gPeta privacy policy

This policy explains what personal data gPeta collects, why we collect it, where it's kept, who can see it, how long we keep it, and what you can do about it.

In short #

• While "Share my trips" is on, gPeta sends your position to our servers in Malaysia every few seconds while your phone is moving in a vehicle and gPeta is running, with or without a route, signed in or not. If you walk off with your phone after parking, the walk can be sent too: for about 5 minutes with gPeta in the background, and for as long as gPeta stays on screen. If you allow location Always, gPeta starts this by itself when you start driving, even if you haven't opened it. It's on when you install gPeta. You can turn it off in About.
• We may keep your trips and data, linked to your account and phone, for as long as we need them to run, diagnose and improve gPeta, including after you remove them from the app or close your account.
• From gPeta 0.3.0, we also keep your phone's identifiers, and we link the phones you use to your account.
• Remove my trip history in About removes your trips from your phone and your account, and Delete account, if you're signed in, closes your account. Neither deletes what our servers hold: we keep it, linked as it was (section 8.3).
• You don't need an account. If you sign in, we ask Apple for your name and email (section 3.4). The app never asks for your phone number or a password.
• We don't sell your personal data, and gPeta shows no ads.
• From version 2026-11-09, we also keep a readable copy of your route requests and trips, with your phone's install id, to improve routing and gPeta and to measure how it's used (section 3.13). We keep it in the same way.
• Our website uses its own first-party cookies, and records how it is used, to understand how gPeta is used and to improve gPeta and our services. It uses nothing from other companies (section 3.14).
• To see or correct your data, to withdraw your consent, or for any other request about it, write to info@mapifytech.com (section 9).

1. Who we are #

gPeta is made by Mapify Technologies Sdn. Bhd. (company no. 202601021283 (1683380-T)), of 58.05, Exchange 106, Tun Razak Exchange, 55188 Kuala Lumpur, Malaysia. In this policy, "we", "us" and "our" mean Mapify Technologies.

We decide why and how your personal data is used in gPeta. That makes us the data controller under Malaysia's Personal Data Protection Act 2010.

You can reach us, and our Data Protection Officer, using the details in section 12.

2. What this policy covers #

This policy covers the gPeta app for iPhone, including test versions on TestFlight, the gPeta servers the app talks to, and our website (section 3.14). You can read it at any time at https://gpeta.dev/privacy, and from About in the app. The welcome screen links to it the first time you open gPeta, and the first time you open a version of gPeta whose terms and policy you haven't accepted (section 3.5).

The app talks only to our servers and to Apple. Apple's own services, such as the App Store, iCloud and your Apple ID, are covered by Apple's privacy policy.

Some parts of this policy start with gPeta version 0.3.0: sharing your trips (section 3.5), your phone's identity and its links to accounts (section 3.6), blocking a phone (section 3.7), and Remove my trip history (section 8.3). Earlier versions don't send trips or register your phone. Spoken report warnings and "Still there?" (sections 3.3 and 3.5) start with gPeta version 0.5.0. Faster-route checks by our server during shared trips (sections 3.2 and 3.5) start with gPeta version 0.7.0. Recording drives with no route (section 3.5), and getting reports and traffic over a live connection (sections 3.2 and 3.3), start with gPeta version 1.2.0.

3. What we collect, feature by feature #

For each part of gPeta, here's what we collect, when, and whether it's up to you.

3.1 On your phone only #

Some data never leaves your phone:

• Saved places, until you remove them.
• Recent places: the 10 places you picked most recently, with their name, address and position. You can remove one, or clear them all.
• Settings, such as the voice language and the traffic layer.
• Search. The map and the phone's own route planning use offline data on your phone, which the app downloads from our servers (section 3.2). Place search uses it too when you have no connection. With a connection, place search asks our server (section 3.2).
• Motion activity, if you allow Motion & Fitness: read on your phone to tell when a drive starts. If you refuse it, GPS speed alone decides.

Your saved places, recent places and your own road reports are included in your phone's backups, if you back up your phone. Those backups are yours, kept on your computer or by Apple in iCloud.

3.2 Planning a route and driving #

When: each time you plan a route, and each time gPeta works out a new route on the way. Needed for routes with live traffic.

The app sends our routing server:

• your starting position, and the direction you're heading;
• your stops and your destination, as points on the map, and whether the destination is a street or a place;
• whether to avoid starting the route inside a tunnel;
• whether to avoid tolls.

The request carries the app's key, which is the same in every copy of gPeta. Once you've accepted this version of the policy, it also carries your phone's install id, the app's version and the version you accepted (section 3.13), and each route plan's requests carry a random id for that plan. A request carries no account, but if you share the trip ("Share my trips"), its plan id links it to the trip, and through the trip to your account if you're signed in. Our server works out your route, and up to two others, with live traffic and sends them back with traffic colours. It keeps a copy of the request and the routes it sent for analysis (section 3.13), and notes which squares of the map those routes pass through (below). If our server doesn't answer, your phone plans the route itself.

When "Share my trips" is on, your route is also recorded as part of your trip (section 3.5).

Faster routes. While you're navigating with gPeta on screen and have at least 5 minutes to go, gPeta checks after each traffic update whether there's a faster route. While "Share my trips" is on, our server makes these checks itself, from your trip (section 3.5): it uses your route and the positions your phone sends, and sends any faster route it finds to your phone through your trip's connection. It records each check, and each faster route it sends, with your trip. At other times, for example with "Share my trips" off or while your trip's connection is down, the app asks our server itself. It sends the same details as a route request, plus the part of your route still ahead. We keep a copy of each of those requests for analysis (section 3.13); while "Share my trips" is on, the faster route the app showed and your choice are recorded with your trip (section 3.5). If there's a faster route, gPeta offers it, and you choose Switch or Keep. gPeta never switches on its own. If a check fails, you see nothing.

Where we fetch traffic. When you plan a route, or gPeta checks for a faster one, our server notes which 1° squares of the map (about 110 km across) the routes it sends you pass through, and those of any faster route it finds. While you drive with "Share my trips" on, it also notes the square you're in and, on a guided trip, those along the rest of your route. It keeps no id or account with them, holds them for about 15 minutes, and uses them only to decide where to fetch live traffic.

Traffic. When the app starts, it fetches its settings from our servers. While gPeta is connected for reports (section 3.3) or for a drive (section 3.5), our server tells your phone, over the same connection, when new traffic is ready. Neither of these carries your location.

Map data. The app downloads its offline map, search and routing data for a region from our own servers, on Amazon Web Services in Malaysia, through Amazon CloudFront, AWS's content delivery network (section 6). The download carries no account and no id.

The city-wide traffic layer is off unless you turn it on. When it's on, the app downloads traffic map tiles for the area on screen, so those downloads show roughly where you're looking. We keep no logs of them.

