Privacy notice

Last updated 7 October 2026.

This notice says what Discuss keeps about you, who can see it, who else handles it, how long it is kept, and what you can ask us to do. It is written for Singapore's Personal Data Protection Act 2012 (the PDPA). The rules say what may be posted and how moderation works.

Who we are

Discuss is operated by Platform.SG, based in Singapore. For any question about this notice or about your personal data, including a request to access or correct it, contact our Data Protection Officer at support@platform.sg.

In short

What you post is public: your username, your posts and replies, and the images a moderator has let through.
Discuss never sees your email address. You sign in through the Platform.SG login, and Discuss keeps only the login's id for you.
People moderate Discuss by hand. No AI reads what you write or looks at the images you add. This notice will change before that does.
Discuss runs on Cloudflare, which carries every page and keeps Discuss's database and image files.
You can delete what you wrote. To close your account, write to us.
We don't sell your data, and we don't use it for advertising or profiling.

What everyone can see

Anyone can read Discuss, signed in or not.

Your username, beside everything you post.
Your posts and replies, with when you wrote them, the board each is in, and when you last edited it.
The images on your posts, once a moderator has let them through.
How many people marked a post useful, but not who.
Who moderates each board. A board lists its moderators by username, and what a moderator writes as themselves in their own boards carries a Mod tag.
Each board's log: what its moderators did there, the rule they named, and when. It never says who acted, to whom, or about which post. It also says when a moderator joined the board, never who.

What you write as a team shows the team's name, not yours. Only the team's members and site admins can see who wrote it, and the team's admins are told who wrote something of the team's that a moderator removed. The list of a team's members is shown only to its admins and to site admins.

What only some people can see

You see everything you wrote, including anything that was taken down, with the rule and any note from the moderator.
A board's moderators see, for that board and the boards inside it: what was reported, with how many reports and why but never who sent them; a copy of each reported post as it was; what was taken down; images waiting for a look; and, for each person who wrote there, when they joined, how much they wrote, the reports about them and any block.
Site admins, Platform.SG's own people, can do what moderators do on every board. They also see who sent each report, with its note; each person's record of what they posted and what was done to them; and the site log, which names who did what.
Your inbox, and the posts you saved, are yours alone. No post says how many people saved it.

What we keep, and why

Your account. Your username, and when you chose it, which is also when you confirmed you are 18 or over. The id the Platform.SG login has for you, linked to a separate id Discuss makes; the login's id is never shown, so nothing on Discuss links your account here to Platform.SG's other apps. Whether the login calls you a platform admin, which makes you a site admin here. Whether you are banned. Discuss doesn't ask for or keep your email address, your name, a phone number, an address, or an NRIC or FIN number.

What you write. Your posts and replies, the images on them, and the board each is in. When you edit something, the new words replace the old: it says it was edited, and when, and we keep no copy of the old words unless a report kept one (below).

What you do on Discuss. The posts you mark useful and the posts you save, so you can take them back. Your inbox, and what you chose to be told about. The reports you send. And a note of each post, reply and image upload you send, to hold everyone to the daily limits in the rules.

The check on record. Discuss's database puts nothing up without a check on record, so each post, reply and username has one. While moderation is by hand the check reads nothing: its record says what was sent and when, with a fingerprint of the words rather than the words, and that no AI read it.

What moderators and site admins do. Every decision is recorded: who made it, when, about which post or person, the rule named, and any note to the person. So is every block and ban, with how long it lasts.

Nothing else about your visits. Discuss's own code keeps no record of which posts you read or of what you search for, beyond marking the lines of your inbox you have opened. To stop a script from hammering Discuss, each copy of its server keeps in memory how often each account and each IP address has searched, marked something useful, saved a post or asked whether a username is free in the last minute. That is never written down.

We use all of this to run Discuss, to keep it safe and within the law, and to answer you when you write to us.

