Calmroots

Legal · Singapore

Privacy policy

Last updated: 22 July 2026

This privacy policy explains how I, Mei, collect, use, disclose and protect personal data when you visit calmroots.life (the “Site”). Calmroots is a personal blog I write and maintain myself. It is not operated by a company or agency. Because I handle personal data as an individual data user under Singapore law, this policy is written to comply with the Personal Data Protection Act 2012 (No. 26 of 2012) and its subsidiary legislation (together, the “PDPA”).

By using the Site, submitting the contact form, or choosing cookie preferences, you acknowledge that you have read this policy. Where the PDPA requires consent, I will ask for it clearly before collecting your data — for example, through the consent checkbox on the contact form.

Who is responsible for your data

The data user responsible for personal data collected through this Site is:

Mei
Calmroots (personal blog)
Blk 26 Jalan Klinik, #03-18, Singapore 160026
Email (displayed on this Site): [email protected]
Email (contact form submissions): [email protected]

Messages sent through the contact form are delivered to [email protected] for processing. The address [email protected] is shown on the Site for general correspondence and appears in the footer.

What personal data I collect

I collect only what is reasonably necessary for the purposes described below. The categories of personal data may include:

  • Contact form data: your name, email address, and the content of your message when you use the form on contact.php.
  • Cookie and preference data: your cookie choices (essential only, or essential plus analytics), stored in a browser cookie named calmroots_consent.
  • Technical data: standard server and access logs that may include IP address, browser type, referring page, and timestamps. These are generated automatically when you load a page.
  • Analytics data (if you consent): aggregated or pseudonymous usage information if optional analytics cookies are enabled. I do not use analytics to build individual profiles for marketing.

I do not knowingly collect personal data from children under thirteen without appropriate consent from a parent or guardian. This Site is intended for general readers and is not directed at children.

How I collect personal data

Personal data is collected in the following ways:

  • Directly from you when you fill in and submit the contact form, including when you tick the PDPA consent checkbox.
  • Through cookies and similar technologies when you interact with the cookie banner (Accept all, Reject all, or Customise).
  • Automatically through my web hosting infrastructure when you browse the Site.

I do not buy mailing lists or obtain personal data from third-party data brokers for this blog.

Purposes of collection, use and disclosure

Under the PDPA, I may collect, use and disclose personal data only for purposes that a reasonable person would consider appropriate in the circumstances, and I will notify you of those purposes. I use personal data for:

  • Reading and responding to messages you send through the contact form.
  • Correcting factual errors in blog posts when you point them out.
  • Operating and securing the Site, including troubleshooting, abuse prevention, and maintaining logs for a limited period.
  • Remembering your cookie preferences so the banner does not reappear on every visit.
  • Understanding general readership patterns if you have opted in to analytics cookies.
  • Complying with applicable laws, lawful requests, or court orders in Singapore or elsewhere where required.

I will not use your contact details to send unsolicited marketing, newsletters you did not ask for, or promotional material on behalf of third parties. If I ever wish to use your data for a new purpose not compatible with the original purpose, I will notify you and obtain consent where required.

Consent and withdrawal

For contact form submissions, I ask you to confirm consent by ticking the checkbox labelled for PDPA consent before sending. Without that consent, I will not process your submission through the form.

For cookies, essential cookies are necessary for basic Site operation and storing your consent choice. Optional analytics cookies are placed only if you select Accept all or enable analytics under Customise and save. You may Reject all optional analytics cookies and still use the Site.

You may withdraw consent at any time by contacting me at [email protected]. Withdrawal does not affect the lawfulness of processing before withdrawal. If you withdraw consent for contact form processing, I may no longer be able to reply using the details you previously provided.

Cookies

This Site uses cookies — small text files stored on your device. When you first visit, a banner at the bottom of the page offers three choices: Accept all, Reject all, and Customise.

  • Essential cookies: required to remember your cookie preference and support basic functionality. These cannot be switched off through the banner because the Site needs them to honour your choice.
  • Analytics cookies (optional): used only if you accept or customise them on. They help me see aggregate trends, such as which pages are read most often.

Your cookie choice is stored in a cookie named calmroots_consent for six months from the date you save your preference. After six months, the cookie expires and the banner will appear again so you can confirm or change your settings.

You can also delete cookies through your browser settings. Note that clearing cookies may reset your preferences and require you to choose again.

Retention of personal data

I retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. In practice:

  • Contact form messages are kept in my email inbox until the conversation is complete and no longer needed, typically for up to twenty-four months unless a longer period is required for a dispute or legal obligation.
  • Cookie consent records expire automatically after six months, as described above.
  • Server logs are retained for a short operational window (generally not more than ninety days) unless needed to investigate security incidents.

When personal data is no longer required, I will delete it or anonymise it so it can no longer identify you.

Protection of personal data

I take reasonable administrative, technical and physical measures to protect personal data against unauthorised access, collection, use, disclosure, copying, modification or disposal. Measures include hosting over encrypted connections (HTTPS), limiting access to my email account, and keeping software reasonably up to date.

No method of transmission over the Internet or electronic storage is completely secure. While I strive to protect your personal data, I cannot guarantee absolute security. If you believe your interaction with the Site is no longer secure, please contact me promptly.

Transfer of personal data outside Singapore

My web hosting provider and email services may process or store data on servers located outside Singapore. Where personal data is transferred overseas, I take steps to ensure that the recipient provides a standard of protection comparable to that under the PDPA, consistent with the requirements for overseas transfers under the PDPA. If you would like more detail about a specific provider, write to me and I will explain what I know.

Your rights under the PDPA

Subject to exceptions under the PDPA, you have the right to:

  • Access personal data about you that is in my possession or under my control.
  • Correct personal data that is inaccurate or incomplete.
  • Withdraw consent to the processing of personal data, where processing is based on consent.

To make an access or correction request, email [email protected] with enough information for me to verify your identity and locate the relevant data. I will respond within a reasonable time and in accordance with the PDPA. I may charge a reasonable fee for access requests where permitted by law; I will inform you before doing so.

If you have concerns about how I handle personal data, you may contact the Personal Data Protection Commission (PDPC) in Singapore. I encourage you to contact me first so I can try to resolve the matter directly.

Third-party links

The Site may link to external websites I do not control. This policy applies only to calmroots.life. If you follow a link elsewhere, that site’s own privacy practices apply. I am not responsible for the content or data handling of third-party sites.

Changes to this policy

I may update this privacy policy from time to time to reflect changes in practice, technology or law. When I do, I will revise the “Last updated” date at the top of this page. Material changes may also be noted on the home page or contact page. Continued use of the Site after an update constitutes acknowledgement of the revised policy, subject to any additional consent requirements under the PDPA.

Disclaimer

I write this blog myself. Everything here comes from my own experiences, opinions and memories at the time I wrote it. These pages are personal reflections, not professional, medical, legal, financial or fitness guidance. I describe places and everyday moments from where I stand; I do not name or speak for anyone else, and I try to write about my neighbourhood kindly and honestly. If something reads wrong, tell me and I will correct it.

Contact

For privacy questions, access or correction requests, or concerns about personal data on this Site:

Mei · Calmroots
[email protected] (displayed on Site)
[email protected] (contact form delivery)
Blk 26 Jalan Klinik, #03-18, Singapore 160026

Or use the contact form, remembering to tick the PDPA consent checkbox.