we cannot match it to an estate
WhySo the Resident Network can add the missing block
How long we keep it90 days
A page-view count
WhenEvery page
WhyTo tell a Resident Network how many people opened their page
How long we keep it12 months, and it is a count — no identifier is stored against it
A browser push subscription
WhenYou turn on notifications
WhyTo send the alert. It identifies a browser, not a person
How long we keep itUntil you turn notifications off, or your browser invalidates it
A random key your own browser made up
WhenYou press “I’m going” on an event
WhySo the headcount counts you once. It is not an account and identifies no one
How long we keep itDeleted 30 days after the event
Your name and a phone number or email
WhenYou offer to help at an event
WhySo the organiser can reach you — they are the only people who see it
How long we keep itDeleted 30 days after the event
A category and a block number
WhenYou report something broken and we hand you to OneService
WhySo your Resident Network can see what keeps being reported. We never store your description, a photo, or your contact detail
How long we keep it12 months
The wording we drafted for your report
WhenOnly if you asked us to write it up properly
WhySo the Resident Network sees what was actually reported. Your own rough words are never stored
How long we keep it12 months
The question you typed into “Ask about your estate”
WhenOnly when the page could not answer it
WhySo the Resident Network learns what the page is missing. A question we answered leaves a count and no text
How long we keep itThe text goes at 90 days; the count at 12 months
An IP address
WhenPosting to Lost & found, signing up a business, reporting a fault, or asking a question
WhyRate limiting, so one person cannot flood a board or run up our costs
How long we keep it24 hours
What we never do
- We do not sell personal data, and we do not share it with advertisers.
- We do not run advertising or third-party tracking pixels on resident pages.
- We do not ask for NRIC, and you should not put one in a lost & found post either.
- We do not build a profile of you across estates.
Cookies and what stays on your device
We use no advertising or analytics cookies. Three small preferences are stored so the page behaves the way you left it:
- Your estate — so the app opens at your own page instead of asking again. “Not your estate?” on the home page clears it.
- Your language — English, 中文, Melayu or தமிழ்.
- Your text size — stored in your browser only, never sent to us.
Admins and business owners also get a sign-in cookie, which is what keeps them signed in.
Photos
A photo you upload to the pantry, to lost & found or to a business listing is stored in a public bucket, which means anyone with the link can open it. Do not photograph documents, a home interior you would not show a stranger, or anyone else's face without asking them.
Pantry photos are checked automatically by Anthropic's Claude to read the expiry date and catch items that should not be on a shelf. The photo is sent to Anthropic for that check and is not used to train a model. If the check is not confident, a human volunteer reviews it instead.
Where your data is, and who processes it
Personal data is stored in Singapore. The services we use to run Heartlanders:
Supabase
What it doesDatabase, sign-in and file storage — everything personal lives here
WhereSingapore (ap-southeast-1)
Vercel
What it doesRuns the website itself
WhereServed from the region nearest you
Anthropic (Claude)
What it doesReads pantry item photos for expiry dates and unsafe items
WhereNot used for model training
Resend
What it doesSends quest prize emails and outcome notices
WhereEmail address and message only
data.gov.sg (NEA), LTA DataMall, OneMap
What it doesAir quality, rain, lightning, forecasts, dengue, hawker closures, bus arrivals, geocoding
WhereWe send them a location or a bus stop code — never anything about you
Your rights
Under the PDPA you may ask what personal data we hold about you, ask us to correct it, and withdraw consent. Email connect@kamponglabs.com and we will respond within 30 days. Some things you can do yourself, immediately:
- Close a lost & found post with the link we emailed you when you posted it.
- Turn notifications off in the notification section of your estate page, or in your browser's site settings.
- Clear your remembered estate with “Not your estate?” on the home page.
Withdrawing consent may mean we can no longer do the thing it was for — we cannot email you a prize code without an email address.
Children
Heartlanders is for everyone in an estate, and a quest is often done by a family together. We do not knowingly collect personal data from a child under 13 without a parent. If a child has given us an email address, write to us and we will remove it.
Security, honestly stated
Data is encrypted in transit and at rest, access is restricted per estate at the database level, and administrator accounts are separate from resident use. No system is perfect. If we ever discover a breach that is likely to cause significant harm, we will notify affected people and the PDPC as the law requires.
Changes
If we change what we collect, we will update the date at the top of this page. Material changes will be announced on estate pages.
This page describes what the software actually does. It is not legal advice, and it has not been reviewed by a lawyer.