The fine print, in plain words

Privacy

LAST STEEPED: JULY 2026 · DRAFT: HAVE A LAWYER READ THIS BEFORE LAUNCH

Spine & Kettle is a directory of book clubs in Singapore. We collect as little as a website can get away with, and this page says exactly what and why. We comply with Singapore's Personal Data Protection Act (PDPA).

What we collect, and why

• When you request to join a club: your message, signed with your account's name and email. These go to that club's host so they can reply to you. That's the entire purpose. Hellos are signed so hosts know a real reader wrote them, which is why sending one needs a sign-in first.
• When you sign in: your email is the whole account. We store it, the display name you choose (optional), and, if you add a passkey, its public half only. Sign-in codes are stored hashed and go cold within ten minutes; there are no passwords anywhere to store or to leak.
• When you list a club: your name, email, and club details. Your email is never shown publicly; it receives join requests and your magic edit link.
• When you subscribe to The Weekly Steep: your email, used only to send the newsletter. The welcome email and every issue carry a one-click unsubscribe that works the first time.
• When you ask to hear when a chair opens: your email is stored against that one club until the alert is sent, then removed. It is used for that single notice and nothing else.
• IP addresses are kept briefly to stop spam (rate limiting) and are deleted within 30 days. Join requests you send are kept so hosts and you can refer back to them.
• Your shelf (bookmarked clubs) lives in your own browser. If you sign in, it also syncs to your account so it follows you between devices; we store only the club names on your shelf, tied to your email, and nothing else about your browsing.
• Staying signed in: a session token is kept in your browser's local storage so you don't sign in on every visit. Clearing your browser data, or signing out, removes it.
• What a host chooses to show: if a host adds a WhatsApp number to their club, it appears on that club's public page by their choice.

Third parties your browser talks to

• Google Fonts serves our typefaces, so your browser requests them from Google, which receives your IP address as part of any normal web request. We load nothing else from Google.
• QuickChart renders the QR code on a club's printable poster; opening a poster page sends that club's URL to QuickChart to draw the code.
• Our database (Supabase), hosting (Vercel), and transactional email (Resend) each process data only to provide the service described here.

What we don't do

• No advertising, no trackers, no selling or sharing your data with anyone.
• No passwords, ever. Browsing needs no account; signing in is only needed to send hellos or manage your shelf across devices, uses a one-time email code or a passkey, and stores only what the bullet above says.
• No analytics that identify you personally.

Your rights

Write to hello@spineandkettle.com to see, correct, or delete any personal data we hold about you. We'll respond within 30 days, usually much faster; we're a small kettle.