Security

Plain answers to the questions people ask most about their data on Now I’m Open.

Where does my data live?

In a database run by Supabase in its Singapore region. The website is served by Vercel. Both process data for us under contract, and neither may use it for their own purposes.

How is it protected?

• Encrypted in transit: every page and request uses HTTPS.
• Encrypted at rest: our database and file storage provider encrypts stored data on disk.
• Access rules in the database itself: the database uses row-level security, so it only returns what you’re allowed to see, such as your own chats, or cards from people who chose to be seen by you.
• Photos are private files: they’re served through short-lived signed links to signed-in members only, never to visitors or on public share pages.
• No passwords to leak: you sign in with an email code, a magic link or Google, so we never store a password.
• Staff access: only our admin team can review reports and verification selfies, and every report is read by a person.

What about my location?

If you tap “Use my location”, your position is used once to find the nearest area and then discarded. We store and show only the area, such as “Tiong Bahru”, never coordinates or distances.

How long is data kept?

• Travel check-ins expire on their own and are deleted within 72 hours.
• Verification selfies are deleted once they’ve been reviewed. We keep only the result.
• Cards close when they expire. You can close or delete them any time.
• Ask us to delete your account and we do it within 30 days, usually much sooner. Pausing is instant.

Found a security problem?

Please email hello@nowimopen.com with the details. Don’t test on other members’ accounts. We’ll reply and fix confirmed issues as fast as we can.

More: Privacy policy · PDPA in plain English · Safety