Skip to main content
Strideby Insights2Sign in

Privacy policy

Mark last updated this page on 5 Nov 2026.

Stride is a demonstration build, not a product on sale. Nobody should walk an occupied building with it until a lawyer has reviewed this policy, a data processing agreement exists, and the building owner has completed the assessment described in section 4. Until then this page says what Stride does today, in plain words, so that nobody is surprised.

1. Who we are

Stride is made by Mark Cunningham, trading as Insights² (INSIGHTS-2, a sole proprietorship registered in Singapore, UEN 53523643C), at 21 Hazel Park Terrace, #1-7, Singapore 678946. The same person answers every question about personal data: write to hello@insights-2.com.

Under the Personal Data Protection Act 2012 (PDPA), the organisation that owns or manages the building is the organisation responsible for the photos a walk takes, because it decides to walk the building and why. Stride, and Mark as the person who runs it, process those photos on its behalf as a data intermediary. For the walker’s own account (email address and sign-in records) Stride is the organisation responsible.

2. What personal data Stride collects

From the facility manager who signs in:

  • An email address. Stride signs you in with a six-digit code it emails you. It never stores a password.
  • The building’s name and address, and the floor names you type.
  • Sign-in records. Each time someone asks for a code or types one, Stride logs the email address, the internet address it came from and whether it worked, so that a stranger guessing codes shows up.

From a walk through the building:

  • Photos.The phone takes a photo whenever the view changes, and when you tap “This is an issue”. Before any photo leaves the phone, the phone finds faces and pixelates them. The phone misses some faces, most often those further than about ten metres away or in poor light, so a second check runs on the server (section 6).
  • Voice notes and typed notes. You can record up to a minute of speech about an issue, or type a note. A voice is personal data; Stride keeps the recording so the person who fixes the hazard can hear what you said.
  • Fix photos. A photo of a hazard after someone has fixed it, pixelated on the phone the same way.
  • When and where.The time of each photo and the floor you chose. Stride does not read the phone’s location.

3. Why Stride uses it

  • To find hazards in the photos, such as a blocked fire exit or a trailing cable, and list them for you to confirm or dismiss.
  • To write a report of the walk, which says which floors you walked, what the camera saw, and what you confirmed.
  • To track each hazard until someone has fixed it and someone else has checked the fix.
  • To compare a walk with the walk before it, so a hazard that comes back is named as such.
  • To sign you in, stop abuse of the sign-in form, and keep Claude spending inside the limits set for the account.

Stride never uses photos to monitor people, to judge anyone’s work, or to train an artificial intelligence model.

4. The legal basis

The building owner or manager relies on the legitimate interests exceptionin Part 3 of the First Schedule to the PDPA to take photos in occupied areas without each person’s consent. That exception asks the organisation to decide that the benefit to the public, here the safety of everyone in the building, outweighs any adverse effect on the people photographed, to write that assessment down, and to say that it relies on the exception. Stride gives the owner a printable assessment form and a notice to display in the building before any walk, and asks the walker to confirm both before the first walk.

For the walker’s own account, Stride relies on the walker’s consent, given on the page you see after you first sign in.

5. Who else handles the data

  • Anthropic, United States.Every photo goes to Anthropic’s Claude API for the hazard check, under Anthropic’s commercial terms, which say Anthropic does not train its models on API traffic. Anthropic keeps API inputs for a limited time for abuse checks and then deletes them.
  • Vercel, Singapore.Stride’s server runs in Vercel’s Singapore region, and photos, fix photos and voice notes sit in a private Vercel store in Singapore. Nobody can open a file by its address; Stride streams it only to the signed-in owner of the building, or to someone holding a share link that owner created. Vercel also counts visits to Stride’s pages, as section 10 explains.
  • Neon, Singapore. The database with your account, the building, the walks and the written findings runs in Singapore.
  • Resend. Sends the sign-in code email, reminder emails about overdue fixes and share emails, from stride@insights-2.com.

6. Faces, and the second check

The phone pixelates every face it finds before the photo leaves it. On the server, the same Claude call that looks for hazards also says whether it can still see a face. If it can, Stride deletes the photo and keeps only the text of what it found. If the check cannot run at all, because the monthly limit is spent or the service is down, Stride does not keep the photo either. The only photos Stride stores are ones that passed both checks. Neither check is perfect: in Mark’s own tests the phone found faces reliably within about five metres and missed some beyond ten.

7. Where the data goes outside Singapore

Photos leave Singapore once, to Anthropic in the United States, for the hazard check, and are not stored there beyond Anthropic’s own short retention. Nothing else leaves Singapore. The PDPA allows this transfer where the receiving organisation is bound by terms that protect the data to a standard comparable to the Act; Anthropic’s commercial terms are those terms.

8. How long Stride keeps things

  • Photos, fix photos and voice notes: 24 months from the day they were taken. A daily job deletes anything older.
  • The written findings, the reason a photo was deleted, and the reports: until you delete your account. Singapore's risk-management rules ask for a written record of a hazard check to be kept for three years, which is why the words outlive the pictures.
  • Sign-in codes and links: 15 minutes, and the record of them one day.
  • Sign-in and account logs: as long as Vercel keeps server logs, which is a matter of days.
  • Your account: until you delete it, or until Mark closes the demonstration and deletes every account, with notice by email.

9. Your rights, and how to use them

  • Delete everything yourself.Settings has “Delete my account and every photo”. It deletes the account, the building, every walk, every finding, every photo, every fix photo and every voice note at once. If you have not accepted these terms, Settings is not open to you, so write to hello@insights-2.com and Mark deletes the account for you.
  • Ask for a copy, a correction, or deletion. Write to hello@insights-2.com. Mark answers within 30 days, and sooner for a deletion.
  • If you appear in a photo. Ask the building management office, or write to hello@insights-2.com with the building, the date and the time. Faces are pixelated before Stride ever sees a photo, so there is usually nothing to find, and Stride deletes the photo if you ask anyway.
  • Complain. You can complain to the Personal Data Protection Commission of Singapore at pdpc.gov.sg.

10. Cookies

Stride sets one cookie, which keeps you signed in for 14 days. It holds no tracking. There are no advertising cookies and no analytics cookies. Stride does count visits to its pages with Vercel Web Analytics, which sets no cookie. For each visit it records which page was opened, the country, the kind of device, the browser and the website you came from. It never records your name, your email address, a photo or anything you type, and Stride removes everything after the page name from the address before sending it, so a sign-in link or a share link is never counted. Stride sends nothing for a browser that has switched counting off or that sends the Global Privacy Control signal. Two files come from other companies: the Inter typeface from Google Fonts on every page, and the face-detection runtime from the jsDelivr content network on the walk page. Both companies see your network address when your browser fetches those files, and nothing else. When you share a report by link, the page shows the email address of the person who shared it.

11. Children

Stride is for people who manage buildings at work. Nobody under 18 should sign in, and Stride does not knowingly keep an account for anyone under 18.

12. Changes to this policy

When this policy changes in a way you should read, the date at the top changes and Stride asks every signed-in person to read and accept it again before they carry on.

13. Contact

Mark Cunningham, Insights², 21 Hazel Park Terrace, #1-7, Singapore 678946. hello@insights-2.com.