Your ballot story belongs to you.

What we collect and why

Signing in uses your email and authentication information through Supabase. If you choose Google sign-in, Google also supplies account identity information to Supabase, including provider metadata that may contain your full name and profile image. Supabase Auth retains this provider metadata; it is not published wholesale as your app profile. New app profiles do not copy provider names or avatars. Existing private profiles may retain previously copied given names and unused avatar URLs. You choose your own nickname and username before sharing.

We keep the ballot attempts you enter, including launch, flat type, outcome and dates, to show your history and streak. Entering history is optional. Public launch information and comparisons can be read without an account. We also keep your saved projects. We may keep the last affirmation shown to avoid repeating it.

If you use optional history, it can include an earlier application count (or “not sure”) with an explicit cutoff month. This count is kept separate from recorded applications and failure streaks. Missing outcomes and “didn’t apply” are separate choices. These are private self-reports, not a verified household dataset; we publish no participant aggregates. You can remove the baseline in history.

If you use optional partner invites, they contain a random token, not profile details, and never link accounts or applications. Only if a visitor accepts measurement do we keep an anonymous visit receipt in an essential-to-that-choice browser cookie for up to seven days. A new account created after that visit may be attributed once. The inviter sees counts, not visitor identities. Use the invite privacy page (/invite/privacy) or settings to withdraw attribution, even when new invites are disabled; deletion removes its related records. Invites expire after 30 days and records are removed by daily cleanup, so records can remain until the next successful cleanup. Invite conversion covers consenting visits only.

For successful ballots, we keep whether you dismissed the celebration and mortgage prompt. Referrals are disabled for launch. If enabled after a separate review, following an affiliate link would record the partner, linked attempt and click time to understand use of the feature. These records are included in account export and deleted with your account.

The public competition comparison limits repeated requests using a keyed hash derived from the request IP address. The limiter stores the hash, minute and request count, not the raw IP or your account identity. Old minute records are removed on the next valid request; they are not removed by a fixed retention timer.

Do not enter your NRIC, salary, last name, home address or date of birth. These are not needed by BTOMG. Use a nickname if you would rather keep your first name private.

Essential sign-in cookies keep your session working. Optional usage analytics can help us understand which features work. Analytics consent is stored in your browser and is separate from your profile visibility. Use Analytics preferences at the bottom of any page to accept or turn off future capture. Turning it off does not delete previously sent events.

Who can see your data

Your profile starts private. If you turn on public sharing, your username and self-reported streak become public. Your nickname stays hidden unless you explicitly include it through the separate nickname-sharing control, when available. Changing your nickname or turning sharing off resets that choice. Dates and private attempt details are not published. Older copies may contain previously shared names or dates. Anyone with the link may save or forward a copy. Making your profile private cannot recall copies already shared.

Supabase provides account authentication and the database. Vercel hosts the website and routes. Where configured, Sentry receives technical error types and source-file positions; request details, personal context and arbitrary error messages are stripped, and performance tracing is disabled. Resend sends sign-in emails. Optional PostHog analytics requires your consent. This build does not load Vercel Analytics. The app does not sell your personal data or use display advertising.

When configured, public HDB data collection runs on an operator-managed Mac mini. Fly.io was an earlier hosting plan and is not used by the current hackathon scraper. Scraper vision services process public HDB screenshots, not your ballot history. Telegram broadcast reminders are optional; joining or leaving the public channel is your choice and subject to Telegram’s own policy. BTOMG does not store Telegram subscriber identities.

Service providers may process information outside Singapore. Before public launch, the operator must verify locations, contracts and safeguards for comparable protection under the PDPA. This draft does not assert that this review has happened.

How long it stays

Account records stay while you use the account. Removing an attempt hides it from your history but retains the record until account deletion; your export includes it. Deleting your account permanently removes the authentication account and its linked live database records.

Copies you download or share remain under the control of their recipients. Provider backups and operational logs may persist according to the provider’s configured retention. Exact retention periods and any necessary legal exceptions must be published before public launch. We will not retain personal data once it no longer serves its purpose and no legal or business reason requires it.

Access, correction and leaving

In settings, you can correct your profile, change public visibility, download your account data and permanently delete your account. You can correct your ballot history in the dashboard. Deletion signs you out.

You may request access to your personal data and information about its use or disclosure, correct errors, or withdraw consent, subject to applicable PDPA exceptions. A dedicated private contact route for these requests is pending publication before public launch. Do not send personal records through public GitHub issues.

For an independent explanation of these rights, see the Personal Data Protection Commission’s guidance for individuals.