Privacy Policy

Effective date: [LAUNCH DATE OF HOBIN PLUS]

This Privacy Policy explains how Goh Jin Wei, the operator of Hobin (“Hobin”, “we”, “us” or “our”), collects, uses, discloses, stores and protects your personal data when you use the Hobin mobile application, the website at hobin.app, and related services (together, the “Service”).

We are committed to handling personal data responsibly and in accordance with Singapore’s Personal Data Protection Act 2012 (the “PDPA”). This Policy should be read together with our Terms of Use. By creating an account or using the Service, you acknowledge that you have read and understood this Policy.

Who this Policy applies to
Personal data we collect
How we collect it
How we use your personal data
What other users can see
Location data
Notifications
Messages
Safety, reports and moderation
Photo verification
Who we share personal data with
Transfers outside Singapore
How long we keep personal data
Account deletion
Your choices and rights
Withdrawing consent
Security
Data breaches
Children
Cookies and tracking
Changes to this Policy
Contact us

1. Who this Policy applies to

This Policy applies to everyone who uses the Service, including people who browse without an account. The Service is intended only for people aged 18 and over.

2. Personal data we collect

Category	What it includes
Account data	The email address, name and unique account identifier provided by your sign-in provider (Google or Apple), and the date and version of the Terms of Use and Privacy Policy you agreed to.
Profile data	Your display name, date of birth, gender, country, bio, hobbies and interests, and profile photos. Optional details you choose to add, such as occupation, education, languages, horoscope, hometown, height, weight, drinking and smoking habits, and religion.
Home area	An approximate area you choose (for example, a neighbourhood), used to suggest nearby Sessions and, if you turn them on, to send alerts about Sessions near you.
Session data	Sessions you host, including the activity, title, description, date and time, group size, how people join, and either the exact spot or the approximate area you choose; Sessions you join, ask to join, leave or are removed from; and any note you include with a request to join.
Social and interaction data	Kaki connections and requests, “Good kaki” endorsements, responses to “How was it?” prompts and host ratings, the profiles you open (recorded once per day, see section 5), users you block, chats you mute or delete, and reports you make or that are made about you.
Messages	Messages and photos you send in Session group chats and in direct messages, with the time they were sent and whether they have been read.
Hobin Plus	If you subscribe: your membership level, start and end dates, and, if you choose one, your nickname. Payments are handled by Apple or Google; we never receive your card details.
Verification selfie	If you choose to get verified, a live selfie of you doing a pose we pick, the pose, the date you gave consent, and the outcome of the review (see section 10).
Search data	Place names and addresses you type when setting a Session’s location, which are sent to our mapping providers to return results.
Device and technical data	A push notification token (if you allow notifications), your device type and operating system, app version, and basic technical logs needed to operate, secure and troubleshoot the Service.
Communications with us	Anything you send us, for example when you contact support, request account deletion or make a privacy request.

We do not collect your phone contacts, and we do not intentionally collect sensitive information such as health, financial or identification-document data. The only exception is the optional verification selfie described in section 10, which we collect only with your express consent. Please do not include sensitive information in your profile or messages.

3. How we collect it

Directly from you, when you sign up, complete your profile, host or join Sessions, send messages, make reports or contact us.
From your device, when you allow location, camera, photo or notification permissions. You can change these at any time in your device settings.
From your sign-in provider (Google or Apple), which shares your email address, name and account identifier with us when you sign in.
From other users, for example when someone adds you as a kaki, gives you a “Good kaki” endorsement, or reports you.

4. How we use your personal data

We use your personal data for the following purposes:

Providing the Service: creating and managing your account and profile; showing Sessions on the map; letting you host, join, edit, leave and cancel Sessions; enabling group chats and direct messages; and managing kaki connections.
Personalisation: suggesting activities and Sessions based on your interests and home area.
Notifications: sending the notifications you allow, such as join requests, approvals, messages, reminders, changes to Sessions, and alerts about Sessions nearby.
Fair use: applying limits such as the number of Sessions you can host at once, preventing double-booking, and closing inactive chats.
Safety and enforcement: reviewing reports, investigating suspected breaches of our Terms or Community Guidelines, preventing fraud, spam and abuse, and taking action against accounts.
Operating and improving the Service: keeping the Service secure and reliable, fixing problems, and understanding how features are used so we can improve them.
Communicating with you: responding to your requests and telling you about important changes to the Service, our Terms or this Policy.
Legal compliance: complying with applicable laws, responding to lawful requests from authorities, and establishing, exercising or defending legal claims.