Our servers record the IP address of each request and connection, with the time and what was asked, and keep it, with your trip records and the analysis copy (sections 3.5, 3.8 and 3.13), for security, to prevent abuse, and to understand how gPeta is used and to improve gPeta and our services. We may use an IP address to work out its approximate location (country, region and city) and the network it belongs to, on our own servers and without sending the address to anyone, for security and to prevent abuse. Downloads through Amazon CloudFront, such as the map data and traffic tiles above, aren't logged.

Searching for a place. When you search for a place with a connection, the app sends your search, and information about your use of it such as your approximate location, the time, your account (if you're signed in) and your phone's identifiers, to our servers. We use it to give you results, and we keep it to understand how gPeta is used and to improve gPeta and our services (sections 3.13 and 4). With no connection, the app searches the offline data on your phone.

3.3 Road reports #

When: each time you report something. Optional. Reporting needs your precise location.

You can report what's on the road: for example, a traffic jam, a camera or a problem with the map.

On your phone, gPeta saves each report: what you reported, the position and direction at the moment you first tapped, how accurate the position was, your speed, the time, and when the report expires. If you were moving slower than 1 metre a second, the direction isn't saved. Your phone keeps each report until you remove it, or for 30 days after it expires.

On our server. If you're signed in, the app also sends each report to our server, with our id for your account, and we note when it arrived. If you're offline, the app tries again later. If you aren't signed in, your reports stay on your phone, and are sent under the next account that signs in on it. Demo reports are never sent.

We keep your speed with the report. Only our moderators see it. We keep it so that our moderators can see the circumstances of a report when they review it, for example whether it was made while driving past.

What other drivers see. Your report appears on every gPeta driver's map, signed in or not. They see a random id for the report, what you reported, where (to about 1 metre), the direction, when it was reported (to the second), and when it expires. It says "Reported by a gPeta driver". They never see who you are, how accurate your position was, or your speed.

Reports about problems with the map aren't shown to other drivers. We use them to fix the map. Reports we've hidden, and reports from blocked accounts, aren't shown either.

Getting other drivers' reports. While gPeta is on screen or you're driving, our server sends reports to your phone over a live connection. To know which, your phone sends the rough map area it's in, a square about 5.5 km across, and the area you're looking at on the map. That carries no account, phone id or install id. Our server holds it in memory while you're connected, and for up to 2 minutes after in case you reconnect, and never writes it to disk, our archive or our logs. Our servers record the connection's IP address and time (section 3.8), never the area. With "Share my trips" off, this is all gPeta sends about where you are. gPeta 1.2.0 and later don't use a public reports file. During a drive with "Share my trips" on, your phone sends those two areas over your trip's connection (section 3.5), which does carry your account or your phone's identity, and they still aren't stored. Route requests (section 3.2), your own reports (above) and your phone's own records (section 3.13) are separate, and those parts say what they send.

Spoken warnings. On every guided trip, gPeta speaks a warning for the reports ahead on your route. On a drive with no route, it speaks a warning for the reports ahead of you in the direction you're heading, while gPeta is on screen or your phone's sound is going to Bluetooth or a car. "Warnings while you drive" in About turns those off. With location Always, they work with your phone locked, even if you haven't opened gPeta; with While Using, only once you've opened it. Your phone works all this out from the reports it already has. Nothing about a warning leaves your phone unless "Share my trips" is on (section 3.5).

"Still there?" While you drive a guided trip with "Share my trips" on, gPeta may ask about another driver's report about 300 metres ahead: "Still there?", with the buttons "Still there" and "Not there". Your answer goes to our server with your trip. The report's author and other drivers never see who answered. For each answer that counts, our server keeps the answer, the report's id and when we counted it, under your account if you're signed in, or under your phone's identity if you aren't (section 3.6). It also keeps a hash of your phone's install id with the report's id, so that one phone counts once, and a count of your answers in each hour: up to 60 answers an hour count.

Our table of answers keeps each answer until 30 days after the report's expiry as your answer left it. Other drivers' later answers can end the report sooner or extend it, but they don't change how long that table keeps yours. It keeps the hourly count until 2 hours after its hour starts. Each is then deleted from that table automatically, usually within a few days. Your answers, and what our server did with each, are also part of your trip record (section 3.5), which we keep as section 8 says.

Not there and Report a problem. On another driver's report on the map, you can tap "Not there" or "Report a problem". gPeta hides the report on your phone, and sends our server the report's id, which you tapped and when, under your account if you're signed in and your phone's identity (section 3.6) if it has one. Our moderators see it with the report, and use it to decide whether to hide the report or block its author. The report's author and other drivers never see who sent it. Up to 20 count each hour; to count them, we keep a counter for each account or phone and hour, which expires 2 hours after that hour starts.

How long reports last. A report shows on the map from 30 minutes (a jam) to 365 days (a camera). Problems with the map last 90 days. When a report expires, or you remove it (section 8.3), it leaves the map, and we keep it on our server (section 8.1). Other drivers' answers can change this. A "Still there" extends a report by its lifetime, counted from the answer. Two "Not there" from different drivers, with no "Still there" between them, end it.

Limits. An account can send up to 20 reports an hour. To count them, we keep a counter for each account and hour. It expires 2 hours after that hour starts, and is then deleted automatically, usually within a few days.

3.4 Your account (Sign in with Apple) #

When: if you sign in. Optional.

You don't need an account. Without one, the app, the map and other drivers' reports all work, and your own reports stay on your phone.

If "Share my trips" is on and you aren't signed in, your trips are kept under your phone's identity instead (section 3.6).

You can sign in with Apple in About. Sign-in is only in About, never while you're driving. When you first sign in, we ask Apple for your name and email address. On Apple's sign-in page you can edit the name or hide your email, and Apple then gives us a private address that forwards to you instead of your own. Signing in gives us no password or phone number.

We use your name and email so that Mapify staff using our moderation tools can identify and contact an account, for example about a block or a request about your data. About shows them to you, and gPeta greets you by your first name. Other drivers, and people watching your Share my drive, never see them. We keep them as section 8 says, including after you close your account. Apple sends your name only the first time you sign in. If you signed in before we began asking, we hold neither, and nothing adds them unless Apple asks you again (below).

When you sign in, we keep:

• Apple's id for you. It's a code that Apple gives us, the same in every app from Mapify. It doesn't show your name or email.
• Your sign-in record at Amazon Cognito, the sign-in service we use: its id and username for you, and your name and email address.
• Our record of you: our own user id for you, your name and email address, when your account was created, and whether it's blocked.

Your phone keeps your sign-in tokens in its Keychain (the iPhone's secure store for passwords and keys), on that phone only. They let the app send reports for your account and, from gPeta 0.3.0, send trips for your account and link your phone to it. They stay if you delete and reinstall gPeta, so you're still signed in after a reinstall. One kind lasts 60 minutes. The one that renews them lasts up to 365 days. Your phone also keeps a copy of your name, your email address and when your account was created in its Keychain, to show in About and to greet you. Signing out is explained in section 8.3.

Sign-in passes through a sign-in page that Amazon Cognito runs for us, which takes you on to Apple's sign-in. The page keeps no cookies after you've signed in.