Images

What is kept. Never the file you upload. Cloudflare Images makes the picture again, as a copy no more than 2000 pixels on its long side and a small one no more than 800, and Discuss then takes out everything a browser doesn't need to draw it, such as where a photo was taken, the camera and its serial number, and comments. Only those two files are kept, in Discuss's storage at Cloudflare.
Who sees it. Every image waits for a moderator before anyone else sees it. Until then only you, who see it marked "Being checked", the board's moderators and site admins can see it, and nobody else can learn that it exists. Once it is let through, anyone who can see the post can see it.
When it goes. An image stops being shown to anyone but the board's moderators and site admins as soon as a moderator removes it, its post is taken down or deleted, or you take it off in an edit. If a moderator removes it, you are told why. Its files are deleted 30 days later, but not while a report about its post is open: whoever decides needs to see what was reported. A browser can keep a copy of an image it was shown for up to 5 minutes. An upload you never add to a post is deleted after 24 hours. After its files go, we keep a record of the image: who uploaded it, when, its size, and what a moderator decided.

Reports, blocks and bans

When you report something, we keep your report: the reason, your note if you add one, and when. The board's moderators are told how many reports there are and why, never who sent them. Site admins can see who sent each one. The writer is never told who reported them.
A report keeps a copy of the post as it was when reported (its title, its words, which images), so that an edit or a delete can't hide it from the moderators. The copy is deleted 30 days after the case is closed.
A report of harassment or threats, personal details, or sexual or violent images can hide a post at once, until a moderator decides. The rules say when.
If a moderator blocks you from a board, or a site admin bans you, the block or ban is kept with its rule, how long it lasts and who gave it. You are told why and until when, never by whom.

Your inbox and email

Your inbox tells you about replies to what you wrote, changes to your bug reports, and what happened to your posts: hidden after a report, removed, put back or moved. A moderator's also has what came in to their boards, reports and images waiting, and that a post in their board was put back, when whoever put it back asks for the board's moderators to be told. A team admin's also has the team's posts a moderator removed. It never says who reported or which moderator acted, and it holds no words anyone wrote except a moderator's note to you.
Email. Discuss never sees your email address. To email you, Discuss asks the Platform.SG login to send it, giving the login its id for you, the kind of news, which post it is about, who replied (a username, or a team's name), a bug's new status or the rule a removal named, and the title of the post only when it is yours and nobody else has changed its words. The login writes the email, and sends it only to an address it has verified, within its own daily limits.
Your choices. "Tell me about" says whether you are told about replies and about changes to your bug reports, and whether those come by email too. New post's "Email me about replies" sets email for replies. When a moderator removes one of your posts or replies, you are told in your inbox whatever you chose, and by email too, unless you used the links in Discuss's emails to turn both kinds off.
The moderators' email. News for moderators, a report or an image waiting, is emailed to support@platform.sg from discuss@platform.sg. It says the board, how many reports and their reasons, and who wrote the post as readers see them, with whether they joined today. Never who reported, and never a report's note.

Signing in

You sign in with Google, through the Platform.SG login (oauth.platform.sg) that Platform.SG's apps share. The login uses Auth0 (login.platform.sg) to sign you in with Google.

When you sign in, the login gives Discuss a session, and with it your account id, your email address and other details of your Platform.SG account. Discuss keeps only the account id, and whether you are a platform admin, and never stores or shows the rest. While you are signed in, Discuss checks your session with the login as you use it, so the login knows when your session was last used.

The login's sign-in page shows no privacy notice for Discuss, so here is what it keeps: your Platform.SG account, with your email address, when you last signed in, and any phone number or display name you added in another Platform.SG app; for each session, when it started and was last used, your browser's user agent, and a hash of your IP address; and, for Discuss's emails, your email choices and a record of each email it tried to send, without the title, any name or which post.

