Privacy Policy

HotPlace ("HotPlace", "we", "us") operates the HotPlace mobile application and the website at hotplace.app from Singapore.

Our Data Protection Officer can be reached at privacy@hotplace.app. The mailbox is monitored during Singapore business hours, and we aim to respond to any privacy request within a reasonable time and in any case as the PDPA requires.

• Account data. Your username, display name, and optionally a short bio and a profile picture. Your password is stored only as a salted hash using a modern memory-hard algorithm (Argon2id) — we never store or see it in plain text. Accounts created with Google sign-in have no password at all.
• Contact data. Your email address (optional), and your phone number if you choose to verify one. Phone verification is optional and exists for exactly one reason: it gates joining a shop's queue. We store the number and the fact that it was verified.
• Google sign-in data. If you sign in with Google, we verify your Google identity token and receive your basic profile: name, email address and profile picture. We use it to create or link your HotPlace account and nothing else.
• Location data. Two distinct uses. First, the map: your device's GPS position is used to centre the map and show what's hot near you — this position is used live and is not stored on our servers. Second, queues: when you join a shop's queue, we check your coordinates against the shop's join radius and record the coordinates of that join on your queue ticket, together with your name and phone number at that moment, so the ticket is a stable record. We never collect location in the background.
• Content you create. Reviews, ratings and review photos; place submissions and suggested edits; the collections you build and their visibility; the places you mark as visited; your recent searches (private to you); and who you follow.
• Reputation data. A points ledger recording each contribution that earned reputation — the review, helpful vote or quest that caused it — plus your tier and the labels you have claimed. Ledger entries are append-only: a reversal is written as its own entry rather than erasing the original.
• Activity within the app. What you tap, search and open is recorded so the map, the feed and the recommendation rails can stop showing you the same things. It is used to rank what you see and is never sold or published.
• Device and service data. Push notification tokens (only if you enable notifications), and standard server logs kept for security and reliability. The app currently includes no third-party analytics or advertising SDKs; if that ever changes, this policy will be updated first.
• App beta requests. If you request HotPlace beta access from the website, we collect your email address. We use it to send your beta invitation and installation instructions.

We collect and use personal data for these purposes:

• Operating the service: the map, reviews, collections, queues, follows, notifications and your profile.
• Computing place hotness from aggregate recent activity. Hotness is calculated per place, not per person — your individual movements are never published or sold.
• Personalising what you see: your feed, the "for you" rails and your picks, using who you follow, what you have saved and what you have already been shown.
• Verifying that reviews and queue joins are genuine (this is what the location check and phone verification are for), and preventing spam, fraud and abuse.
• Running the reputation programme: awarding and reversing points, deriving your tier, and issuing labels.
• Communicating with you about your account and the service. Transactional messages such as beta invitations and installation instructions are sent when you request them.
• Meeting our legal obligations.

We do not sell personal data, and we do not use your data for third-party advertising.

We collect personal data with your consent — given when you create an account, grant a device permission (like location or notifications), or use a feature that plainly requires the data (joining a queue requires checking where you are). We only use data for purposes a reasonable person would consider appropriate in the circumstances.

You can withdraw consent at any time: revoke device permissions in your phone's settings, turn off notifications, opt out of marketing updates via the unsubscribe link in those emails or by writing to privacy@hotplace.app, or write to the same address for any other withdrawal. We will explain the consequences before acting — withdrawing consent for essential processing (for example, location while joining a queue) simply means that feature can't work for you. Withdrawing marketing consent does not stop transactional messages you have requested, such as a beta invitation.

Your public profile shows your username, display name, bio, profile picture, your published reviews (with their photos and ratings), your reputation tier and any labels you have equipped, and your follower and following counts. If you anonymise a review, your byline is hidden from it permanently.

Collections follow the level you set: private (only you), friends-only (people you follow who follow you back), or public. A share link makes a collection reachable by anyone holding it, and an invite lets a collaborator edit it — both are your choice to give.

Your private collections, the places you have marked visited, your search history, your phone number and your email are private. Your precise location is never shown to anyone.

We share personal data only with providers who process it on our behalf to run HotPlace:

• Database and file storage — our managed Postgres database and the storage bucket that holds review photos (currently Supabase).
• Map and place search — when you search for a place, your search terms (and the area being searched) may be sent to Google's Places service to supplement our own results. The request goes through our servers; Google does not receive your HotPlace identity.
• Push notifications — delivery through Expo's push service to your device.
• Sign-in — Google or Apple, if you choose one of those.
• Email delivery — Resend processes email addresses and message content on our behalf to deliver beta invitations, installation instructions and (only if you opt in) marketing updates. Resend acts as our processor under a Data Processing Addendum; HotPlace remains responsible for the personal data.

We may also disclose data where the law requires it or to protect the safety of our users. There are no other recipients.

Our infrastructure is hosted in the Asia-Pacific region, targeting Singapore (AWS ap-southeast-1). Some providers above may process data outside Singapore. Where personal data leaves Singapore, we transfer it only under arrangements — contractual or otherwise — that ensure a standard of protection comparable to the PDPA, as section 26 of the Act requires.

The website sets a single, strictly necessary session cookie to keep you signed in. It is httpOnly (not readable by scripts) and is not used for tracking or advertising. There are no analytics or advertising cookies. Details live in the Cookie Policy.

• Passwords hashed with Argon2id; never stored or logged in plain text.
• Sessions carried in httpOnly cookies, inaccessible to browser scripts; all traffic over HTTPS.
• API keys for third-party services (maps, storage, push) are held server-side only and never shipped in the app or to the browser.
• The reputation ledger is append-only, so a contribution record cannot be silently altered.
• Administrative access is role-gated, and actions taken on your content or your account are recorded with the actor who performed them.

We keep personal data only as long as it serves the purposes above or as the law requires:

• Account data: for the life of your account, then deleted or anonymised within 30 days of account deletion.
• Reviews you retract: removed from public view. Reviews you anonymise stay published with your byline permanently removed.
• Reputation ledger entries: kept for the life of your account and deleted with it. They carry no financial obligation, so nothing is retained on that basis.
• Queue ticket snapshots: kept for the operational life of the queue record.
• Server logs: kept briefly for security and then rotated out.
• App beta requests: kept while needed to deliver your invitation and then deleted or anonymised when no longer required or when you ask us to delete them (subject to any short legal or security retention).

Under the PDPA you may:

• Access — ask what personal data of yours we hold and how it has been used or disclosed in the past year.
• Correction — ask us to correct inaccurate or incomplete data.
• Withdrawal — withdraw consent, as described above.
• Deletion — delete your account and personal data; see Delete your account for exactly how, and what is retained.

Send any request to privacy@hotplace.app. If you are unhappy with our handling of your data or your request, tell us and we will try to put it right; you may also complain to Singapore's Personal Data Protection Commission (PDPC).

We do not collect NRIC numbers or identity documents — not at sign-up, and not anywhere else in HotPlace. There is no step in the product that asks for them. An earlier version of this policy described identity verification before a cash withdrawal; that rewards programme has been discontinued and the verification step removed with it.

If a data breach occurs that is likely to result in significant harm to you, or affects 500 or more people, we will assess it promptly, notify the PDPC as soon as practicable (and in any case within three calendar days of assessing it as notifiable), and notify you directly where the law requires it.

HotPlace is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has created an account, contact us and we will remove it.

We may update this policy as the service evolves — for example, when deferred features such as real SMS verification go live. Material changes will be announced in the app or by email before they take effect. The date at the top shows the last revision.