You can read everything here without telling us who you are

Reading this site tells us nothing about you. There are two ways we learn anything: you email us, or you choose to sign in on the Learn pages so your progress follows you between devices.

So, to be specific about what this site does not do:

• No passwords, ever. Sign-in is by Google only.
• No analytics, no visitor counter, no tracking pixels.
• No advertising, and no advertising networks.
• No embedded social feeds or share widgets that watch you.
• No mailing list to end up on.

We have nothing to sell to anyone, and no one but you can see your progress.

If you sign in, this is the whole of what an account holds:

• The email address you signed in with.
• For each stage of the Launch Guide: which questions you ticked, the note you wrote, whether you marked it done, and when you last changed it.

It is stored in a database run for us by Supabase, in a project that belongs to Sustainify and is hosted in the Asia-Pacific region; the site itself is served by Vercel from data centres around the world. Hong Kong’s rule on sending personal data abroad (section 33 of the Ordinance) is not yet in force, but we tell you anyway. Each row is locked to the account that made it at the database level, so one signed-in visitor cannot read another’s progress even if our own code had a bug. Supabase handles the data as our processor under their own privacy policy (opens in a new tab).

When you sign in with Google, Google tells us your email address and nothing else that we keep. Google also sends a name and picture; we do not store them. We do not see your Google password, contacts, calendar or anything in your Google account. No password is ever created with us.

Progress you record without signing in stays in your own browser. It never reaches us unless you later sign in on that device and choose to add it to your account, at which point it is copied over and cleared from the browser.

On the My progress page you can download everything we hold as a file, wipe your progress, or delete the account. Deleting removes your email, your name and every row of progress from our database immediately. Nobody has to approve it.

On Get involved you pick the route that fits you best. That choice only changes what appears on your screen. It is not sent to us, it is not saved, and if you reload the page it is gone.

The button then opens your own email program with a draft addressed to info@sustainifysdg.com, with a few prompts in the body.

Nothing leaves your device until you press send yourself — and if you close the draft, nothing ever reaches us.

Then we have three things, and only these three:

• Your email address.
• Whatever name your mail program sends with it.
• Whatever you decided to write to us.

We use them to reply and to work out how we might help. Nothing else.

Your message is read by the small number of volunteers who handle enquiries. Like any email, a copy sits with the email provider that hosts our address, and another with yours.

We do not add you to anything, and we do not pass your message on to anyone outside Sustainify without asking you first.

Enquiry emails are deleted twelve months after the conversation ends. An account that has not been signed into for twenty-four months is deleted, after a warning email to the address on it.

If you would rather we deleted your message sooner, ask us and we will. You can delete your own account at any time from the My progress page.

Email travels across the internet in the hands of several companies before it reaches us. It is a fine way to say hello. It is not a safe way to send anything sensitive.

Please keep all of this out of a message to us:

• Identity card, passport or other ID numbers.
• Bank, card or other financial details.
• Passwords, of ours or anyone else's.
• Health information, or anything else you would not want read aloud.
• Someone else's personal details, unless they know you are sending them.

We will never ask you for any of it. If a message claiming to be from Sustainify asks you for bank details or a password, it is not from us.

Anything you choose to send us is sent at your own risk. Email passes through companies we do not control, and so far as the law allows we are not responsible for it being lost, delayed, altered, intercepted, read by someone else or misused on the way to us.

If you send us something sensitive after reading this, that is your decision, and the risk stays with you.

The site is hosted on Vercel. Like any web server, theirs has to receive your request in order to send the page back, which means it handles technical information: your IP address, the time, the page you asked for, and the browser you used.

That happens for every website you visit, and it is the one real exception to “we collect nothing”.

We have not built any analytics on top of it, and we do not sit and read those logs. Vercel handles them as our hosting provider, under their own privacy policy (opens in a new tab), and how they run their service is not something we control.

Because we do not control it, we are not responsible for it. So far as the law allows, we are not liable for how Vercel, our email provider, or any other company in the chain handles, keeps, loses or discloses anything that passes through them.

There is no cookie banner because there are no tracking or advertising cookies, and Hong Kong law does not require a banner for the rest.

