Privacy Policy

This policy explains what information Kaya collects, how it's used, and what stays only on your device.

"Kaya," "we," and "us" refer to the operators of this platform. "You" refers to anyone using it. This policy explains what we collect, who can see it, and what never reaches us. Other terms of use are set out in the Terms of Service.

• Email address, collected when you place an order or leave a review, used for passwordless sign-in.
• A browsing session with no personal details, created the first time you message a shop, set a home town, or enable notifications.
• Order records — items, amounts, any note, collection time, and status history.
• Messages sent to makers, and any reviews you leave.
• A mobile number, only if you choose to verify one for the verified-buyer badge.
• A notification subscription, only if you enable notifications; this can be revoked at any time.

We do not collect your name, home address, or date of birth.

• Listing content you publish — business name, offerings, prices, hours, town, and building block/street. This is public.
• Unit number, kept private except as described above.
• Payment details (typically a mobile number) used to generate a payment QR code. This is shown only to a buyer with an active order or held booking, and becomes inaccessible once that order or booking ends.
• A WhatsApp number, if provided. Visible only to you and administrators.
• Uploaded photographs, and certificate details for any trust badge you claim. Certificate numbers are stored separately and never made public; only certification status and expiry are shown.

Saved shops, cart contents, dismissed prompts, and any location you set to sort by distance are stored in your browser only. They are never sent to us, are not tied to an account, and do not transfer between devices. Clearing your browser data removes them.

If you use location-based sorting, your device shares coordinates with the page, which stores them locally. They are discarded after twelve hours, and you may clear them at any time. If you type an address instead, that text is sent to us to be geocoded via a third-party mapping service; we do not retain the address or the resulting coordinates.

• Makers see orders placed with them and their conversations. By default a buyer is shown as a reference code and a partially masked email address (for example, jane.tan@gmail.com appears as jan…@gmail.com). The full address is never transmitted.
• Buyers may set a display name on their account, shown to makers in place of the masked email. It is optional and can be changed or removed at any time.
• Reviews are public but unattributed — rating, text, and date only.
• Administrators can access listings, orders, reviews, and accounts for moderation purposes, but cannot act within an order or conversation they are not party to.

These access controls are enforced at the database level.

We use a limited number of service providers, none for advertising:

• Supabase — database, authentication, and file storage.
• Cloudflare — hosting, and processing of menu content a maker chooses to import (text, links, photos, or PDFs). Uploaded files are processed and discarded, not retained.
• OneMap and OpenStreetMap — geocoding a listing's address and rendering map tiles.
• Push notification services (Apple, Google, or Mozilla, depending on device) — only if notifications are enabled.
• Google — only if you choose to sign in with a Google account.

We do not use analytics, advertising, or tracking, and we do not sell or rent personal data.

We use a single cookie to maintain your sign-in session. We do not use advertising, analytics, or profiling cookies.

Orders and reviews are retained as a record for both parties and are not deleted individually. A shop with any order history cannot be deleted, though a maker may close it at any time.

Anonymous browsing sessions are retained until deleted, even if inactive.

Makers may delete a shop with no order history from their dashboard at any time. For other deletion requests, contact us and we will remove the relevant profile, listing, and messages, excluding records covered above.

Under Singapore's Personal Data Protection Act, you may request access to, correction of, or withdrawal of consent for the personal data we hold. Contact us via Contact us.

If you are under 13, a parent or guardian must consent to our collection of your personal data before you use Kaya. If you are between 13 and 17, you may consent yourself, provided the purpose of collection is one you can reasonably understand.

Creating a maker account and listing a business requires you to be at least 18 — consistent with the minimum age to register a home-based business in Singapore.

We may update this policy from time to time. Material changes will be announced on the platform. The date below reflects the last revision.

Questions about this policy, or requests regarding your data, can be directed to Contact us. Other terms of use are set out in the Terms of Service.