Version 2026-10-24 · Effective 24 October 2026 · Written for the Personal Data Protection Act 2012 (Singapore)
SG Tuition Finder (Unofficial) (the "Service") is run by a single individual in Singapore (the "Operator", "we"). This policy explains, in plain terms, what personal data the Service touches, where it goes, and what it does not do. The short version: we run no accounts, no database, no cookies, no analytics and no advertising, and our server stores nothing about you.
1. What we collect about you: essentially nothing server-side
The Service has no sign-up, login, profile, cookie, tracker, analytics script, advertising or fingerprinting. Our code never writes a log, database, key-value store or file on any server.
When you press Load latest assignments, your browser calls our Cloudflare Pages Function at /api/channel with only the channel name (from a fixed list) and, for older pages, a post id. No settings, postal code, filters or identifiers are sent to us. The response is the same for every user and is cached at Cloudflare's edge for 300 seconds.
We do not know who you are, and we have no way to look you up.
2. What Cloudflare may process
The Service is hosted on Cloudflare Pages. To deliver any web page, Cloudflare, as our infrastructure provider, necessarily receives your IP address and request metadata (such as the URL requested, browser user-agent, and timing) and may record them in its own operational and security logs under its own retention rules. We do not enable, access or receive request logs for the Service.
Cloudflare acts as our data intermediary (processor) for this traffic, and we remain responsible under the PDPA for data it processes on our behalf. Cloudflare's handling of end-user data is described in its Privacy Policy.
Cloudflare operates a global network. Your request may be served by, and the 300-second cache may live at, a Cloudflare data centre outside Singapore. See section 9.
3. What stays in your browser (localStorage)
Everything you set up lives only in your browser's localStorage for this site and never reaches our server:
your tutor type, look-back window and all filters, including your home postal code and up to 10 recently used postal codes;
your hidden and applied job lists and up to 20 saved result lists (these contain copies of the post details you saw, minus the raw text);
a small cache of postal-code coordinates obtained from OneMap;
the version of the Terms you accepted and when.
How to delete it. Clear this site's data in your browser (usually under Settings → Privacy → Site data, or by clearing browsing data for sg-tuition-finder.pages.dev). In the app you can also clear your home postal code and use "unhide all", remove saved lists and un-apply jobs. Export backup downloads all of this as a JSON file to your device; Import backup restores it. Anyone with access to your device or browser profile can read this data, so protect your device.
4. OneMap (Singapore Land Authority)
To compute straight-line distances, your browser sends your home postal code and each assignment's postal code directly to OneMap's public search API at www.onemap.gov.sg, operated by the Singapore Land Authority (SLA). These requests do not pass through our server. OneMap receives your IP address and the postal codes, and handles them under SLA's own privacy statement and terms.
A postal code is a location, not your name. Still, if you prefer not to send it, leave the home postal field blank: the distance filter is then disabled and nothing is sent to OneMap.
Coordinates returned by OneMap are cached in your browser so repeat lookups are not sent again.
5. Personal data about other people in agency posts
Tuition-assignment posts are written and published by tuition agencies in public Telegram channels that anyone can read without an account. They often contain personal data about students and families: level, gender, area, address or postal code, schedule and sometimes names.
The Service relays these public posts transiently: our function fetches the public web preview (t.me/s/<channel>), extracts the post id, date and text, returns them to your browser, and the result sits in Cloudflare's edge cache for at most 5 minutes. We keep no copy, database or archive. Parsing and filtering happen in your browser.
We rely on the PDPA's exception for personal data that is publicly available (First Schedule, Part 2) to relay this data without consent, for the same purpose for which the agency published it: letting tutors find and apply for assignments. We do not use it for anything else, and the Terms of Use forbid you from re-publishing or misusing it.
Each card links to the original post. The original content stays on Telegram under the agency's control. We cannot edit or delete it there.
If you are a student, parent, tutor or agency and want a post or a whole channel to stop appearing in the Service, or have any concern, write to tuitioncentres@protonmail.com. See the Content removal & complaints policy for what to include and what we will do. Removing a channel from our allowlist stops the Service fetching it after the next deployment.
6. No cookies, tracking, advertising or sale
The Service sets no cookies and uses no analytics, pixels, embedded social widgets or advertising. The only third-party endpoint your browser contacts is OneMap, and only when you use the distance filter.
We do not sell, rent, share or otherwise disclose personal data to anyone. We hold none to disclose.
Our Content Security Policy restricts the page to loading scripts and styles only from this site and to connecting only to this site and OneMap.
7. Children and young people
The Service is for tutors and requires users to confirm they are 16 or older; users aged 16 or 17 must have their parent's or guardian's consent. It is not directed at children and we do not knowingly collect personal data from anyone under 16. We collect no personal data from users at all, so there is nothing to delete on our side; data on your own device can be cleared as in section 3.
Posts frequently describe students who are minors. We display only what the agency has already made public, and we ask you to treat it with care: use it only to apply through the agency, and never contact a family directly or re-share it.
8. Security
Our security approach is to hold nothing worth stealing, and to keep the small server-side part narrow:
the server function only fetches channels on a fixed allowlist, validates its two inputs, and is not an open proxy;
a strict Content Security Policy, X-Content-Type-Options: nosniff, Referrer-Policy: no-referrer and frame-ancestors 'none' are set on every page;
post text is treated as untrusted and is rendered as text only, never as HTML;
there is no server-side storage, so there is no server-side database to breach;
all connections use HTTPS.
No system is perfectly secure. Your localStorage is only as safe as your device and browser.
9. International transfers
Cloudflare serves and caches the Service from its data centres worldwide, so requests and the short-lived cache of public posts may be processed outside Singapore. The cached content is publicly available personal data as defined in the PDPA; the request metadata is handled by Cloudflare under its own safeguards (see its Privacy Policy and Data Processing Addendum). OneMap requests go to SLA in Singapore.
10. Your rights
Access and correction. We hold no personal data about users, so there is nothing for us to give you or correct. Your own data is in your browser and fully under your control (view it with Export backup).
Withdrawing consent. Stop using the Service and clear the site's data. Leaving the home postal field blank stops OneMap lookups.
Data in posts. If a post is about you or your child, or your agency published it, use the removal process. To remove the original, contact the agency or Telegram.
Complaints. Write to us first at tuitioncentres@protonmail.com. You may also complain to the Personal Data Protection Commission of Singapore (pdpc.gov.sg).
11. Changes
We may update this policy by publishing a new version here with a new version date. Material changes also bump the Terms version, so the Service will ask you to re-accept before it loads assignments again.
12. Contact / Data Protection Officer
The Operator is the person responsible for data protection for the Service. Contact: tuitioncentres@protonmail.com. We aim to acknowledge messages within 7 days and to resolve removal requests within 14 days.