Privacy Policy
Effective 27 September 2026. This policy is written to meet the Personal Data Protection Act 2010 of Malaysia, as amended.
- We never sell your data and we do not show advertising.
- Your accessibility profile is optional. You can skip it and still use the app.
- Location is used only while the app is open, and is saved only when you attach it to a barrier report.
- You can delete your account in the app at any time, without having to ask us.
1.Who we are and what this covers
Move My Way ("Move My Way", "we", "us" or "our") is an accessible navigation service based in Johor Bahru, Malaysia. For the purposes of the Personal Data Protection Act 2010 (the "PDPA"), we are the data controller responsible for your personal data.
This policy applies to:
- the Move My Way mobile app;
- the browser version of the app available on this website; and
- this website, including the venue registration form for businesses.
Together we call these the "Service". This policy does not cover websites or services run by other people that you reach through a link in the Service.
2.Information you give us
Your account
Your name, email address and password when you sign up with email. Your password is never stored in readable form. If you sign in with Google or Facebook instead, we receive the basic profile details that provider shares with us, such as your name and email address. We never receive your password for those accounts.
Your profile and accessibility needs
A profile photo, if you add one. During setup you can also tell us the mobility aid you use, your type of wheelchair, its approximate weight, and the furthest distance you are comfortable walking or rolling. Every one of these is optional. We use them to tailor routes, distances and recommendations to you.
Your contributions
Reviews (star ratings, accessibility scores, tags, written comments and photos), barrier reports (the type of barrier, a description, photos, the location and any description of where it is), votes on a venue's accessibility features, confirmations of other people's reports, and likes.
Your trips and saved places
Trip titles, destinations, travel dates, the places you add, stop times, notes, cover images and whether each trip is private or shared. Also your favourite venues and the venues you have recently searched for.
Your conversations with Compass
What you type or say to Compass, our in-app assistant, and its replies. See section 7 for how these are handled.
Rewards
The rewards you redeem, the points spent and the voucher codes issued to you.
Businesses registering a venue
When you use the venue registration form: the venue name, company registration number, address, city and state, the contact person's name, email address and phone number, the accessibility features you tell us about, and any notes you add. We also keep a record of the emails we send you about your request.
When you contact us
Your email address and whatever you choose to include in your message.
3.Information collected as you use the Service
Location
With your permission, the app uses your device's location while it is open on your screen. It does not track you in the background. We use it to show venues and barriers near you, work out distances, plan routes and guide you turn by turn. To calculate a route, your starting point and destination are sent to our map and routing providers. Your device's own location service may also be used to turn your position into the name of your city.
We do not keep a history of where you have been. A location is stored on our systems only when you attach it to a barrier report, and a city is stored as part of any trip you create.
Camera and photos
The camera is used when you take a photo for a report, a review, a trip cover or your profile, and for the live walking guide. The walking guide works entirely on your device: its camera view is not recorded or uploaded. Photos are uploaded only when you choose to attach them.
Microphone
The microphone is used only when you talk to Compass, and for the optional "Hey Compass" wake word, which is off until you turn it on and listens only while the app is open on your screen. Speech is converted to text by your device's built-in speech recognition service, which, depending on your device, may be provided by your phone's maker or operating system under their own privacy terms. We receive the resulting text, never an audio recording.
How you use the app
We record in-app events linked to your account: screens you open, venues you view, searches you make, trips you create, reviews you add, the types of barriers you report and rewards you redeem. We also count how often you use Compass each day, so that we can apply a fair daily limit.
Points and progress
Points you earn and spend, your level, badges and mission progress.
Technical information
Like almost every online service, our hosting providers automatically log technical details such as your IP address, browser or device type, and the time of each request. These logs are used to keep the Service running, secure and free of abuse.
4.How we use your information
We use personal data only for these purposes:
- To provide the Service: creating and securing your account, showing venues, routes and accessibility information, saving your trips, favourites and history, and delivering the features you choose to use.
- To personalise it: tailoring routes, distances, recommendations and Compass's answers to your mobility needs.
- To run the community map: publishing reviews and barrier reports, updating venue accessibility scores, and checking contributions for accuracy and misuse.
- To run points and rewards: awarding points, tracking levels and missions, and issuing the rewards you redeem.
- To keep people safe: preventing fraud, spam, point farming and abuse, moderating content, and enforcing our Terms of Use.
- To talk to you: sending a welcome email, account and password emails, in-app notifications, and replies to your questions. For businesses, sending updates about your venue registration.
- To improve the Service: understanding which features are used and where people get stuck.
- To meet our legal obligations and respond to lawful requests.
We do not use your personal data for advertising, we do not build advertising profiles, and we do not make decisions about you that have legal or similarly significant effects based solely on automated processing.
5.Consent and sensitive personal data
We process your personal data with your consent, which you give when you create an account or submit a form, and where the processing is necessary to provide what you have asked for or to comply with the law.
Information about your mobility aid, wheelchair and walking distance relates to your physical health, which the PDPA treats as sensitive personal data. We collect it only when you choose to provide it, which is your explicit consent, and we use it only to tailor the Service to you. You can leave it out, change it or remove it at any time.
You may withdraw your consent at any time by changing your settings, turning off a device permission, or deleting your account. Some features cannot work without certain information; for example, routing from where you are needs your location.
6.What other people can see
Move My Way is a community service, so some of what you contribute is visible to other users:
- Reviews show your name, profile photo and level alongside your rating, comments, tags and photos.
- Barrier reports appear on the map with their type, description, photos and location. The app does not show your name with them.
- Trips are private by default. If you choose to share a trip with the community, other signed-in users see its title, cover image, destinations, number of days and the places in it, together with your first name only. Your travel dates, stop times, notes and profile photo are never shown.