Cookies

Discuss sets two cookies, both for signing in, and none for advertising or for following you around the web:

__Host-discuss_session keeps you signed in. It holds your session id from the Platform.SG login, lasts 7 days, and is renewed each time you use Discuss. Signing out removes it.
__Host-discuss_sso_tx is set while you are away at the login, for up to 15 minutes, and removed when you come back. It holds a random check value, a one-time key that ties your sign-in to your browser, when you left, and the page to come back to.

Cloudflare can set cookies of its own on discuss.platform.sg. Its list of cookies says its bot protection can set cf_clearance, which holds the result of its JavaScript detections (below), and __cf_bm, which ends after 30 minutes without a visit. The Platform.SG login, Auth0 and Google set cookies of their own on their own sites when you sign in.

What Cloudflare adds to every page

Discuss's own pages ask no other site for anything, except Turnstile on the sign-up page. But Cloudflare adds three things to every page of discuss.platform.sg, whatever Discuss's code does. They are settings of the platform.sg domain at Cloudflare, not of Discuss, and Platform.SG has chosen to keep the first two. What each does, from Cloudflare's own pages, read on 30 September 2026:

JavaScript detections, part of Cloudflare's bot protection. A hidden script from /cdn-cgi/challenge-platform/ runs in your browser to help tell people from automated traffic, and stores its result in the cf_clearance cookie; each result lasts 15 minutes (Cloudflare's page). Cloudflare's Turnstile privacy addendum covers it: it reads signals such as your IP address, your browser's TLS fingerprint and user agent, and the site you're on, to detect and block bots for us, and also, for itself, to improve its bot detection.
Web Analytics, so we can see which pages are read and how quickly they load. A script from static.cloudflareinsights.com measures how long each page takes to load and sends that to /cdn-cgi/rum on discuss.platform.sg. Cloudflare's reports show the page's address without anything after a ?, the page you came from, your country, and your browser, operating system and kind of device. Cloudflare says it uses no cookies or local storage for this and doesn't fingerprint you; it keeps the full detail for 7 days, then a sample of it, and shows six months (Cloudflare's FAQ).
Network error reports, so that problems reaching the site can be found. Each answer asks your browser to tell Cloudflare, at a.nel.cloudflare.com, if it fails to reach discuss.platform.sg: the address, the page you came from, the kind of error and the server's address. Cloudflare says it turns your IP address into your network, country and area, and doesn't log it (Cloudflare's page).

Turnstile, on the sign-up page only, is Cloudflare's check that you are a person. It stays hidden unless Cloudflare needs you to do something. When you send the form, Discuss asks Cloudflare to confirm the widget's answer, and sends your IP address with it. Discuss's widget is made with Cloudflare's pre-clearance turned off, so passing it sets no clearance cookie.

Cloudflare, which runs Discuss

Cloudflare carries every page of Discuss and runs its code, keeps its database and its image files, makes images again, and carries its email. Its network, in data centres around the world, sees every request, including your IP address.

Where things are kept. Discuss's database and its image files were made with Cloudflare's hint to keep them in its Asia-Pacific region. Cloudflare treats a hint as a preference, not a promise (database, files).
Its log of requests. Cloudflare keeps a log of each request to Discuss for 7 days: the address asked for, which includes what you typed into a search, when, and details it adds about the request; and the lines Discuss's code writes, which are counts from its hourly jobs and error messages (Workers Logs).
Backups. Cloudflare can restore Discuss's database to any minute in the last 30 days, so what was deleted or changed can still be recovered from it for 30 days (Time Travel).
Email. Mail to support@platform.sg reaches us through Cloudflare's email routing, and Discuss's and the login's emails go out through Cloudflare's email service. Cloudflare keeps a record of each email (who from, to whom, the subject) for 31 days, and can keep a copy of a sent email for about 7 days (email logs).
Its roles. Cloudflare's privacy policy (effective 4 November 2025) says it acts for its customers, as their processor, for the content that passes through or is stored on its network and for the logs they can see; for other data about traffic, such as what it uses to improve its bot detection, it acts for itself.

If you write to support@platform.sg, we keep your email address and what you send, to answer you and deal with it.