We do not sell your personal data, and we do not use it for third-party advertising.

5. What other users can see

Your public profile: your name (or your nickname, if you are a Hobin Plus member and choose to show it, in which case your real name is shown in smaller text on your profile), age (calculated from your date of birth, which is not shown), gender, country, bio, hobbies, photos, occupation, education, languages, horoscope, and your “Good kaki” count.
Kept private: your email address, date of birth, home area, hometown, height, weight, drinking and smoking habits, and religion are not shown to other users.
Sessions you host: the title, activity, description, date and time, location or approximate area, and the names and photos of people who have joined are visible to anyone using the Service, including people who are not signed in.
Shared links: anyone with a link to a Session can see a preview showing its title, time and location or area.
Join requests: when you ask to join a Session, the Host can see your profile and any note you include.
Hobin Plus: other users can see that you are a Hobin Plus member (a gold ring and tag on your profile and photo), and Sessions you boost are highlighted.
Profile views and Good kakis: when you open someone’s profile, we record that you viewed it (once per day; kept for 30 days). If that person is a Hobin Plus member, they can see that you viewed their profile. Hobin Plus members can also see who gave them a “Good kaki”, for Good kakis given after Hobin Plus launched. People who block each other never see each other in these lists.
Chats: Session group chats are visible only to the Host and approved members. Direct messages are visible only to the two people in the conversation.

Please think carefully about what you share. Other users can see, remember or screenshot what you show them, and we cannot control what they do with it.

6. Location data

If you allow location access, the app uses your device’s location to centre the map on where you are and to help you place a Session pin. We do not continuously track your location, and we do not store your live location on our servers. We store only the home area you choose and the locations of Sessions you host. You can choose an approximate area instead of an exact spot for any Session you host, and you can turn off location access at any time in your device settings.

7. Notifications

If you allow notifications, we store a push notification token for your device so that we can send you notifications. Notifications are delivered through Expo and Apple or Google push services, and may contain a short preview of a message or Session. You can turn individual notification types on or off in the app, mute a group chat, or turn off notifications completely in your device settings. When you sign out, we remove that device’s token.

8. Messages

We store messages, and photos sent in chats, so that they can be delivered and shown to the people in the conversation. Photos are kept in private storage that only the people in that chat can open. To make chats load quickly, recent messages may also be kept on your device; they are removed from your device when you sign out. We do not read your messages, except where a conversation is reported to us, where we need to investigate a safety concern or a breach of our Terms, or where we are required to do so by law.

9. Safety, reports and moderation

When a user, Session or conversation is reported, our moderators may review the relevant profiles, Session details and recent messages in order to investigate. We keep records of reports and of the actions we take, such as warnings, removals and account suspensions, so that we can handle repeat abuse and respond to questions or disputes. Where we believe someone is at risk of harm, or where the law requires it, we may share relevant information with the police or other authorities.

10. Photo verification

Getting verified is optional. If you choose to do it, the app asks you to take a live selfie with your front camera while doing a pose we pick at random (for example, a thumbs up). Before you take it, we ask for your express consent.

Why we use it: only to check that the person in your profile photos is you, so we can show a “✓ Verified” badge on your profile and reduce fake accounts. A member of the Hobin team compares your selfie with your profile photos by eye. We do not use automated face recognition, and we do not create or keep a face template.
Who can see it: your selfie is stored in private storage that only you and authorised Hobin moderators can open. It is never shown on your profile or to other users. Other users see only whether you are verified.
How long we keep it: the selfie is deleted 30 days after we approve or reject it. We keep a record that you were verified (or not), the reason given if it was not approved, and when.
If you change your main photo after being verified, the badge is removed until you verify again.
Withdrawing consent: you can withdraw your consent at any time by contacting us (section 22). We will then delete your selfie if we still hold it and remove your badge. Deleting your account also deletes it.

11. Who we share personal data with

We share personal data only as described in this Policy:

Other users, as described in section 5.
Service providers who process data on our behalf, under contractual obligations to protect it and to use it only to provide their services to us:
- Supabase (database, authentication, file storage and server functions);
- Expo, Apple and Google (push notification delivery);
- Google (Maps and Places, for maps and place search) and the Singapore Land Authority’s OneMap (addresses and areas);
- Google and Apple (sign-in);
- Vercel (our website and shared-link previews);
- our email provider, for messages you send to us.
Authorities and others where required by law, such as in response to a court order or a lawful request from the police, or where necessary to protect the rights, property or safety of our users, the public or us.
A successor, if the Service is transferred to a company or other entity that operates it in future, in which case this Policy will continue to apply to your personal data.

