Privacy policy

Last updated 10 November 2026

ottokay is a study app for Singapore's Real Estate Salesperson (RES) exam. This page explains what we collect when you use it, why, where it's kept, and how to see or delete it. We follow Singapore's Personal Data Protection Act 2012 (PDPA).

The short version: you can study without an account, and then your progress never leaves your device. If you sign in, we keep your email address and your study progress so it can sync across devices. We don't sell your data, show ads, or use tracking cookies.

If you study without an account

Your progress (which questions you've answered, when, and how well, your streak, points and any exam dates you set) is saved in your browser on this device only. A copy of the questions is also saved there so the app works offline. We don't receive any of it. Clearing your browser's site data, or "Reset progress" in the app, deletes it.

If you sign in

Signing in is optional. When you do, we keep:

Your email address, to sign you in with a 6-digit code.
Your name and profile picture, only if you sign in with Google, because Google shares them with us. We use your email to identify your account; we don't show your name or picture to anyone.
Your study progress, the same as above, so it's saved to your account and stays in step across your devices.
Sign-in records: when you signed in, and the IP address and browser used. Our sign-in provider keeps these to protect accounts from misuse.

We use this only to run your account and the app. We don't use it for advertising, and we won't email you anything other than sign-in codes unless you ask.

Visits to the site

We count visits with Cloudflare Web Analytics, which uses no cookies and doesn't identify you: it tells us things like how many people visited a page and from which country. Like any website, our hosting provider also processes your IP address to deliver the pages and protect them from attacks.

Who handles your data for us

We use a few providers to run ottokay. Each handles your data only to provide its service to us.

Supabase stores accounts and progress, in a data centre in Singapore.
Cloudflare hosts the website, counts visits, forwards email sent to hello@ottokay.com, and runs Turnstile, the check that you're a person when you ask for a sign-in code (it looks at your browser and connection, not your email). Its network is worldwide.
Resend sends the sign-in code emails, from its Tokyo region, so it handles your email address and the code.
Google, if you choose "Continue with Google", handles that sign-in under its own privacy policy.

Some of these providers process data outside Singapore. Where they do, we rely on their contractual commitments to protect it to a standard comparable to the PDPA.

How long we keep it

We keep your account and progress until you delete your account. Sign-in records are kept by our sign-in provider for a limited time for security. Before some updates to the app's database we take a backup copy of everyone's progress; we keep the 10 most recent and delete older ones. When you delete your account, we also remove your progress from those backups.

Delete your data

To delete your account and everything linked to it, email hello@ottokay.com from the address you sign in with, with the subject "Delete my account". We'll delete your account, your progress and your sign-in identities within 30 days and reply to confirm. If you signed in with Google, you can also remove ottokay's access in your Google account settings.

Progress saved on a device without an account is deleted with "Reset progress" in the app, or by clearing your browser's data for ottokay.com.

Your rights

Under the PDPA you can ask what personal data we hold about you and how we've used it, ask us to correct it, or withdraw your consent (which means deleting your account, since we need your email to run it). Email hello@ottokay.com; we'll reply within 30 days.

Children

ottokay is meant for adults preparing for the RES exam. It isn't meant for children under 13, and we don't knowingly collect their data.

Security

Data travels encrypted (HTTPS), the database accepts encrypted connections only, and each account can read and change only its own progress. No system is perfectly secure; if we ever learn of a breach that affects you, we'll tell you and the authorities as the PDPA requires.

Changes

If we change this policy, we'll update the date at the top. If a change affects how we use data you've already given us, we'll tell you in the app before it applies.

Contact

Questions, requests or complaints: hello@ottokay.com. This address also reaches our data protection officer.