Privacy · Singapore · PDPA

Privacy notice

Last updated: 5 August 2026

I wrote this notice because Word Vault is a small, personal site — and I still owe you clarity about what happens when you visit or write to me.

My name is Ellis. I maintain Word Vault at wordvault.pro as a personal reading-room blog from Telok Blangah, Singapore. I am the data controller for personal data collected through this website. This notice explains what I collect, why I collect it, how long I keep it, and what rights you have under Singapore's Personal Data Protection Act 2012 (PDPA), as administered by the Personal Data Protection Commission (PDPC). If anything here is unclear, you may write to me at [email protected].

1. Scope of this notice

This notice applies to wordvault.pro and its pages — the Reading Room, The Shelf, individual entries, the About page, the letter desk, and this privacy page. It does not cover third-party websites you may reach through links I have quoted or mentioned. Those sites have their own policies, and I encourage you to read them before you share anything there.

Word Vault is not a commercial platform. I do not sell advertising space, charge for access, or run a newsletter list at the time of writing. The personal data I handle is modest in volume and limited in purpose: mainly to operate the site, remember cookie preferences, show a neighbourhood map, and reply when you send a letter.

2. What personal data I collect

Depending on how you use the site, I may collect or receive the following categories of personal data:

• Contact and identity data — your name and email address when you submit the letter form on the Letters page.
• Message content — the subject line you choose and the text of your message, which may include anything you choose to tell me about yourself.
• Technical and usage data — your IP address, browser type, referring page, and timestamps when you submit the letter form or when server logs are generated.
• Cookie preference data — a small cookie that stores whether you accepted, rejected, or customised non-essential cookies on this site.
• Map interaction data — when Google Maps loads in your browser, Google may collect data about your device and approximate location according to Google's own policies. I do not receive that data directly.

I do not ask for your NRIC, passport number, financial details, or precise home address through this website. Please do not send sensitive personal data — such as health records, employment grievances, or third-party private information — through the letter form unless you are comfortable with me reading and storing it for reply purposes.

3. How I collect personal data

I collect personal data in three main ways:

• Directly from you, when you tick the consent checkbox and submit the letter form at /letters.php.
• Automatically, through server logs maintained by my hosting provider when pages are requested or forms are posted.
• Through cookies, when your browser stores the cookie preference value described below.

I do not buy mailing lists, scrape social profiles, or obtain personal data from data brokers for Word Vault.

4. Purposes and legal bases under PDPA

Under the PDPA, organisations — including individuals acting in a personal or domestic capacity where applicable — must collect, use, and disclose personal data for purposes that a reasonable person would consider appropriate, and must obtain consent where required. For Word Vault, my purposes are:

• Responding to your letters — to read, consider, and reply to messages you send through the form. I rely on the consent you give by ticking the PDPA checkbox before submission.
• Operating and securing the site — to detect abusive submissions, enforce a fair rate limit on the letter form, and maintain basic server logs for troubleshooting. This is reasonably necessary for site integrity.
• Remembering cookie choices — to store your banner selection so you are not asked on every visit. Essential cookies do not require consent; optional analytics cookies are off unless you enable them.
• Showing Google Maps — to display an embedded map of my harbour-side corner of Singapore on every page. The map helps orient readers who may never have walked the Telok Blangah ridge. Google acts as a separate data controller for data processed through its embed.

I do not use your letter content for automated profiling, targeted advertising, or resale to third parties.

5. Cookies on wordvault.pro

Cookies are small text files stored on your device. Word Vault uses a minimal set:

• wv_cookie_consent (essential) — stores your cookie banner choice as a JSON value (essential, analytics, maps flags). Duration: six months. Path: site-wide. SameSite: Lax.
• Google Maps cookies (third-party) — may be set when the embedded map iframe loads. I treat map functionality as essential to how this site presents my neighbourhood, but Google's processing is governed by Google's privacy policy.
• Optional analytics — if you accept analytics in the customise panel, I may enable lightweight, privacy-conscious measurement in future updates. At the time of this notice, analytics remains disabled unless you opt in, and no non-essential tracker is loaded on rejection.

You can clear cookies through your browser settings at any time. Clearing the consent cookie will cause the banner to appear again on your next visit.

6. Google Maps on every page

Each page on wordvault.pro includes a slim map band at the foot of the layout, and the Letters page includes a larger map beside the form. Both embed Google Maps via an iframe pointing to Telok Blangah Hill Park and the surrounding area. When the iframe loads, your browser contacts Google's servers. Google may log your IP address, device information, and interaction signals under its own terms.