AWS keeps its own record of each sign-in, renewal and sign-out, with the IP address it came from, for 90 days (section 3.8).

When you use Delete account, Apple asks you to confirm, and gives us a one-time code. We use it to cancel gPeta's access at Apple. We use the code once, and don't store or log it. If Apple doesn't give us a code, we close your account anyway.

If you stop using Sign in with Apple for gPeta in your Apple ID settings, Apple doesn't tell us. Your gPeta account stays open until you close it with Delete account in the app. If you sign out and sign in again after that, Apple asks for your name and email again, and what you share replaces what we hold.

3.5 Your trips #

Trip sharing starts in gPeta version 0.3.0. Earlier versions don't send trips or register your phone.

When: during every drive, with or without a route, while "Share my trips" is on. Optional.

Which trips. While "Share my trips" is on, gPeta records every drive: each guided trip, from when you start a route until you arrive or cancel, and each drive with no route, from when gPeta sees your phone moving in a vehicle until, with gPeta in the background and no car connected, it has stayed still or stopped moving at vehicle speed for about 5 minutes. If you walk off with your phone before then, or with gPeta on screen, the walk can be recorded too. gPeta can't tell who is driving, so a ride as a passenger, on a bus for example, can be recorded. With location Always, this happens in the background without opening gPeta; with While Using, only once you've opened it. While you're parked with gPeta in the background, your phone only watches for the start of a drive, and nothing about where you are now leaves it. While your phone isn't moving, it sends no positions, and our server takes it that you've stopped. Demo drives aren't recorded. We keep drives with no route as we keep trips (section 8), to help us understand how gPeta is used and improve it. In this policy, a "trip" is any drive gPeta records, with or without a route. Trips saved on your phone while you were offline are sent later, when gPeta is running and has a connection, even if you aren't driving then.

Agreeing on the welcome screen. The first time you open gPeta, and the first time you open a version of gPeta whose terms and policy you haven't accepted, a welcome screen says, in English and Bahasa Melayu: "By tapping Continue, you agree to gPeta's Terms of Use and Privacy Policy." It links to our terms and to this policy, in both languages, and has one button, "Continue · Teruskan". When you tap it, you accept our terms, and consent to us using your personal data as this policy describes, including sharing your trips, with your phone's identifiers, as this section describes while "Share my trips" is on. We record the version of the terms and this policy you accepted (they share one version number), and the time on your phone when you tapped Continue. Your phone keeps this record, and sends it with each connection to our trip service, so it's kept in your trip record. Your phone registers with our servers (section 3.6) only after you tap Continue, whether "Share my trips" is on or off, and sends trips only after you tap Continue and while "Share my trips" is on. If you delete and reinstall gPeta, the welcome screen shows again. "Share my trips" is in About. It's on when you install gPeta. You can turn it off in About at any time.

If you're signed in, your trips are kept under your account. If you aren't, they're kept under your phone's identity (section 3.6).

What we record:

• Your position, every second while you're moving: latitude and longitude, the time, your speed, your direction of travel, and how accurate the reading was. We record it exactly as your phone measured it, not matched to the road. The app sends it in batches every 5 seconds, or every 15 seconds in Low Power Mode. While your phone isn't moving, it sends none, except its latest position if it has to reconnect, so that our server knows where you've stopped. If you drive without a signal, the trip waits on your phone, and is sent later.
• Your route, on a guided trip: the part still ahead, your remaining stops and your destination as points on the map, whether the destination is a street or a place, and whether to avoid tolls. It's recorded at the start, each time gPeta works out a new route, when you switch to a faster one, and after a reconnection. We don't record the destination's name.
• Whether gPeta is on screen or in the background, at the start and whenever it changes.
• When your phone stops moving and starts again during a drive, so that a stop can be told from a lost signal.
• The road reports along your route that we sent your phone during the trip, and when (below).
• Spoken warnings and "Still there?": each report warning your phone spoke (the report's id, kind and type, the voice clip, how far ahead it was, and whether the report was your own or came from our server), each "Still there?" card your phone showed, your answers, and what our server did with each answer.
• Faster routes: each check our server made for a faster route during the trip (when it was made, how far along your route you were, what it found, and the travel times and traffic it compared), each faster route it sent your phone, whether your phone showed it and, if not, why, and for each offer your phone showed, whether you chose Switch or Keep, let it time out, or it went away, for example because you left the route.
• The start and end of the trip: the app's version at the start, and whether it's a guided trip or a drive with no route. At the end, how the trip ended (you arrived, you cancelled, you parked, a guided trip took over from a drive with no route, it stopped, for example because you signed out, or it was cut short because the app closed) with the distance and time driven.
• Each connection to our servers for a trip, including the ones that send saved trips: a random trip id (new for each trip, and not your account id), your user id if you're signed in, your phone's device id and identifiers (section 3.6), the app's version, your IP address, and when the connection opened, when it closed, and why.
• Facts about your phone, each time it connects for a trip and, from gPeta version 1.2.6, each time it registers with our servers or renews its identity (section 3.6): information about your phone and how it's set up and used, such as the network type (Wi-Fi, mobile data or other), the phone model, the iOS version, your language and region setting, your time zone, whether Low Power Mode is on, the location permission you've given gPeta (precise or approximate, and Always or While Using) and, from gPeta version 1.2.7, whether it's connected to CarPlay, where its sound is playing, whether it's charging and whether iOS reports its screen as locked. During a trip, those last four are also recorded whenever they change. If the phone can't read one of these, it's left out. We record them as they are, and don't combine them into an identifier. With each connection, your phone also sends the version you accepted on the welcome screen, and when you tapped Continue.

Your IP address is kept with your trip records, in our gateway, firewall and connection logs (section 3.8) and in the analysis copy (section 3.13). AWS's record of sign-ins holds the IP address of each sign-in (section 3.8).

Your trip list. For each trip, we keep an entry with the trip id, its start and end times, and where it sits in the archive, so that we can find your records.

The trip archive. Each record is encrypted before it's stored in our trip archive in Malaysia: with your account's key if you're signed in, or your phone's key if you aren't (section 8.2). After 2 to 3 days, records move to long-term storage. They never expire.

On your phone. Until our server confirms it has a record, the record waits in a queue on your phone. The queue isn't included in your phone's backups. It holds up to 30 days or 200 MB of trips. Past that, the oldest trip is dropped. Your phone also remembers which reports you answered, for 30 days, so that it doesn't ask you again. This isn't in your phone's backups either, and it goes when you remove your trip history or close your account.

Live reports on your route. While you drive a guided trip with "Share my trips" on, our server checks the road reports along your route, and sends the ones ahead of you to your phone, through your trip's connection. To tell which are ahead, it uses your route and the positions your phone sends. As those reports change or are removed, and as new ones appear, it sends the changes too. Reports along your route are recorded: it keeps a record of which it sent your phone, and when, with your trip, as part of your trip record, and that record is kept like the rest of your trip (section 8). Reports for your area (section 3.3) aren't recorded, per driver.

