Legal · PDPA

Privacy Policy

Last updated: 27 July 2026

This Privacy Policy explains how Farah ("I", "me") collects, uses, discloses, and protects personal data when you visit storydrift.pro ("StoryDrift", "the site") or contact me through it. I operate this site as a personal blog from Singapore and handle data in accordance with the Personal Data Protection Act 2012 ("PDPA") of Singapore, as amended.

1. Who is responsible for your data

The data controller for StoryDrift is Farah, writing under my first name as the author of this personal blog. You can reach me at [email protected] or by post at Blk 3 Cantonment Close, #04-15, Singapore 080003. This is not a company, agency, magazine, or registered business — it is one individual's website.

2. What personal data I collect

Contact form data: When you use the Say hello form, I collect your name, email address, and message text. You must tick the PDPA consent checkbox before sending; it is not pre-checked. I do not collect payment details, NRIC numbers, or other sensitive identifiers through this site.

Consent records: Whether you agreed to PDPA processing on the contact form, and your cookie preferences stored in your browser's local storage under the key storydrift_cookie_consent.

Cookies and similar technologies: Essential cookies remember your banner choice for six months. If you accept analytics cookies, anonymised usage statistics may be collected. You can accept all, reject all, or customise via the cookie banner on every page.

Server and access logs: My hosting provider may automatically log technical data such as IP address, browser type, referring URL, and access time. I access these logs only for security or troubleshooting and do not build profiles of individual readers from them.

3. Purposes of collection and use

I use personal data for the following purposes:

• Responding to messages: to read and reply to enquiries you send via the contact form. Legal basis: your consent (PDPA consent obligation) and my legitimate interest in correspondence.
• Operating the site: to deliver pages, maintain security, and fix errors.
• Cookie preferences: to honour the choice you make in the banner for six months.
• Analytics (optional): to understand general traffic patterns if you consent to analytics cookies — aggregated counts, not individual tracking for advertising.
• Legal compliance: when required by Singapore law or valid legal process.

I do not use your data for direct marketing unless you explicitly ask to receive updates. I do not sell, rent, or trade personal data to third parties.

4. How the contact form works

The contact form submits data via POST to /send.php. That script validates your input, checks a hidden honeypot field for bots, verifies that you ticked the PDPA consent box, and sends an email to my inbox with the subject prefix "[StoryDrift] ". Messages are stored in my email account for as long as needed to respond and keep a reasonable record of correspondence.

5. Legal basis and consent

Under the PDPA, I rely on your consent when you submit the contact form and when you choose cookie settings in the banner. You may withdraw consent at any time by emailing [email protected]; withdrawal does not affect processing that occurred before withdrawal, and I will stop the relevant processing unless retention is legally required.

6. Disclosure to third parties

Personal data may be processed by:

• My email and hosting providers, solely to deliver messages and serve site files
• Analytics providers, only if you consent to analytics cookies
• Authorities, if required by Singapore law or valid legal process

These parties are expected to protect data in line with applicable law. I do not transfer personal data outside Singapore unless necessary for hosting or email delivery; where that occurs, I expect appropriate safeguards consistent with PDPA cross-border transfer requirements.

7. Retention

Contact form messages: typically up to twelve months after the conversation ends, unless a longer period is required. Cookie consent choices: six months in local storage. Server logs: according to my host's policy, generally under ninety days. I review stored messages periodically and delete what is no longer needed.

8. Your rights under the PDPA

Subject to exceptions in the PDPA, you may:

• Request access to personal data I hold about you
• Request correction of inaccurate data
• Withdraw consent for processing that relies on consent
• Ask how your data has been used or disclosed

To make a request, email [email protected] with enough detail for me to identify your message. I will respond within a reasonable period as required by law. If you are not satisfied with my response, you may contact the Personal Data Protection Commission of Singapore.

9. Security

I take reasonable administrative and technical measures to protect personal data, including HTTPS, POST-only form handling, honeypot spam filtering, and minimal data collection. No method of transmission over the internet is completely secure; I cannot guarantee absolute security but I aim to handle data responsibly for a small personal website.

10. Children's privacy

StoryDrift is written for a general audience and is not directed at children under thirteen. I do not knowingly collect personal data from children. If you believe a child has submitted data through the contact form, contact me and I will delete it promptly.

11. Links to other sites

Posts may mention external places or link to third-party websites. Those sites operate under their own privacy policies. I do not control their data practices and am not responsible for them.

12. Changes to this policy

I may update this Privacy Policy from time to time. The "Last updated" date at the top will change when revisions are posted. Material changes will be noted on this page. Continued use of the site after changes constitutes acknowledgment of the updated policy.