Privacy policy
Karya is a public showcase where builders show what they've made. This page explains what personal data we collect, why, who can see it, and how to get it changed or deleted. We follow Singapore's Personal Data Protection Act (PDPA).
What we collect
- From GitHub, when you sign in: your GitHub username, display name, profile photo, email address, and your public profile details (bio, location, website). We also read your public repositories: names, descriptions, languages, topics, star counts and links. We never read private repositories.
- What you add yourself: your name, headline, bio, city, country, website, your “open to work”, “open to collab” and “hiring” status, contact details you choose to show (LinkedIn link and contact email), projects and screenshots, achievements, certificate files you upload as proof, and short work and education history.
- From the waitlist form: your email, optional GitHub username, and whether you want to show work or hire.
- Help requests and teams: when you offer to help on a project, we keep your request (the role and your short note) and whether it was accepted. When someone adds you to a project team, we keep the invite and whether you confirmed it.
- Reports and blocks: if you report a profile, we keep the report and who filed it. If you block someone, we keep that so they can't send you requests.
- Technical data: sign-in cookies that keep you logged in, and standard server logs (such as IP address and browser type) kept by our hosting providers for security.
- Visit counts: anonymous page-view statistics (which pages are visited, rough country, device type). They use no cookies and can't identify you.
Why we use it
- To build and show your public profile, projects and achievements.
- To let visitors and employers discover builders through Explore and search.
- To verify that you own the GitHub account you sign in with.
- To pass help requests between builders, and show confirmed teammates on projects.
- To email you when someone offers to help on your project, accepts your offer, or adds you to a team. You can turn these off in Edit profile.
- To contact you about your account, the launch, and important changes.
- To keep Karya safe: reviewing reports and removing fake or abusive content.
We don't sell your personal data, and we don't use it for advertising.
What's public
Karya is built for showing your work, so your profile, projects, achievements and uploaded certificates are public and can be found by search engines. Your sign-in email is never shown publicly. If you add a contact email or LinkedIn link, those are shown on your profile so people can reach you; remove them any time. Help requests are private between the two people involved; once a request is accepted, both sides can see each other's contact details. Team members are shown publicly only after they confirm. Blocks are private. Before uploading a certificate, cover personal details such as your NRIC or FIN number.
Who we share it with
We use trusted providers to run Karya. They process data only to provide their service to us:
- Supabase: database, sign-in and file storage (hosted in Singapore).
- Vercel: website hosting and anonymous visit counts.
- Resend: sending Karya's email alerts.
- GitHub: sign-in, and the public repository data we display.
Some of these providers may process data outside Singapore. Where they do, we rely on their contractual and security commitments to protect it to a standard comparable to the PDPA. We may also disclose data if the law requires it.
How long we keep it
We keep your data while your account is active. If you delete your account, your profile, projects, achievements, work and education history, help requests, team memberships, blocks and uploaded files are deleted straight away. Waitlist emails are kept until launch or until you ask us to remove them. Hosting logs are kept for a short time by our providers.
Your choices and rights
- Change your details any time in Edit profile.
- Delete your account from the bottom of the Edit profile page. This is immediate and permanent.
- Ask for a copy of your data, ask us to correct it, remove a waitlist email, or withdraw consent, by emailing hello@karya.sg. We'll reply within 30 days.
You can also revoke Karya's access in your GitHub settings under Applications. Your existing Karya profile stays until you delete it.
Security
Data is encrypted in transit. Access rules in our database mean only you can edit your own profile, and verification status can't be changed by users. No system is perfectly secure, but we'll tell affected users and the authorities as required if a breach happens.
Children
Karya is meant for people aged 13 and over. If you're under 18, please check with a parent or guardian before making your work public.
Changes and contact
If we change this policy in a way that matters, we'll update the date above and tell signed-in users. Questions or requests, including for our data protection contact: hello@karya.sg.