Share my drive. While you drive a guided trip with "Share my trips" on, you can tap Share my drive. "Share my trips" must be on: without it, nothing streams and you can't share. Our server then makes a link, https://share.gpeta.dev/ followed by a random code. You send the link yourself, in any app you choose.

• What the link shows. Your car's position, its heading, your estimated arrival time and the rest of your route, to where it ends, so the people watching can tell where you're going. Your position is updated every 5 seconds while you're moving (every 15 seconds in Low Power Mode) until the share ends, and your route each time it changes, for example when you take another route. While you're stopped, the link shows where you stopped. Your phone works out the arrival time and sends it to us. Our server takes the route from your trip: your phone sends nothing more for it. No place name or address is sent: the route ends on the road at your destination. The link doesn't show your speed, or the road you've already driven.
• Who can watch. Anyone who has the link, with no account and no sign-in. Up to 10 people can watch a share at once, in gPeta or in a web browser. Anyone you send the link to can pass it on, so send it only to people you trust.
• When it ends. When you tap Stop sharing, when your trip ends, when you remove your trip history or close your account, or when gPeta loses touch with your phone for about 15 minutes. A link that has ended shows nothing.
• What we keep. The link's hash (a one-way fingerprint of the code, so the code itself is never stored); how many people watched, when, and whether each watched in gPeta or a web browser; and the share's start and end. We keep nothing about a viewer with the share: no name, no IP address and no device details. Like every connection to our servers, a viewer's is logged with its IP address and what the app or browser sends about itself (section 3.8), never the link's code. The share's start and end are kept with your trip, as part of your trip record (section 8).
• You see who's watching. gPeta shows you how many people are watching.

What we do with your trips today. We keep your trips in the archive, and use your route and positions during a trip to send you the reports ahead of you (above), and to check for faster routes (section 3.2). We keep drives with no route to help us understand how gPeta is used and improve it (section 4). When you answer "Still there?", your answer can extend or end the report for every driver (section 3.3). Otherwise, your trips don't yet change what the app shows you. Section 4 explains why we read the archive, and what we plan.

3.6 Your phone's identity, and links between phones #

Phone registration starts in gPeta version 0.3.0. Earlier versions don't register your phone. Until the version that asks you to accept this policy, your phone registered only while "Share my trips" was on. From that version, it registers whether "Share my trips" is on or off.

When: only after you've tapped Continue on the welcome screen (section 3.5). Then: when gPeta starts, comes back on screen or gets a connection, and when your phone renews its identity, which also happens when you sign in or close your account. Needed to share trips without signing in, and for your phone's own records (section 3.13).

So that you can use gPeta without an account, your phone gets its own identity on our servers. Your phone registers only after you've tapped Continue on the welcome screen (section 3.5): as soon as you tap it, if it can reach our servers, and again when gPeta starts, comes back on screen or gets a connection.

Our server then gives your phone a pass that lasts 1 hour, and the phone renews it. Each renewal sends a new App Attest check and a DeviceCheck token, and updates when we last saw your phone. The pass carries your phone's device id, not your account. The phone keeps the pass only in memory, and keeps its device id and key id in its Keychain, on that phone only.

"Share my trips" decides only whether your trips are sent. With it off, your phone still registers and renews its identity as above, sends its own records (section 3.13), and signing in still links it, with its earlier installs, to your account.

If your phone can't use Apple's App Attest, it sends trips only when you're signed in.

What we keep about your phone:

• App Attest key. Your phone makes a key, and Apple's App Attest service confirms that it belongs to a genuine copy of gPeta on a real Apple device. Apple sees the app and the device, never your location. We keep the key's id, its public part and a counter, and we check the key each time your phone renews its pass.
• Install id. gPeta makes a random id the first time it runs, and keeps it in your phone's Keychain, on that phone only. It's never synced. It stays when you delete and reinstall gPeta. We never change it, even after you remove your trip history.
• Vendor id (Apple's "identifierForVendor"): an id that Apple gives to one developer's apps on one phone. If iOS doesn't give one, we go without.
• DeviceCheck. Apple stores two yes-or-no values about your phone for us: whether it has used gPeta before, and whether we've blocked it. Your phone gives our server a DeviceCheck token when it registers and renews, and our server passes the token to Apple. Apple keeps the two values even if you reinstall gPeta or your Keychain is wiped. Removing your trip history or closing your account doesn't change them. We keep Apple's "used before" answer, and whether we've checked with Apple.
• Your phone's record: an id, the platform, the kind of check used, when the record was made, when the phone last registered or renewed, whether it's blocked, the identifiers above and, from gPeta version 1.2.6, the facts about your phone (section 3.5) it sent when it last registered or renewed, whether or not "Share my trips" is on. We also keep each of those in the analysis copy (section 3.13), to understand how gPeta is used and to improve gPeta and our services. Each time you reinstall gPeta, a new record is made with the same install id.

How we link phones and accounts:

• We recognise records with the same install id or vendor id as the same phone.
• When you're signed in, we link your account to your phone's record, and to every other record of the same phone. This happens when your phone registers while you're signed in, when you sign in, and each time your phone connects to our trip service while you're signed in, including to send saved trips. For each link, we keep when it was first made and when it was last seen.
• One phone can be linked to several accounts, and one account to any number of phones.
• Signing out doesn't remove a link. Only Remove my trip history on that phone, or closing the account, removes it. We keep a removed link, with when it was removed, so the trips stay linked (section 8.3).
• Your record is your own trips, plus the trips made without signing in on every phone linked to your account, including trips made after you've signed out.
• So, on a shared phone: if someone signs in to gPeta on a phone you've used without signing in, the trips you drove on it become part of their record too. The same goes the other way round.

3.7 Moderation and blocks #

Our moderators can hide a report, and block an account, a phone, or an account with all its phones.

• A hidden report, and every report from a blocked account, is taken off other drivers' maps.
• A blocked account can't post reports or share trips: a block reaches a trip in progress within about an hour. It can still sign in, to remove its reports and close the account.
• Blocking a phone covers every install of gPeta on it, and sets Apple's DeviceCheck "blocked" value, so the block survives deleting and reinstalling gPeta, resetting the phone, and passing it to someone else. A new account signed in on a blocked phone starts out blocked.
• When a blocked account is closed, we keep a hash of its Apple id (a scrambled form that we can match against later) and the time of the block. If the same Apple ID signs in again, the new account is blocked too. A block of a closed account also blocks the account its Apple ID uses now.
• When a blocked phone's records are removed, we keep a hash of its install id and the time of the block, in the same way, so the phone's next record is blocked too.
• When we lift a block, we delete the block hash. For a phone, we then keep a different hash of its install id, with the time we lifted the block, until our server clears Apple's DeviceCheck "blocked" value, which happens the next time the phone renews its identity, or until the phone is blocked again.