If you sign in, a session cookie keeps you signed in. It exists only to do that, is not readable by any other site, and goes when you sign out or it expires.

The Learn pages keep your ticks and notes in your browser’s local storage until you sign in. That never leaves your device on its own, and clearing your browser data removes it.

The site uses one typeface, Plus Jakarta Sans. It is served from this site, so your browser makes no request to Google to read a page here.

The photographs and illustrations are ours and come from the same place. No other company’s code runs on these pages.

We link to news articles about our work, to organisations we have worked with, and to our own LinkedIn and Instagram. The moment you follow one, you are on someone else’s site under their privacy policy.

We cannot see who clicks, and we get nothing back from those sites about you.

We do not control those sites and, so far as the law allows, we are not liable for how they handle your data or for anything that happens to you once you are on them. Read their policies, not ours, once you are there.

Plenty of our readers are. That is one reason we kept this simple: you never need to sign up to read anything, and if you do sign in, an email address and your own notes are all it involves.

Accounts are for people aged 13 and over, which is also the minimum age for a Google account in Hong Kong. Younger readers can use every page without signing in. If you are thinking about emailing us about an idea, it is worth telling a parent, carer or teacher first — partly so someone knows, and partly because they are often useful.

If a parent or guardian asks us to delete a child’s account, we will, and we will not argue about it.

Hong Kong’s Personal Data (Privacy) Ordinance (Cap. 486) gives you the right to ask whether we hold personal data about you, to ask for a copy of it, and to ask us to correct it if it is wrong.

For an account, the My progress page already gives you a copy of everything, lets you correct it by editing, and lets you delete it. For email you have sent us, ask and we will find it.

Send any data access or correction request to info@sustainifysdg.com. That is the only channel we use for this, and we will answer.

So that we can find the right messages, tell us the email address you wrote from and roughly when. The Ordinance also lets us charge a reasonable fee for handling a data access request. We would rather not, and for a simple question about your own email we will not.

If you are not satisfied with how we handle it, the Privacy Commissioner for Personal Data, Hong Kong (opens in a new tab) oversees this law and can take complaints.

We describe this site as it is built today, honestly and to the best of our knowledge. We cannot promise the site or our inbox will always be available, or that email will always arrive.

In this section, “we” and “us” means Sustainify and also, personally, its founders, directors, officers, volunteers and contributors. Each limit below protects those people in their own name as well as the organisation.

So far as Hong Kong law allows, we are not liable for any loss or damage of any kind — direct, indirect, consequential, special or incidental, and including lost time, lost money, lost opportunity, lost or corrupted data, and harm to reputation — arising out of or connected with:

That applies however the loss arises, and whether or not we knew it might happen.

Here is what we cannot limit, and are not trying to. Nothing in this section excludes or limits our responsibility for death or personal injury caused by our negligence, for fraud, or for anything else the law does not allow us to exclude. It also takes nothing away from your rights under the Personal Data (Privacy) Ordinance: everything in section 11 stands whatever this section says.

The limits, the cap and the severability wording in our terms of use apply to this statement too. If a court finds part of this section too wide, read it as narrowed to what the law allows; if it cannot be narrowed, that part drops out and the rest stands.

This statement is governed by the laws of the Hong Kong Special Administrative Region, and the Hong Kong courts have exclusive jurisdiction over any dispute about it.

There is no visitor database, and no passwords to leak because none exist. The account database holds email addresses and study notes, each row locked to its owner, and the key that could bypass that lock lives only on our server and is used only to carry out deletions.

No system is perfectly secure, and we cannot guarantee that no incident will ever happen — to our inbox, to our hosting provider’s systems, or anywhere on the internet between you and us. So far as the law allows, we are not liable if one does.

That is not a reason for us to be careless. If an incident happened and it affected your data, we would tell you.

We added optional accounts on 22 September 2026 and rewrote this page the same day. If we ever add anything else that collects data — a proper form, a newsletter, analytics — we will say so here and change the date at the top before it goes live. Until that date changes, what you have read is what the site does.

Our terms of use cover the rest: what you may do with our materials, and what we can and cannot promise.