Privacy notice
How Note Nest handles information — plainly, for a personal blog with no form and no shop.
Introduction
This privacy notice explains how Note Nest — a personal blog written by me, Aishah — handles information when you visit notevaultnest.life. The site is small, static, and hosted independently. I do not run a business through it, I do not sell anything on it, and I do not operate a contact form that collects messages into a database on this server.
I wrote this notice in plain Singapore English to meet the spirit of the Personal Data Protection Act 2012 (PDPA) as it applies to a personal website. It describes what I know is collected, what I deliberately avoid collecting, and what you can do if you have questions or want to correct something.
The PDPA governs how organisations collect, use, and disclose personal data in Singapore. Although this site is not a company, I treat visitor privacy with the same seriousness I would expect from any site I read myself. Transparency matters even when the data footprint is small.
If anything here is unclear, email [email protected]. For cookie-specific detail, including how map embeds behave when you accept or reject categories, see the Cookies page.
Who is responsible
The data controller for this site is me, Aishah, writing in a personal capacity from Blk 49 Marine Crescent, #08-21, Singapore 440049. There is no company behind Note Nest — no registered business entity, no agency, no editorial board. Correspondence about privacy should go to the email address above.
I do not appoint a Data Protection Officer in a formal corporate sense because this is not a commercial operation. I still take reasonable care with the little data the site touches, and I respond to privacy enquiries myself rather than routing them through a helpdesk queue.
If you are reading from outside Singapore, Singapore law still applies to how I handle data connected to this site because it is operated from here. Your local laws may also give you rights regarding data sent across borders — for example, when you email me or when a Google Maps iframe loads in your browser.
What this site collects
Information you send by email
If you write to [email protected], your email address, the content of your message, and any attachments you choose to include arrive in my personal mailbox. I read these messages to respond where appropriate, to correct factual errors in the blog, or to understand feedback. I do not feed them into a customer-relationship system or share them with advertisers.
Information you do not submit through the site
There is no contact form, no comment box, no newsletter signup, and no account registration. The site does not ask for your name, phone number, or address unless you choose to put those in an email you send me directly. The Kerbside page lists my contact details for you to use offline; it does not pull information from you automatically.
Server and hosting logs
Like most websites, the hosting environment may automatically record technical data when you request a page: your IP address, browser type, referring URL, requested path, and a timestamp. I do not personally browse these logs for profiling. They exist mainly for security, troubleshooting, and understanding aggregate traffic patterns. Retention depends on the hosting provider's default rotation policy, typically a few weeks unless a security incident requires longer retention.
Cookies and local storage
This site stores a single consent preference so the cookie banner does not reappear on every visit. Details — including category names, retention of about six months, and how Google Maps embeds respond to your choice — are documented on cookies.php. Analytics cookies are not used on this site; the analytics toggle exists in the panel for clarity only.
Why information is used
I use the limited information described above for straightforward purposes: keeping the site available and secure, remembering your cookie choices, responding to emails you send, and correcting the blog when someone points out an error. I do not use personal data for automated decision-making, credit scoring, or targeted advertising on this site.
Email correspondence is kept only as long as it remains useful — usually until a thread is resolved, unless you ask me to delete it sooner or unless I need to retain a message to document a factual correction. I do not build mailing lists from people who write once to tell me a bus route number has changed.
Server logs help distinguish a genuine traffic spike from a misconfigured bot hammering the same page. That is operational hygiene, not surveillance. I have no interest in knowing which specific visitor read which clipping on which evening.
Google Maps embeds
Every page on Note Nest includes a neighbourhood-scale Google Maps embed or a placeholder that appears until you allow functional content. When the map loads, your browser requests resources from Google, and Google may receive technical data such as your IP address, browser characteristics, and interaction signals according to Google's own policies. I do not control Google's processing once the iframe loads.
I centre every map on the Marine Parade / Katong / East Coast corridor at a zoom level that shows the neighbourhood, not a street-precise pin on my block. The embed uses Google's standard iframe share URL; I do not use the Maps JavaScript API and I do not hold a Google Maps billing account for this site.
If you reject functional cookies, the site shows a styled placeholder instead of loading the iframe until you choose to allow embedded content. That behaviour is intentional and is described step by step on the Cookies page. You remain in control of whether Google's servers are contacted for map tiles during your visit.
How long data is kept
Cookie consent preferences are stored for about six months (180 days), after which the banner may appear again so you can reconsider your choice. Server logs rotate on a short cycle governed by the host. Email is kept according to the practical needs described above, not on a fixed seven-year corporate schedule.
If you ask me to delete an email thread, I will do so unless I am keeping a minimal record because it documents a correction to published content — in which case I will explain why and keep only what is necessary to show the correction was made in good faith.
Static pages on this site do not expire, but this privacy notice may be updated when practices change. The date at the bottom of the final section tells you when the wording last changed materially.
Your rights under the PDPA
Under Singapore's PDPA, you may have the right to ask what personal data I hold about you, to request correction if it is inaccurate, and to withdraw consent where processing is consent-based. Because this site collects very little directly, many requests will be simple: "I emailed you once — please delete that message."
To make a request, email [email protected] with enough detail for me to locate the information — the approximate date of your message, the address you wrote from, or the page you were viewing if the request concerns logs you believe the host holds. I will respond within a reasonable time. If I cannot fulfil a request, I will explain why rather than leaving you guessing.
You may also lodge a complaint with the Personal Data Protection Commission if you believe I have handled personal data improperly. I hope you will contact me first so I can fix a straightforward issue quickly — most concerns about a site this small can be resolved with a single email exchange.
Withdrawal of consent for cookies takes effect when you change your choice in the cookie panel or clear site data in your browser. Withdrawal does not affect the lawfulness of processing that happened before you withdrew, but it does change what loads on your next visit.
Security
This is a static site with no visitor accounts and no database of form submissions on the server. The main practical risks are email interception (as with any mail), unauthorised access to my mailbox, or third-party processing by Google when maps load. I use sensible mailbox practices and HTTPS-ready hosting. No online transmission is perfectly secure; I do not ask you to send sensitive identity documents through this blog.
If I ever become aware of a breach affecting data I control — for example, unauthorised access to my email — I will take reasonable steps to contain it and notify affected individuals where appropriate under PDPA notification requirements.
Children
Note Nest is written for a general adult readership. I do not knowingly collect personal data from children through the site. If a parent or guardian believes a child has emailed me, contact me and I will delete the correspondence promptly.
Changes to this notice
I may update this notice if the site changes — for example, if I add a new embed or change hosting. The latest version will always live at this URL. Last updated: 11 August 2026.