MOPY STUDIO PTE. LTD. (Singapore UEN 202632893C) operates Second Story. This policy covers our app, marketplace and website. We collect, use and share personal data for the purposes below, with your consent or where Singapore law permits or requires it.
What we collect and why
- Account details: your email, login details, profile information, phone number if provided, verification status and agreement records, to create and secure your account. If you use Apple or Google sign-in, we receive the account information they provide for that login.
- Marketplace activity: listings, photos, listing locations, messages, offers, bids, reviews and other activity, to display items and help members communicate and trade.
- Purchases: store order references, purchase verification and refund records, to provide paid promotions and resolve payment problems. Apple or Google handles store checkout.
- Support and safety: reports, blocks, support messages and relevant activity, to respond to requests, investigate abuse, enforce our rules and meet legal duties.
- Technical information: app name, package identifier, version, build, platform and operating system version where available; request logs, IP addresses, notification tokens and approximate account activity, to deliver notifications, protect the service and troubleshoot faults.
App diagnostics do not collect device serial numbers, advertising identifiers, device fingerprints or location, and are not used for cross-company advertising tracking. A location you add to a listing is part of that listing. Optional product emails are separate from essential account, security and transaction messages.
Who can see your information
Your public profile, listings, listing locations, photos and reviews can be seen by other people, including visitors without an account. Shared pages may appear in search engines or link previews. Messages and chat photos go to the other participant; authorised staff may access relevant records for support, safety or legal matters. Avoid sharing private details you do not want others to see or copy.
Providers such as Microsoft Azure and Google Firebase help us host the service and deliver messages and notifications. Apple and Google process sign-in or purchases when you choose those features. We may share necessary information with advisers or authorities for a lawful purpose. When data is processed overseas, we must ensure protection comparable to Singapore's PDPA, unless a legal exception applies.
Optional Singpass verification
If you choose Singpass Myinfo verification, we link one identity to your account and retrieve your mobile number for your private review. You may edit the number before confirming it. We retain the confirmed number privately; it is never displayed on your public profile. An unchanged number from production Myinfo is marked verified through Singpass. An edited number is saved as unverified. This does not send an SMS or establish current possession. Singpass is not your Second Story login. We do not request or store your legal name, NRIC, address, nationality or Singpass credentials through this flow. We keep verification times, the source and a one-way identity reference to prevent duplicate links. Temporary verification data is encrypted, cleared after confirmation or failure, and removed after expiry by cleanup.
Young members
Our accounts are for people aged 13 and above. If you are 13–17, you can consent to the use of your data when you understand this policy and what agreeing or withdrawing consent means. Ask a trusted adult or contact us if anything is unclear. If we have reason to believe you do not understand, we will seek a parent or guardian's consent before relying on yours. The separate parent or guardian requirement for using the marketplace is in our Terms.
Your profile and listings are public; chats are shared with the other member. Do not post your school, home address or identity documents. You can ask us to stop using your data, but we may then be unable to provide your account. Contact us about an under-13 account so we can close it and arrange removal of data we no longer need.
Keeping and deleting data
We must stop keeping personal data, or remove its link to you, when it is no longer needed for a service, business or legal purpose. Closing your account revokes access and hides your public profile and active listings; it does not immediately erase every record. Contact us to request removal of remaining personal data. We may need to keep relevant transaction or conversation records for disputes, fraud investigations, legal claims or accounting duties. Retention must be limited to what is still needed; backups may take longer to expire.
Automatic cleanup defaults are 30 days for completed background-job logs, 90 days for email delivery logs and 180 days since receipt for the latest app-information snapshot. These periods may change for a documented service need and do not cover all account or transaction records. See how to request account deletion.
Your choices and rights
Update your profile and notification choices in the app. Contact us to request access to your personal data and information about its use or disclosure, correct it, withdraw consent, request deletion or raise a privacy concern. We may verify your identity and apply legal exceptions, including protection of another person's information.
We respond to access and correction requests as soon as reasonably possible. If we cannot complete one within 30 days, we will tell you in writing when to expect our response. If an access fee applies, we will tell you before proceeding. On reasonable notice of withdrawal, we will explain the likely effects and stop the affected collection, use or sharing unless the law permits or requires it. Some features may no longer work without the necessary data.
Website cookies
The public website uses a language-preference cookie where needed and has no advertising trackers or analytics scripts. Your browser may cache page files and images. Our host processes request information to serve and protect the site. Opening a shared listing or seller page fetches its public information from our marketplace service.
Security and updates
We use reasonable safeguards, including access controls and encrypted connections. No system is completely secure. We assess suspected breaches and notify affected people and authorities where legally required.
We will publish changes and their effective date here, with additional notice where appropriate. If a new use of your data needs consent, we will ask before starting it.
Contact us
For privacy requests or complaints, contact our Data Protection Officer at dpo@mopy.studio. For general support, email support@mopy.studio. Include your account email and what you need help with. Do not send passwords, OTPs or identity documents in your initial email.
If we cannot resolve your privacy concern, you may contact Singapore's Personal Data Protection Commission.