Data sent outside Singapore

Cloudflare's network runs Discuss in data centres around the world, near whoever is visiting, and Cloudflare's privacy policy says it primarily stores the personal information it handles in the United States and the European Economic Area. Section 26 of the PDPA lets us send personal data abroad only where it will be protected to a standard comparable to the PDPA's. Cloudflare is certified to the Global Cross-Border Privacy Rules System and the Global Privacy Recognition for Processors System (its Data Processing Addendum, version 6.4, effective 3 April 2026, section 3.2), and the Personal Data Protection Regulations 2021 have accepted both certifications for such transfers since 2 March 2026. We read both pages on 30 September 2026.

How long things are kept

Your account and what you write: until you delete what you wrote, or close your account.
What you delete: its words go at once. A deleted post keeps its place in its thread as "Deleted by its writer", with when it was posted and in which board, and the replies under it stay; a deleted reply keeps that line only if others replied to it. Site admins can still see in your record that you posted, where and when.
Images: their files, 30 days after they stop being shown; an upload never added to a post, 24 hours.
A report's copy of a post: 30 days after the case is closed.
Useful marks and saved posts: until you take them back. Your inbox and your choices: until you close your account.
The daily limits' record of what you send: 30 days. The record of your image uploads: 2 days.
Reports, the check on record, what moderators and site admins did (blocks and bans included), and emails you send us: we keep these, as the record of what happened.
Your sign-in: 7 days after you last use Discuss. The sign-in cookie: at most 15 minutes.
At Cloudflare: its log of requests, 7 days; its backups of the database, 30 days; its email records, 31 days.

A clean-up runs every hour to delete what is due.

Closing your account

You can't close your account from Discuss yet. Write to support@platform.sg and we close it within 30 days. Closing it:

stops it first: from then on it can't post, reply, edit, mark, save, report or upload anything, and nothing more reaches its inbox or is emailed to you;
deletes its sign-in, so nobody can use it;
deletes everything you wrote as yourself, as if you had deleted each post and reply yourself, and the replies other people wrote under them stay;
deletes your useful marks, saved posts, inbox, choices, and the daily limits' records;
keeps your username, so that it is never given to anyone else, and when you joined;
leaves what you wrote as a team under the team's name, and keeps the reports you sent and what moderators and site admins did, as the record of what happened.

An account that moderates a board or belongs to a team is taken off the board, or out of the team, first. From the moment closing is asked for, the account is given no role: it isn't made a moderator, a team's member or admin, or a site admin. Your Platform.SG login account stays, since Platform.SG's other apps use it too.

Your rights

Under the PDPA, you can ask us:

for access: what personal data we hold about you, and how it has been used or disclosed in the past year;
to correct it: to fix an error or an omission;
to withdraw your consent to our collecting, using or disclosing your personal data. Withdrawing consent means we can no longer provide Discuss to you, so we close your account, as above.

Write to support@platform.sg. We read and act on every request as soon as possible. If you're not satisfied with our response, you can contact Singapore's Personal Data Protection Commission.

Discuss is for adults

Discuss is for people 18 and over. When you choose your username, you confirm that you are. We record when you did, and we don't ask for proof.

Online safety and official requests

Singapore's Online Safety (Relief and Accountability) Act 2025 has applied since 29 June 2026, when the Online Safety Commission began work.

Reporting harm. Use Report on the post or reply, or write to support@platform.sg with a link to it. The rules say what happens next, and when you can go to the Commission.
Official requests. The Commission can direct platforms and the people who run online spaces to deal with online harm, and can require anyone to give it information they hold, including information that identifies who posted something. We give information to the Commission, the courts or the police when the law requires it. Because Platform.SG also runs the login, that can include the email address of your Platform.SG account.

Changes

When this notice changes, so does the date at the top. It will change before anything that reads what you write, or looks at your images, is turned on.

Sources names the open data behind Discuss's list of places, which is about places, not people.