12. Transfers outside Singapore

Some of our service providers store or process data outside Singapore. In particular, our main database is hosted by Supabase in South Korea (Seoul), and other providers may process data in the United States and other countries. Where we transfer personal data outside Singapore, we take appropriate steps to ensure that it receives a standard of protection comparable to that under the PDPA, including by using providers that are bound by contractual data protection commitments.

13. How long we keep personal data

We keep personal data only for as long as it is needed for the purposes described in this Policy, or as required by law. In particular:

Account and profile data is kept while your account is active, and deleted when you delete your account (see section 14).
Session group chats close once a Session has ended and no one has written in the chat for 5 days. A closed chat is removed from the Service, and its messages are permanently deleted 30 days later, unless the Session is the subject of an open report, in which case they are kept until the report is resolved.
Photos in Session group chats are permanently deleted when the chat closes. Photos in direct messages are kept until the message, the conversation or your account is deleted. A photo that has been reported is kept until the report is resolved.
Profile views are deleted after 30 days.
Verification selfies are deleted 30 days after the review decision (see section 10).
Requests to join that are not answered before a Session starts expire automatically.
Reports made about you are kept for up to 2 years, including after your account is deleted, so that we can investigate safety issues and prevent repeat abuse. These records keep your former user ID, display name and the details of the report.
Backups: copies of deleted data may remain in encrypted backups for up to 7 days before being overwritten.

14. Account deletion

You can delete your account at any time in the app under Settings → Phone & security → Delete account, or by following the steps at hobin.app/delete-account. When you delete your account, we immediately and permanently delete your profile, photos, the Sessions you host (together with their chats), your messages in other Sessions’ chats, your direct message conversations (for both participants), your kaki connections, endorsements, blocks, reports you have filed, notification settings and your sign-in account, except for the records described in section 13 that we keep for safety or legal reasons.

15. Your choices and rights

Subject to the PDPA, you may:

Access the personal data we hold about you, and ask how it has been used or disclosed in the past year;
Correct personal data that is inaccurate or incomplete. You can update most profile details yourself in the app at any time;
Delete your account and personal data, as described in section 14; and
Control notifications, location, camera and photo access in the app and in your device settings.

To make a request, email us at hobin.tsd@gmail.com from the email address linked to your account. We may need to verify your identity before acting on a request. We will respond within 30 days, or tell you if we need more time. We may charge a reasonable fee for access requests where permitted by the PDPA, and we will tell you the fee before processing the request.

16. Withdrawing consent

You may withdraw your consent to our collection, use or disclosure of your personal data at any time by contacting us, or by deleting your account. Because personal data is essential to providing the Service, withdrawing consent may mean that we can no longer provide some or all of the Service to you. We will explain the likely consequences before acting on your request.

17. Security

We take reasonable security arrangements to protect your personal data, including encryption of data in transit, access controls that limit each user to the data they are allowed to see, restricting staff access to what is needed for moderation and support, and keeping secret keys on our servers rather than in the app. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please keep your sign-in account secure and let us know immediately if you suspect any unauthorised access.

18. Data breaches

If a data breach occurs that is likely to result in significant harm to you, or is of a significant scale, we will notify the Personal Data Protection Commission and, where required, affected users, in accordance with the PDPA.

19. Children

The Service is not intended for anyone under 18, and we do not knowingly collect personal data from anyone under 18. If we learn that someone under 18 has created an account, we will delete it. If you believe a child is using the Service, please contact us.

20. Cookies and tracking

The app does not use advertising identifiers or third-party advertising or tracking tools. Our website does not use advertising or tracking cookies. If we introduce analytics in the future to understand how the Service is used, we will update this Policy before doing so.

21. Changes to this Policy

We may update this Policy from time to time, for example when we add features or when the law changes. If we make material changes, we will let you know through the Service or by other reasonable means before the changes take effect. The updated Policy will show a new effective date.

22. Contact us

If you have any questions, requests or complaints about this Policy or how we handle your personal data, please contact our Data Protection Officer:

Data Protection Officer, Hobin
Email: hobin.tsd@gmail.com

If you are not satisfied with our response, you may contact the Personal Data Protection Commission of Singapore.