Blocks are made by our moderators. A new account on a blocked phone is blocked automatically. If you think a block is wrong, write to us at info@mapifytech.com (section 12). We'll tell you why we made it, and look at it again. If you got your phone from someone else and find it blocked, write to us too. If the block wasn't about you, we'll lift it.

3.8 Logs, counts and backups #

• Request logs. Our servers write one line for each request: the kind of request, the web address it asked for, the result, and how long it took. They never hold the content of the request, a position or a token. A web address can include a report's id, for example when you remove a report. When our moderators look at or act on an account or phone, the log holds that account's or phone's id. We keep these logs for 1 month.
• Gateway logs. The front door to our servers logs each request: its IP address, the time, the kind of request (never the full web address), the result, timings, our firewall's verdict and how the app or browser describes itself (its user agent). No other header, no content and no token. We keep them as long as we need them, for security and to prevent abuse (section 8).
• Trip service logs. Start-up, refused connections with the reason code, and errors, with no ids, positions, IP address or phone facts. We keep them for 1 month.
• Archive delivery errors are logged for 1 month. A record that failed to deliver stays in the archive, encrypted like the rest.
• Counts. Our metrics hold counts only, such as how many requests we handled.
• Connection limits. Our firewall screens connections to the trip service, and the live connection for reports (section 3.3), with AWS's standard rules, and allows up to 20,000 new connections from one IP address in 5 minutes. Another firewall allows up to 20,000 requests to our servers from one IP address in 5 minutes.
• Firewall and connection logs. Our firewalls log each request they screen, allowed or blocked: its IP address and the country it's in, the time, the web address without anything after a ?, its headers with your sign-in, app key and device tokens taken out, details of how it connected, and the verdict. The trip service also logs each connection: its IP address and port, the time and how it was encrypted. We keep these logs as long as we need them, for security and to prevent abuse (section 8).
• AWS's record of sign-ins. AWS keeps a record of calls to Amazon Cognito, including signing in, renewing your sign-in and signing out, with the IP address they came from, in our AWS account's event history for 90 days.
• What we don't log. We don't keep records of who downloads files, and we don't copy out our database's own logs.
• Backups. Our database (accounts, reports, phone records, links and archive keys) is backed up automatically, and can be restored to any point in the last 35 days. Our trip list can also be restored for 35 days. So can our table of answers and hourly counts (section 3.3). If we replace or move our database, we keep a final copy of it.

3.9 TestFlight builds #

If you test gPeta through TestFlight.

Test versions, and the copy that Apple reviews, have a developer mode. Its trip recorder, "Record trips", is on by default. For each trip, it saves a file on your phone with:

• the destination's name and position;
• every position reading, with its accuracy, altitude, speed and direction;
• the route requests and answers;
• your phone model, iOS version, and language and region setting;
• app events, including trip service events.

For testing, developer mode can also export a sample of the App Attest check.

The recorder keeps the newest 20 real trips and 5 demo drives, for up to 30 days. These files aren't in your phone's backups. They leave your phone only if you share them yourself. You can delete one, delete them all, or turn recording off. If you install a version of gPeta without developer mode, the files are deleted when it starts.

Developer mode also has "Route on this device only", which plans routes on your phone without asking our server. While it's on, trips aren't sent.

If we invited you to test by email, we have the name and email address we invited. Through TestFlight, Apple also shows us when you installed each test version, how often you opened it, and any crash reports and feedback you send us, with your phone's model and iOS version.

3.10 Where the data comes from #

• From your phone: positions, phone facts and identifiers.
• From you: your reports, your destinations and stops, your settings, and any message you send us.
• From Apple: your Apple id when you sign in, your name and email address when you first sign in, App Attest's confirmation that your copy of gPeta is genuine, the DeviceCheck values, and TestFlight details, crash reports and feedback, if you share them.
• From other phones linked to your account: the trips they made without signing in, which join your record (section 3.6).

3.11 What we don't collect or do #

• The app doesn't ask for your phone number or a password, and you never type your name or email into it. Only Apple's sign-in page asks for them (section 3.4).
• We don't use advertising ids, or your phone's UDID, serial number, IMEI or MAC address. We don't use the phone facts in section 3.5 to work out which phone you're using. We recognise your phone only by the identifiers in section 3.6.
• gPeta has no ads and no ad code. It has no analytics, crash-reporting or remote-logging code from other companies. It sends gPeta's own servers the headers and records in section 3.13, and nothing to anyone else.
• We don't combine your data with data from other companies' apps, and we don't use it for advertising.
• gPeta doesn't send push notifications.

If you've chosen in your iPhone's settings to share analytics with app developers, Apple sends us gPeta's crash reports and usage figures. They don't tell us who you are. Apple also gives us figures about how people find and download gPeta on the App Store, such as page views and downloads by source and campaign. They don't tell us who you are either.

3.12 When you write to us #

If you email or write to us, we keep your message, your email or postal address, and anything you send to show the request is yours, so that we can answer you and keep a record of what we did. We keep them for as long as we need them for that.

3.13 Route requests and trips kept for analysis #

When: once you've accepted version 2026-11-09 of the policy, or a later one, by tapping Continue. Older versions of gPeta, and phones that haven't accepted it, send nothing of this and aren't kept.

So that we can improve routing and gPeta, and measure how it's used, we keep a readable copy of:

• Each route request and the routes we sent back: your starting position and direction, your stops and destination as points on the map, the options asked for, and the routes, with their steps and lines on the map, travel times and traffic. This covers planning a route, working out a new route, the app's check for a faster one, and our own faster-route checks during a shared trip (section 3.2). We keep it with what the request carries: your phone's install id, the app's version and the policy version you accepted (section 3.2). Each route plan's requests carry a random id for that plan: if the trip is shared ("Share my trips"), that id links them to the trip, and through the trip to its account. Our own checks during a shared trip are also kept with your phone's device id and our id for your account if you're signed in, so that they're linked to your trip.
• Copies of your streamed trips, when "Share my trips" is on: the records in section 3.5 (positions every second while you're moving, routes, on-screen state, when your phone stops and starts moving, spoken warnings and "Still there?" cards, faster-route checks and offers, the start, end and arrival times of each Share my drive, and the start and end of the trip), with your phone's install id, its device id (section 3.6), our id for your account if you're signed in, the app's version and the phone facts in section 3.5. These copies are readable. The encrypted trip archive in section 3.5 is kept as it is.
• The roads a trip drove: at the end of a trip, our server matches its positions to the map's roads, and keeps the road ids and names, the distance on each and the times.
• Records your phone sends itself, whether or not it streams the trip: when it plans a route on the phone (where it answered, why it didn't use our server, the distance, the time and the route's line) and which route option you drove. We keep them with your phone's install id, its device id and the app's version.
• Your place searches: what you searched for, your approximate location, the time and the results we gave, with your phone's identifiers and our id for your account if you're signed in.
• The IP address of each request and connection above, as our servers received it, so that each is linked to the phone and the account behind it.

