iCalledIt Privacy Policy
Draft. The operator's details are still being filled in, so this is not yet the final text.
Last updated: [TBD]
Data controller: [TBD], UEN [TBD], [TBD], Singapore
Data Protection Officer: [TBD], [TBD]
This policy explains what personal data we collect, why, and your rights, in line with Singapore's Personal Data Protection Act 2012 (PDPA). It forms part of our Terms of Service.
1. What we collect
| Data | When | Why |
|---|---|---|
| Session token (random, in a cookie) | Guest use | Hold your forecasts and streak on this device |
| Topics you pick (in a cookie, and on your account once you have one) | If you pick them | Put those topics first on your board |
| Phone number (hashed for lookup; encrypted at rest) | WhatsApp/SMS sign-in or ranked verification | Sign you in; one person, one ranked account |
| Telegram user id, Google account id, or LINE/Zalo/Facebook id | Sign-in with that provider | Sign you in; deliver notifications you opt into |
| Email address | Email sign-in, recovery, or company/school verification | Sign-in, account recovery, digests you opt into |
| Work or school email domain and a salted hash of the address (raw address deleted after verification) | Company/school board verification | Board membership; we never store the raw work address |
| Handle, country, forecasts, points, rating, streak, league and board memberships, and any league whose creator removed you | Using the Service | Run the game, leaderboards, share cards |
| Comments, proposed questions, reports | If you post them | Community features, moderation |
| Technical data: IP address, browser, device type, approximate location from IP, timestamps, referral source | Automatically | Security, abuse prevention, analytics, country defaults |
| Messages you send our WhatsApp or Telegram bot | If you use them | Sign-in and notifications |
We do not collect real names, payment details, government IDs, or precise location. We do not knowingly collect data from children under 13; if we learn we have, we delete it.
2. How we use it
- Operate the Service: record forecasts, settle questions, compute ratings and boards, generate share cards.
- Sign-in, security, and abuse prevention: rate limits, duplicate-account and manipulation detection.
- Communications you opt into: Telegram/WhatsApp notifications, email digests. Each has an off switch.
- Analytics to improve the Service (aggregated).
- Aggregated or anonymised forecast data for recaps, reports, research, and commercial products. This data cannot identify you.
- Legal compliance and responding to lawful requests.
We rely on your consent (given by using the Service and by opting into communications), on performance of our Terms, and on the PDPA's deemed-consent and legitimate-interests provisions for security and improvement purposes.
3. Who we share it with
- Service providers who process data for us: hosting (Singapore region) for our server and database, and Cloudflare, which carries every request to the Service. They act on our instructions under contract. We will add others here before we use them.
- Sign-in and messaging platforms (Google, Meta/WhatsApp, Telegram, LINE, Zalo, Facebook) receive the data needed to authenticate you or deliver messages, under their own policies.
- Other users see your handle, country, rating, streak, forecasts on questions, comments, and board/league positions. Company and school boards show handles only.
- Sponsors and partners receive aggregated statistics only, never your personal data.
- Authorities where required by law, or to protect our rights, users, or the public.
- A successor if we merge, are acquired, or sell assets; this policy continues to apply.
We do not sell personal data.
4. International transfers
Data is hosted in Singapore. Some providers (for example Google, Meta, Telegram, email and analytics vendors) may process data outside Singapore. We transfer only under contracts requiring protection comparable to the PDPA.
5. Retention
- Guest data: 90 days after last activity, then deleted.
- Account data: while your account is active, then deleted or anonymised within 30 days of deletion. A deleted account can remain in our backups until they expire: 7 days for the nightly copies on our server.
- Forecasts and ledger entries: retained in anonymised form indefinitely for game integrity and aggregate statistics.
- Phone hashes for duplicate-account prevention: up to 12 months after deletion.
- Security and access logs: 12 months.
- Legal holds: as required.
6. Your rights
Under the PDPA you may:
- Access the personal data we hold about you and how it has been used or disclosed in the past year.
- Correct inaccurate data.
- Withdraw consent and stop any communications (every message has an opt-out; bots accept
/stop). - Delete your account, self-serve on the You page (You → Delete your account), effective immediately.
- Export your forecasts and profile data, self-serve on the You page (You → Download your data).
Contact the DPO at [TBD]. We respond within 30 days. If you are unsatisfied, you may complain to the Personal Data Protection Commission of Singapore (pdpc.gov.sg).
7. Cookies and similar
We use two first-party cookies. One is strictly necessary and keeps your guest account on this device. The other remembers the topics you picked for your board, or that you skipped picking; it holds topic names only, nothing that identifies you. We do not use analytics or advertising cookies, or third-party tracking pixels. Browser controls that block cookies may break sign-in, and without the second one the board asks for your topics again.
8. Security
Encryption in transit, a database reachable only from our own server, keyed hashes instead of raw IP addresses, hashed phone numbers, no raw work emails, admin access only over SSH to that server, an append-only ledger, and no personal data in logs. No system is perfectly secure; if a breach affecting you is likely to cause significant harm, we will notify you and the PDPC as the PDPA requires.
9. Children
The Service is for users 13 and older. Users under 18 should use it with parental consent. We do not target children and do not knowingly collect their data.
10. Changes
We will post changes here with a new date and notify you of material changes through the Service. Continued use is acceptance.
11. Contact
[TBD], [TBD] · DPO: [TBD], [TBD]