Privacy

Who operates this

The Guild is not yet incorporated. Until it is, this site is operated by its founder, Leonard Chow, in Singapore. Contact: dinggege125@gmail.com. When the company is registered, this page will name it and its UEN.

What we collect when you sign in

Google or Apple tells us three things: a permanent subject identifier, your email address, and the display name on your account. That is all we ask for and all we receive — the scopes requested are openid email profile and nothing else. We never receive your password.

If you sign in with Apple and choose Hide My Email, we store the relay address Apple gives us. We have no way to see your real one, and we do not try.

A session cookie (guild_session) keeps you signed in for 30 days. It holds a random token, is HttpOnly and Secure, and only a hash of it is stored on our side. Two short-lived cookies exist for ten minutes during sign-in to prevent request forgery. There are no other cookies.

What we collect when you post

Project details

Whatever you type: title, description, block postal code, flat type, style, budget band, dates. You choose each one.

Photographs

The image only. Location metadata is removed from every file before it is stored — EXIF, XMP and embedded text are stripped server-side, so a photo taken on a phone does not publish the flat’s GPS coordinates.

Floor level

Only ever “lower” or “higher”. The site does not offer a field for a unit number, because a postal code plus flat type plus an exact storey identifies one household.

Proof of ownership

If you claim a flat as its owner, the document you upload is reviewed and then the file is purged. The decision — verified or rejected, by whom, on what date — is kept. The document is not.

Invoices

Reviewed to confirm a job was real. You choose whether the amount is shown publicly; hidden still counts as verified.

What we collect when you write, and what we never collect

Reading this site records nothing about you. No IP address, no device identifier, no visitor-level row of any kind — looking up your own block, browsing the register, reading this page. Page views and click-throughs are counted as a date, a subject and a tally, with nothing in them that could be traced to a person. There are no third-party analytics or advertising trackers on any page, and the content security policy blocks them from loading.

Writing does record network context, because that is where the register can actually be defrauded — a designer inventing a homeowner to confirm their own work, one person running several accounts. When you create a project, upload a photo, invite the other party, confirm, or rate, we store: a random device identifier in a cookie; your network provider and its ASN; the planning area Cloudflare reports (for example “Yishun”); and one-way hashes of your IP address and browser string. The address itself is never stored — the hash is salted with a key held on the server, so “are these two accounts on the same network” is answerable and “which address is this” is not. These rows are deleted after 90 days by the same scheduled job that runs the checks they exist for.

If you run the broadband speed test, the result is stored without any account identifier — the server refuses one if it is sent. It keeps the speed, the broadband provider you declare, the planning area Cloudflare reports for the request (for example “Yishun”), and the postal code you chose to type. Not your address, not your identity.

What we cannot delete, and why

Two records are permanent by construction, and you should know this before you post.

Moderation snapshots capture a work exactly as it stood at each decision. The audit log records every moderator action. Both are append-only: the database physically refuses UPDATE and DELETE on them, and that refusal applies to us as much as to anyone. It is what lets the Guild show it treated a competitor’s work the same way it treated its own.

So: your account, your projects and your photographs can be removed on request. The record that a decision was made, and by whom, stays. Published work counts and the reasons for any rejection are part of that record.

Where it is held, and who else sees it

The site runs on Cloudflare (Workers, D1, R2). Cloudflare processes requests and stores the database and uploaded files on our behalf, and may route traffic through servers outside Singapore. We do not sell data, and we do not share it with any other company. Nothing is shared with designers, firms or advertisers beyond what is already published on the page.

Your rights

Under Singapore’s Personal Data Protection Act you may ask what we hold about you, ask us to correct it, and withdraw your consent. Email dinggege125@gmail.com and we will respond within 30 days. Withdrawing consent means your account is closed and your posts are removed from public view, subject to the permanent records described in section 05.