Your phone sends its install id, the app's version and the policy version you accepted with each request to our servers, and its own records go to our servers, at POST /v1/events. Nothing goes to anyone else. We don't keep your name or your email in this copy, but your positions and identifiers can show where a phone has been, so we treat the copy as personal data.

What we use it for. To improve routing and gPeta, and to measure how it's used (section 4).

Who can read it. Mapify staff who analyse gPeta, and our Data Protection Officer, through a staff sign-in with a second step (section 7).

How long. As section 8 says: for as long as we need it, including after you remove your trip history or close your account. Neither takes you out of this copy.

3.14 Our website #

Our website, at https://gpeta.com and https://gpeta.dev, uses its own cookies, and records how it is used with its own code. It uses no cookies, code or services from other companies, and it has no ads.

• Cookies. The site sets these cookies, for its own address only:

  • gp_vid: a random identifier for your browser, kept for 13 months;
  • gp_sid: a random identifier for your visit, which ends after 30 minutes without opening a page;
  • gp_cmp: the campaign or campaign link that first brought you to the site, if any, kept for 30 days;
  • gp_notice: that you've closed our cookie notice, kept for 13 months.

  The site sets them from the first page you open, and shows a notice about them. You can delete or block them in your browser's settings. The site still works without them, and then records nothing about your visit.

• What the site records. When you open a page, tap a link to the App Store, or open one of our campaign links, the site sends our servers: the cookies' identifiers, the page's address without anything after a ?, the site and page that sent you to us (also without anything after a ?), the campaign details in the link you followed (its utm_ values, or our campaign link's name), the page's language and your screen's size. Our servers keep each with the IP address it came from, as they keep every request's (section 3.8).

• What we use it for. To understand how gPeta is used and to improve gPeta and our services, including learning which pages, links and campaigns bring people to gPeta (section 4).

• Who can read it. Mapify staff who analyse gPeta, and our Data Protection Officer, through a staff sign-in with a second step (section 7). The site sends nothing to anyone else.

• How long. As section 8 says: for as long as we need it.

4. Why we use it #

• To plan your route with live traffic, and to offer faster routes: route requests, faster-route checks, the map squares that decide where we fetch live traffic (section 3.2), and, while "Share my trips" is on, your route and positions during a trip (section 3.5).
• To show road reports to every driver, and to fix the map: your reports (section 3.3). We keep your speed at the moment you report so that our moderators can see the circumstances of a report when they review it, for example whether it was made while driving past.
• To run your account and let you sign in (section 3.4).
• To identify and contact an account: your name and email address (section 3.4). Mapify staff use them when handling moderation and support, and About shows them to you.
• To keep your trip history. We keep your trips in our archive (section 3.5). We read the archive to:
  • answer your request to see your data;
  • deal with a dispute or a support case;
  • answer a request from the authorities.
• To send you the reports ahead on your route while you drive with "Share my trips" on: your route and positions, and the record of the reports we sent you (section 3.5).
• To show you the reports around you, and to warn you about reports ahead when you drive with no route: the rough map area and the area you're looking at on the map, which we don't store (section 3.3). Your phone works out the warnings from the reports it already has.
• To keep road reports up to date: asking you whether a report ahead is still there, and using your answer, with other drivers', to extend or end it for every driver (sections 3.3 and 3.5). The hash of your phone's install id makes one phone count once.
• To let others follow your drive, when you tap Share my drive: your car's position, heading and estimated arrival, and the rest of your route to where it ends, sent to the people who have your link (section 3.5).
• To recognise your phone, so that you can share trips without an account, and to link your phones to your account (section 3.6).
• To stop misuse: checking that the app is a genuine copy of gPeta (App Attest), limiting reports and connections, keeping blocks in place across accounts, phones and reinstalls (DeviceCheck and the hashes in section 3.7), and recording the IP address of each request and connection to our servers, and working out its approximate location and network, to find and stop abuse and attacks (sections 3.2 and 3.8).
• To keep the service running, and fix problems: logs and counts (section 3.8), and the crash reports and usage figures Apple sends us (section 3.11).
• To test gPeta: developer-mode files in TestFlight builds, which stay on your phone unless you share them, and what Apple shows us about tests (section 3.9).
• To answer you: the messages and requests you send us (section 3.12).
• To improve routing and gPeta, and to measure how it's used: the readable copy of route requests and trips in section 3.13. We may show partners such as Amazon Web Services and government bodies aggregate statistics only: counts, roads and areas, never a person or a phone.
• To understand how gPeta is used and to improve gPeta and our services: what our website records (section 3.14), and the App Store figures Apple gives us (section 3.11).
• To help us understand how gPeta is used and improve it: your drives with no route, while "Share my trips" is on (section 3.5). We keep them as we keep trips (section 8).

What we plan. We also keep your trips for features we're building:

• working out traffic from gPeta drivers' trips.

This is not in gPeta yet. Before it starts, we'll update this policy (section 13).

5. What you must give us, and what happens if you don't #

• Location. gPeta needs your location to guide you. Without location permission, it can't guide you or warn you, and the map shows reports only for the area you're looking at. With While Using, gPeta uses your location once you've opened it, and for the rest of that drive if you then leave it. With Always, it also notices by itself when you start driving, without your opening it: it warns you about reports ahead and, while "Share my trips" is on, records the drive. Reporting needs your precise location. With approximate location, gPeta can't record your drives or warn you.
• Route requests are sent each time gPeta plans a route. Outside TestFlight builds, there's no setting to stop them. If our server can't be reached, your phone plans the route itself, without live traffic.
• An account is up to you. Without one, the app, the map and other drivers' reports all work, and your own reports stay on your phone. If you sign in, you can edit your name or hide your email on Apple's sign-in page.
• Reports are up to you.
• Your trips are up to you: turn "Share my trips" off in About. No new trips are recorded then. gPeta guides and warns you the same way with it off. Our server sends you the reports along your route only while it's on (section 3.5), but it sends you the reports around you either way (section 3.3). With it off, your phone still sends the rough map area (section 3.3), registers with our servers and renews its identity, sending the facts about your phone (section 3.6), and signing in still links it, with its earlier installs, to your account (section 3.6). When you share trips, your position readings, route, phone facts, IP address and phone identifiers (sections 3.5 and 3.6) go with them, signed in or not. You can't share trips without them.
• Your phone's identity is needed to share trips without signing in. If your phone can't use App Attest, trips are shared only when you're signed in.
• Apple's code, when you use Delete account, is up to you. We close your account without it.

6. Where we keep it #

We keep your data on our own servers in Malaysia. They run on Amazon Web Services (AWS), in its Asia Pacific (Malaysia) region, ap-southeast-5. That's where our databases, trip archive and logs are.