I chose an embed rather than a static screenshot because the map still feels like the neighbourhood I write from — the curve of the ridge, the harbour light, the MRT line threading south. I do not control Google's retention or international transfers. If you prefer not to load Google Maps, you may use a browser extension that blocks third-party embeds; the rest of the site will remain readable.

7. Letter form data handling

When you submit the letter form, the following happens:

• Your name, email, subject selection, and message are transmitted over HTTPS to my server endpoint at /send.php.
• I validate the fields, check a hidden honeypot field intended to trap automated bots, apply a rate limit of three submissions per five minutes per IP address, and verify that the request appears to originate from this site.
• If validation passes, I send the contents to my private inbox so I can reply. The message includes a Singapore timestamp.
• If validation fails, you see the form again with error messages and your entered values preserved where safe to do so.
• If the honeypot is triggered or the origin check fails quietly, you still see a success acknowledgement on the Letters page — this is deliberate so that abusive senders cannot easily probe my validation rules.

I read letters personally. I do not use an automated ticketing system or outsourced call centre for Word Vault correspondence.

8. Disclosure of personal data

I do not sell or rent your personal data. I may disclose data only in these limited situations:

• Service providers — my hosting provider processes server logs and form submissions on my behalf under confidentiality obligations reasonably expected of hosts.
• Google — when you load Maps embeds, as described above.
• Legal requirements — if Singapore law or a competent authority requires disclosure, I will comply to the extent I am legally obliged, and I will review the request carefully because this is a personal blog with no corporate compliance department behind it.

I do not routinely disclose letter contents to other readers. If you write something you later wish retracted, email me and I will consider deletion where reasonable.

9. International transfers

Word Vault is oriented to Singapore readers and stored on infrastructure that may sit outside Singapore depending on my host's data centre choices. Email delivery may also route through providers with servers abroad. Where personal data leaves Singapore, I take reasonable steps to ensure recipients protect it consistently with PDPA expectations — primarily by choosing reputable providers and limiting what I send.

10. Retention

I keep personal data only as long as needed for the purposes above:

• Letter form submissions — retained in my mailbox until I no longer need them to correspond with you, typically up to twenty-four months unless the thread remains active.
• Server and rate-limit logs — IP timestamps for form rate limiting rotate within minutes to hours; error logs may persist longer for security review.
• Cookie consent — six months, then the banner asks again.

You may ask me to delete correspondence earlier; see Section 12.

11. Security

I take reasonable administrative and technical measures to protect personal data: HTTPS for pages and form posts, server-side validation, honeypot and rate-limiting on the letter endpoint, and error logging with display of technical details disabled on the public site. No method of transmission over the internet is perfectly secure. I cannot guarantee absolute security, but I treat your letters with the same care I would treat a note left on my actual desk.

12. Your rights under the PDPA

The PDPA grants individuals several rights in relation to personal data held by organisations. As the operator of Word Vault, I will honour the following requests where applicable and reasonable:

• Access — you may ask what personal data I hold about you.
• Correction — you may ask me to correct inaccurate data.
• Withdrawal of consent — you may withdraw consent for future processing, though this may mean I cannot reply to further letters without fresh consent.
• Deletion — you may request deletion of correspondence, subject to any legal retention need.

To exercise these rights, email [email protected] with enough detail for me to locate your message. I will respond within a reasonable period, generally within thirty days. If you remain unsatisfied, you may contact the Personal Data Protection Commission (PDPC) in Singapore for guidance on your options under local law.

13. Children

Word Vault is written for a general adult readership. I do not knowingly collect personal data from children under thirteen without appropriate parental consent. If you believe a child has submitted personal data through the letter form, please contact me and I will delete it promptly.

14. Changes to this notice

I may update this notice when the site changes — for example, if I add analytics, change hosting, or revise the letter form. The "Last updated" date at the top will change when I do. Material changes will be described here in plain language. Continued use of the site after an update constitutes acknowledgement of the revised notice, though I will not use previously collected data for new incompatible purposes without consent where required.

15. Contact

For privacy questions, access requests, or corrections, reach me at:

Ellis
Word Vault
Blk 72 Telok Blangah Heights, #14-243
Singapore 100072
Email: [email protected]
Phone: +65 8732 6158

I am grateful you took the time to read this. Privacy notices are rarely as interesting as a good paragraph on the shelf, but they matter — especially on a site that asks you to write back.