Data policy

We collect road speeds, not trips.

This describes what Laluan is built to do. Laluan is still in testing and has no public service yet, so test builds only talk to test servers.

What leaves your phone

• Your search text and your route's start and end points, when you search or ask for a route. Our servers need these to answer. We don't tie them to you, because there are no accounts.
• The rough area you are looking at, when you search or view the map. Search sends the map's centre rounded to about 1 km. Map images are requested by area, so whoever serves them can tell which area you are viewing. When you start a trip, your phone also saves the map along the route for 10 days, so it works without signal; whoever serves the map images then sees the route's area at the start of the trip. You can turn this off in Settings (Save maps for trips).
• Road speeds, only from trips you navigate. Your phone sends short batches of time, position, speed, heading and GPS accuracy so we can work out how fast a road is moving. If a batch can't be sent, it waits on your phone and goes out during your next navigation or when you next open the app. Anything still unsent after 24 hours is deleted.

• Alerts you choose to report, such as police, an accident, a closed road or a traffic jam, only during navigation. A report says what it is, where on the road, and which way you were heading. It has no name or account, and its trip ID is separate from the speed data's, so a report can't be linked to your trip.
• The rough area around you, to show alerts, every 15 seconds while you navigate. It's rounded to about 1 km.

What never leaves your phone

• The first and last 500 m or so of every trip, so your home and destination are never sent as speed data.
• Your saved places and your history.
• A photo you choose for your car icon. Only that one photo is shared with Laluan by your phone's photo picker, and it's kept as a small round picture without the photo's location or other details.
• Your location on the emergency screen. It's shown for you to read to the operator, and 999 is called by your phone as a normal call.
• Your routes, to work out tolls. Your phone works out each route's toll from a downloaded list of toll plazas and prices.

What we don't have

• No accounts or logins.
• No device IDs or advertising IDs.
• No analytics SDKs and no Firebase.
• No link between your trips. Each trip uses a new random ID that is never reused.

What we do with speed data

• We don't log IP addresses on speed uploads.
• We delete raw speed reports as soon as they've been turned into road speeds, usually within seconds, and always within 24 hours.
• We keep only speeds per road segment, combined across trips.
• We publish a road's speed only after at least 3 different trips have covered it in the same 15 minutes.

What we do with alerts

• We don't log IP addresses on alerts.
• An alert disappears when it expires or drivers vote it gone: traffic jams after 30 minutes, police after 1 hour, accidents after 2 hours and closed roads after 8 hours, unless drivers confirm it is still there. No alert lasts more than 12 hours.
• To stop one trip voting twice, we keep a scrambled code made from the alert and the trip together. It is deleted with the alert, and it can't link your answers on different alerts.

Where it lives

Routing and speed collection servers are hosted in Malaysia. Map images may be served through a global content network, which sees the requests for them but no speed reports, searches or routes.