Some data passes through other places:

• Amazon CloudFront. The traffic map tiles, the offline map downloads and the sign-in page reach your phone through CloudFront, AWS's worldwide delivery network. Your phone may connect to a CloudFront server outside Malaysia. We keep no CloudFront logs. Your name and email pass through it when you sign in and each time your sign-in renews: from Apple to Amazon Cognito the first time, and in the sign-in tokens Amazon Cognito sends your phone.
• Apple runs Sign in with Apple, App Attest, DeviceCheck and TestFlight, and may handle that data outside Malaysia.
• Your phone's backups, if you back up to iCloud, are kept by Apple.

7. Who we share it with #

We don't sell your personal data.

We share it only with:

• Other gPeta drivers: the report details in section 3.3, without who made them. Getting them needs no account or key, so we can't tell a driver from anyone else who connects.
• Apple, for:
  • Sign in with Apple: signing in, and cancelling gPeta's access when you close your account;
  • App Attest: your phone's key. Apple sees the app and the device, never your location;
  • DeviceCheck: your phone's token. Apple keeps the two values in section 3.6.
• AWS, which runs our servers and stores our data for us. AWS handles this data only on our instructions, under its data processing terms, which require it to keep the data secure.
• The authorities, such as the police, a court or a regulator, when the law requires or allows it: for example, to prevent or investigate a crime. We may read your trip records to answer such a request.
• A company that takes over gPeta, if that happens. At least 30 days before we transfer your data to it, we'll post a notice at https://gpeta.dev/terms, and show it in the app when you update gPeta (terms of use, section 17). It must use your data only as this policy describes, and your rights under this policy stay the same.

Aggregate statistics. We may show partners such as Amazon Web Services and government bodies statistics made from the analysis copy (section 3.13): counts, roads and areas. They never identify a person or a phone, and we don't give any partner the copy itself.

Inside Mapify, Mapify staff who handle gPeta's moderation and support can use our moderation tools. With them, they can see:

• every report, including hidden, expired and removed ones, with its account id, accuracy, speed and exact position;
• the list of accounts: our id for each, its name and email address, when it was created, whether it's blocked, and when it was closed (never your Apple id or Cognito id);
• a phone's identifiers (including its App Attest key id, install id and vendor id), the accounts linked to it, with their names and email addresses, and the same phone's other installs, with when a record or link was removed (never its public key);
• how many trips, position readings and records an account or phone has in the archive. To count the recent records, the tool decrypts them. Records in long-term storage are counted without being opened. If we need to read a record in long-term storage, we restore a copy of it, and the copy is kept for 7 days.

Every action in the moderation tools is logged.

Mapify staff who analyse gPeta, and our Data Protection Officer, can read the analysis copy of route requests and trips (section 3.13) in our dashboards and queries. They sign in separately from the moderation tools, with a second step, and a smaller group sees aggregate figures only. Your name and email aren't in what they read.

Mapify engineers who run gPeta's servers, and our Data Protection Officer, can decrypt and read trip records, positions included, when they handle the purposes in section 4 (your requests, disputes and support cases, and requests from the authorities).

Nobody else gets your data. Our live traffic comes from HERE: our servers send HERE an area of the map and our key, never anything about you or your trips.

8. How long we keep it, and what removing does #

We may keep your trips and data, linked to your account and phone, for as long as we need them to run, diagnose and improve gPeta, including after you remove them from the app or close your account. Removing something in the app takes it out of what the app and other drivers see. It doesn't delete it from our servers. To ask about erasing data, write to us (section 9.3).

8.1 How long we keep it #

8.2 How your trips are locked #

Each account, and each phone used without signing in, has its own encryption key. A phone's key is made when it registers with our servers. An account's key is made the first time it connects to our trip service. Every trip record is locked with the key of the account it was made under or, without an account, the key of the phone, before we store it. So a phone's key locks every trip made on that phone without signing in, whoever drove.

We keep each key for as long as we keep the trips it locks, including after you remove your trip history or close your account, so that we can still read those trips for the purposes in section 4. Removing your trip history or closing your account makes no new key for those records, and new trips from that phone or Apple ID are locked with a new one.

If you remove your trip history or close your account while a trip is being sent, the trip stops being sent within seconds, and what had reached our servers is kept. Your phone also drops its queue of unsent trips for that account or phone.

8.3 What each button does #

Remove a report, or Remove all reports. Use a report's card, or About. This removes the report from your phone at once. If it was sent, and you're signed in and online, it's also marked removed on our server at once, and it disappears from other drivers' maps within about a minute and a half. A phone that's offline keeps showing the reports it last received. If you're offline or signed out, your phone keeps a marker of the report, without its position, and removes it on our server the next time it's online and signed in. Until then, the report stays on other drivers' maps until it expires. We keep a removed report on our server, with when you removed it (section 8.1), and its id can stay in our request logs for 1 month.

Remove my trip history. This is in About, shown only when you aren't signed in. It marks every record of your phone that has its install id removed, including earlier installs of gPeta, with their links to accounts. The next time your phone registers, it gets a new record and a new key, with the same install id, and the removed records are never linked to an account again. A trip being sent stops, and a Share my drive link ends. Your phone drops its queue of unsent trips, and the reports it remembers you answered.

We keep the removed records, their keys, links and trip lists, the trips they lock, your answers to "Still there?" and the analysis copy (section 3.13), linked as they were, as section 8 says.

It doesn't remove:

• trips you made while signed in. Those are your account's: Delete account closes it;
• records of your phone that share only its vendor id, not its install id. To ask about those, write to us (section 9.3);
• the install id on your phone;
• a blocked phone's hash, or the DeviceCheck values at Apple;
• your phone's ids in our moderation logs, which we keep for 1 month.

Delete account. This is in About, and Apple asks you to confirm. It closes your account, at once:

• it ends your sign-in: Amazon Cognito deletes your sign-in record, and gPeta's access at Apple is cancelled;
• it marks our record of you closed, and keeps it, with Apple's id for you, your name, your email address and your Cognito sign-in id, so that the data it holds stays linked to you. If you sign in again with the same Apple ID, you get a new account, and the closed one stays closed;
• your reports leave other drivers' maps, and stay on our server;
• every phone record linked only to you is marked removed, with its links, as Remove my trip history does;
• a trip being sent under your account stops, and a Share my drive link ends.

We keep your name and email address, your trips, your archive key, your trip list, your reports, your answers to "Still there?", the phone records and their links, and the analysis copy (section 3.13), linked to the closed account, as section 8 says.

Your phone drops its queue of your unsent trips, and its copy of your name and email.

It doesn't remove:

• reports saved on your phone. Remove them with Remove all reports, or delete the app;
• a phone that's also linked to another account. That phone stays as it is, and only its link to you is marked removed. To remove the trips made on that phone without signing in, use Remove my trip history on that phone while signed out;
• the hash of your Apple id, if your account was blocked, or a blocked phone's hash;
• report ids in our request logs, and the ids of your account or phones in our moderation logs, for 1 month;
• the DeviceCheck values at Apple, or the install id on your phone.

If our call to Apple fails, your account is still closed.