Photos you upload are stored so the app can display them, which means anyone who has a photo's web address can view it. Please do not include faces, vehicle number plates or other people's personal details in your photos. Our photo checks will ask you to retake a picture that shows people.
7.Compass and automated photo checks
Compass, the in-app assistant
To give answers about your situation rather than generic ones, each question you ask Compass is sent, through our own servers, to an artificial intelligence (AI) provider along with relevant context from your account. That context can include your first and last name, your accessibility profile, your approximate location, nearby venues and barriers, your trips, and your points and level. Your email address is never included, and the AI provider is not given your account identifier.
- Saved history. Your conversations are encrypted before they are stored. By default they are deleted automatically after 30 days. You can choose 3, 7 or 14 days, or to keep them, and you can delete any conversation, or all of them, at any time.
- Shared answers. To answer common questions quickly, we may reuse replies to general questions that contain nothing personal. Those stored replies are not linked to you. Anything personal, and anything that leads to an action in your account, is never reused.
- Without a connection. When the AI service is unavailable, Compass answers using a simpler assistant built into the app, and your question is not sent to an AI provider.
Barrier photo checks
Before a barrier report is submitted, its photos are checked automatically for problems such as blur, poor lighting, irrelevant content, people in the frame or inappropriate material. Some of these checks happen on your device; others send the photo to an AI provider. We also keep a digital fingerprint of each photo to detect the same image being reused across reports. A photo that cannot be checked is not rejected: it is marked for review by our team instead.
Venue registrations
Our team may use an automated assistant to help review a venue registration. It is given the venue's details and description, but never the contact person's name, email address, phone number or company registration number, and any contact details written into the description are removed first. A person always makes the final decision, and nothing is ever approved automatically.
9.Transfers outside Malaysia
Some of our service providers, including our AI, hosting and email providers, store or process data on servers outside Malaysia. When your data is transferred abroad, we take steps to ensure it continues to receive a level of protection consistent with the PDPA, including by choosing established providers that are bound by contract and by their own security and privacy commitments.
10.How long we keep your information
- Your account and content are kept for as long as your account is open.
- Compass conversations are deleted on the schedule you choose, 30 days by default, and are deleted straight away when you delete them yourself.
- When you delete your account, we permanently erase your profile, accessibility preferences, reviews, barrier reports, trips, favourites, recent searches, points, rewards, notifications, Compass conversations and usage limits, together with your profile photo, barrier report photos and trip cover images.
- What remains after deletion. In-app usage events are kept without any link to you, so they no longer identify you. Any venue listing linked to your account stays on the map with that link removed, because it forms part of the shared map. Photos you added to reviews are stored with the venue's photo collection; if you would like those removed too, email us and we will delete them.
- Venue registrations and the emails we sent about them are kept as a business record for as long as reasonably necessary to handle the request and any follow-up.
- Backups and logs. Copies may remain in routine backups and technical logs for a limited period until they are overwritten in the normal course.
We may keep information for longer where the law requires it, or where it is needed to resolve a dispute or investigate misuse.
11.How we protect your information
We use practical technical and organisational measures to protect your personal data against loss, misuse and unauthorised access, including:
- encryption of all data in transit between your device and our servers;
- access rules enforced by the database itself, so each user can read and change only what they are allowed to, whichever app or screen they use;
- encryption of Compass conversations before they are stored;
- passwords stored only in a securely hashed form;
- protection against repeated sign-in attempts; and
- access to administrative tools restricted to authorised staff.
No system can be guaranteed to be completely secure. If a data breach affecting your personal data occurs, we will notify the relevant authority and, where the breach is likely to cause you significant harm, notify you, as required by law. Please keep your password to yourself and tell us straight away if you think your account has been accessed without your permission.
12.Your rights and choices
Subject to the PDPA, you have the right to:
- Access the personal data we hold about you and receive a copy.
- Correct personal data that is inaccurate, incomplete or out of date. You can edit most of it yourself in your profile.
- Delete your account. In the app, open your Profile and choose Delete Account. This takes effect immediately and cannot be undone.
- Withdraw consent or limit how we process your data, including by turning off location, camera or microphone access in your device settings.
- Receive your data in a portable format, where the law provides for it.
You can also control your Compass history, your trip visibility, and the optional "Hey Compass" wake word from inside the app.
To make any other request, email us from the address linked to your account, or tell us enough to verify that you are the account holder. We will respond within 21 days. We do not charge for reasonable requests. If you are not satisfied with our response, you may complain to the Personal Data Protection Commissioner of Malaysia.
13.Children
The Service is not directed at children under 13, and they should not create an account. If you are under 18, please use the Service only with the consent of a parent or guardian. If you believe a child has given us personal data without that consent, contact us and we will delete it.
14.Cookies and device storage
This website does not use advertising cookies, tracking pixels or third-party analytics, and its fonts are served from our own site rather than fetched from another company.
The browser version of the app keeps you signed in using your browser's session storage, which is cleared when you close the tab, and it saves app files in your browser so it loads faster next time. It also loads its map library from a public content delivery network, which receives your IP address as part of that request.
The mobile app stores some information on your phone, such as your settings, your sign-in session, and copies of venues, your trips and your profile so they are available offline. Uninstalling the app removes this information from your phone.
15.Changes to this policy
We may update this policy as the Service changes or the law develops. We will change the "Last updated" date at the top of this page, and if a change significantly affects how we use your personal data, we will tell you in the app or by email before it takes effect.
This policy is published in English. If it is translated and the versions differ, the English version applies.
16.Contact us
For any question about this policy or your personal data, or to make a request:
