Jalaan

Privacy Policy

Effective 23 October 2026 · Applies to Jalaan at jalaan.tentspark.app

In short
  • You can use Jalaan without an account. Driving data is anonymous.
  • If you sign in with Google, we keep your name, email, profile picture, saved places and a count of verified trips, never your routes.
  • We don't sell your data, show ads or use tracking analytics.
  • You can delete your account and saved places at any time in the app.

1. Who we are

Jalaan ("we", "us") is a navigation app for Malaysia built on open data (OpenStreetMap, MET Malaysia). This policy explains what personal data we process, why, and your rights under Malaysia's Personal Data Protection Act 2010 (PDPA).

2. What we collect and why

DataWhenWhy
Your locationWhen you allow location accessShow you on the map, find places near you, plan routes and guide you. Your device sends your position to our server only when you search, ask for a route, tap the map, load reports nearby, or navigate (below).
Anonymous GPS points while navigatingOnly during turn-by-turn navigation, with the app openMeasure live traffic speeds and improve travel times for everyone. Points are tagged with a random trip ID that changes every 15 minutes, so a drive can't be pieced together, and about the first and last 200 m of each trip are discarded so home and work locations aren't kept.
Hazard reports and votesWhen you report an accident, police, flood, closure, hazard or jam, or vote on oneWarn other drivers. Reports contain the type, location, an optional note and vote counts. They are anonymous and are not linked to your account.
SearchesWhen you search for a placeFind places. Searches are answered by our own search server and are not stored.
Google account details (name, email address, profile picture, Google account ID)Only if you choose "Sign in with Google"Create and identify your Jalaan account.
Saved places (Home, Work, favourites)When you save a place while signed inLet you reach them quickly on any device.
Verified trip countWhile signed in and navigatingUnlock community features (such as adding places) for regular drivers and prevent abuse. While you drive, our server joins your trip pieces in memory to check the trip (at least 3 km and 5 minutes); afterwards it only adds 1 to your count. Your route is never saved to your account.
Technical data (IP address, browser type, error logs)When your device connectsKeep the service working and secure, e.g. limit how many reports one connection can send.

3. What stays on your device

Your language and weather settings, your recent searches and the app's files are stored in your browser so the app works quickly and offline. They are not sent to us. You can remove them by clearing this site's data in your browser settings.

4. How long we keep data

DataKept for
Anonymous GPS points7 days. After that only road speed averages remain (per road, day of week and 15 minutes), which say nothing about any person or trip.
Hazard reportsShown for 20 minutes to 6 hours depending on type; deleted 30 days after they expire.
Account and saved placesUntil you delete them or your account.
Sign-in session180 days, or until you sign out.
Daily trip counts (for the 3-trips-a-day limit)7 days.
IP address for rate limitingUp to 10 minutes, in memory only.
Server error logsUp to 30 days. They don't contain your searches, routes or location.

5. Who else receives data

We don't sell or rent personal data, and we don't share it with advertisers. Map tiles, search, routing and weather forecasts run on our own server. Your device connects directly to these services:

Our server fetches weather data from MET Malaysia and river levels from JPS (both via data.gov.my), satellite flood maps from Copernicus (EODC), and map data from OpenStreetMap sources; no personal data is sent to them. We may disclose data if required by Malaysian law.

6. Live updates

To receive nearby reports and traffic in real time, the app tells our server which area you're in (an area of about 36 km²). This is held in memory only while the app is open and is not stored.

7. Security

All connections use HTTPS. Sign-in uses a secure, HttpOnly cookie, and we store only a scrambled (hashed) form of it. Access to the server and database is restricted to the people who run Jalaan.

8. Your rights

Under the PDPA you may ask to access or correct your personal data, withdraw your consent, or ask us to stop processing it. You can:

Anonymous data (GPS points, reports) isn't linked to you, so we can't find or delete it for a specific person; it is deleted on the schedule above.

9. Children

Jalaan is not intended for children under 13, and children under 13 should not sign in.

10. Changes

If we change this policy, we'll update the date at the top and, for important changes, tell you in the app.

11. Contact

Questions or requests about your personal data: [email protected].