Sign out. This asks Amazon Cognito to cancel your renewing token, and deletes your sign-in tokens from your phone. It also removes the copy of your name and email from your phone. If your phone is offline, the tokens are only deleted from the phone. It doesn't delete anything on our servers, and your phone stays linked to your account, so trips made on it later without signing in, by you or anyone else, still become part of your record. A trip in progress under your account ends.

Turning off "Share my trips". This deletes nothing, and no new trips are recorded. gPeta still sends the rough map area, to get you reports (section 3.3). Signing in still links your phone to your account (section 3.6). Trips that haven't been sent yet wait on your phone, for up to 30 days, and are sent if you turn it back on.

Deleting the app. This removes your saved places, recent places, settings, reports on your phone, the trip queue and any developer-mode files. It leaves the Keychain items, including your sign-in tokens, the copy of your name and email, and the install id. It also leaves the DeviceCheck values at Apple, and everything on our servers.

9. Your choices and rights #

9.1 Choices in the app #

• Share my trips (About): turn it off to stop recording new drives, with or without a route.
• Remove my trip history (About, when you aren't signed in).
• Delete account (About).
• Sign out (About).
• Remove a report on its card, or Remove all reports in About.
• The traffic layer button: off unless you turn it on.
• Warnings while you drive (About): on unless you turn it off. It turns off the spoken warnings on drives with no route.
• Location permission, which you set for gPeta in your iPhone's Settings. With Always, gPeta notices by itself when you start driving: it warns you and, while "Share my trips" is on, records the drive, even if you haven't opened it. With While Using, it does this only once you've opened it. Section 5 says what happens without it.
• Motion & Fitness permission, which you set for gPeta in your iPhone's Settings. gPeta uses motion activity on your phone only, to tell when a drive starts, and it never leaves your phone. If you refuse it, GPS speed alone decides.

Other people. A trip record also shows where anyone travelling with you was. gPeta can't tell who is driving, so a ride as a passenger, on a bus or in someone else's car, can be recorded as your drive. If someone else drives with gPeta on your phone, their trips are recorded under your phone, or under your account if you're signed in. On a shared phone, trips made without signing in join the record of every account linked to that phone, even after its owner signs out. To keep a trip out of your record, turn "Share my trips" off before you start it. With location Always, a drive can start being recorded by itself, so turn it off before you set off. If you turn it off during a trip, what was already sent stays in your record, and anything recorded but not yet sent waits on your phone, and is sent if you turn sharing back on.

9.2 Your rights #

Under Malaysian law, you can:

• see your data: ask for a copy of the personal data we hold about you;
• correct it: ask us to correct data that's wrong, incomplete, misleading or out of date. We also pass the correction on to anyone we disclosed the data to in the past 12 months;
• withdraw your consent: tell us in writing (section 9.3). Remove my trip history, Delete account and turning "Share my trips" off don't withdraw consent for the data we already hold: they change what's recorded from then on, as section 8.3 says;
• ask us to stop processing that causes you, or is likely to cause you, substantial damage or distress;
• move your data: ask us, by email, to send your data to another organisation, where that's technically possible and the formats work together;
• complain to the Personal Data Protection Commissioner (pdp.gov.my) if you're unhappy with how we handle your data.

9.3 How to make a request #

For any question or complaint about your personal data, contact us or our Data Protection Officer (section 12).

Write to info@mapifytech.com, or by post to 58.05, Exchange 106, Tun Razak Exchange, 55188 Kuala Lumpur, Malaysia. Tell us whether you used gPeta signed in or not. Before we act on a request, we may ask you to confirm details only the holder of the account or phone would know, such as roughly when you installed gPeta and where you drove recently.

• We'll confirm that we've received your request.
• We'll answer within 21 days. If we need longer, we'll tell you why in writing, and answer within 14 more days.
• We don't charge for a request.
• If we can't do what you ask, we'll tell you why in writing, within 21 days.

A parent or guardian can make these requests for a child under 18.

10. Security #

• Your phone's connection to our trip service is encrypted with TLS 1.3, the same protection as a secure website.
• Each trip record is encrypted (AES-256, a strong standard method) before it's stored, with the key of the account it was made under or, without an account, the key of the phone. Only the key's id, the kind of record and the hour are kept unencrypted alongside it.
• The trip archive is stored encrypted, is closed to the public, and accepts only encrypted connections.
• Our database is encrypted.
• Your sign-in tokens and your phone's identifiers are kept in your phone's Keychain, on that phone only, and never synced.
• App Attest lets us accept trips sent without an account only from genuine copies of gPeta.
• The moderation tools' key is kept in AWS Secrets Manager, never in the app. Staff reach it through a separate staff sign-in, and every moderation action is logged.
• Our service logs leave out positions and tokens. Our gateway, firewall and connection logs keep IP addresses, to find and stop abuse, and leave out sign-in tokens, app keys and device tokens.
• Our firewalls limit how often one IP address can connect to the trip service or call our servers.

If a data breach is likely to cause you significant harm, we'll tell the Personal Data Protection Commissioner within 72 hours, and tell you within 7 days after that. If we have no other way to reach you, we'll tell you on our website.

11. Children #

gPeta is for people aged 18 and over. When you tap Continue on the welcome screen, you confirm that you're 18 or over (terms of use, section 3). Don't use gPeta if you're under 18.

A parent or guardian can ask to see or correct a child's data, or withdraw consent for it, using the steps in section 9.3.

12. Data Protection Officer and contact #

Data Protection Officer

• Name or role: Data Protection Officer, Mapify Technologies Sdn. Bhd.
• Email: info@mapifytech.com
• Phone: +60 3-7455 0968
• Address: 58.05, Exchange 106, Tun Razak Exchange, 55188 Kuala Lumpur, Malaysia

Mapify Technologies Sdn. Bhd.

• Company no.: 202601021283 (1683380-T)
• Address: 58.05, Exchange 106, Tun Razak Exchange, 55188 Kuala Lumpur, Malaysia
• Phone: +60 3-7455 0968
• Privacy requests: info@mapifytech.com
• Support: support@gpeta.com

13. Changes to this policy #

When gPeta changes what it collects, or how it uses it, we'll update this policy, and the version and effective date at the top. If a change takes away or reduces any of your rights, or needs your consent, such as using your data for a new purpose or sharing it with a new kind of recipient, it applies to you only after the welcome screen has shown again, with links to the new version, and you've tapped Continue (terms of use, section 15). Other changes apply from the day they take effect. We keep every earlier version of this policy. Ask us if you'd like one.

14. Language versions #

This policy is in English and in Bahasa Melayu (https://gpeta.dev/ms/privacy). Both versions have the same version number and effective date. If the two versions differ, the one that's more favourable to you applies. The app's welcome screen is in both languages, and links to both versions.

The app is in English and in Bahasa Melayu, following the language set for gPeta on your iPhone, and its welcome screen shows both. This policy gives the names of the app's buttons and settings in English. When the app is in Bahasa Melayu, most of them appear in Malay: "Share my trips", for example, appears as "Kongsi perjalanan saya".