Komap Privacy Policy
Baca dalam Bahasa MalaysiaKomap is owned and operated by SOARA AI SDN. BHD. (Registration No. 202601027632 (1689728-T)), a company based in Kuala Lumpur, Malaysia. SOARA AI SDN. BHD. is the data controller for the Komap services described here. This notice explains how we use personal data for navigation, accounts, the garage and Ko-munity. Contact hello@soara.ai for support, privacy questions or rights requests. An English and Bahasa Malaysia version are available.
Information we use
We store your account identifier, unique Kover username when chosen, display name, optional profile photo and private phone number, email when supplied, password hash for email accounts, and session credentials. If enabled in your build and our service, Google or Apple sign-in supplies a verified account identifier and may supply your name and email. We do not receive your Google or Apple password. An optional phone number is visible only in your own account settings; it is not currently verified or used for sign-in or password recovery. Vehicle choices and app preferences are stored on your device; selected appearance is included when you enable community visibility.
Location and navigation
With your permission, Komap uses location while open to show the map, find nearby incidents and provide route guidance. Route requests send your origin, destination and chosen stops to our API and routing provider. Trip history can include destination, trip timing, distance and rewards. Native navigation may continue when the app is in the background, subject to your device permissions. Stop navigation to end guidance. You can deny or revoke location permission in your device settings.
Toll estimates during a trip
During active foreground navigation, toll estimation may send short batches of precise GPS coordinates, accuracy and timestamps to our API to confirm a toll-plaza crossing. The API temporarily keeps the route, latest GPS fix and any confirmed entry in memory; it does not save these batches as a trip trace or log them. A session is removed within 75 seconds without updates and expires after at most 12 hours plus a 15-second cleanup interval. Stopping navigation stops new batches. Lost GPS continuity can prevent a toll estimate.
Nearby Kovers and map privacy
Showing your vehicle to nearby Kovers is optional and off by default. When enabled, location updates reach our service; coordinates in community presence are rounded to approximately 100 metres. Other Kovers see a location sample at least two minutes old, not your live navigation position. You are not shown during the initial delay, and presence stops being shown after two minutes without an update. The map shows your selected vehicle; tapping it opens a mini profile. With private profile enabled, that profile shows Kover, generic Ko artwork and your joined month without your username, custom photo, mood or driving status. With identity visible, it can show your username, chosen photo or Ko avatar, mood and driving status. Approximation and delay reduce precision but do not guarantee anonymity. Switching visibility off requests removal; if you are offline, removal may wait until expiry. Blocking filters both users from community views.
Reports, discussions and photos
Incident reports include their location, time, category and any details you submit. Confirmations, dismissals and other reactions are associated with your account to prevent duplicate votes and help determine report visibility. Report attribution follows your report-identity preference; hiding your name does not hide the reported location, submission time or content. Your display name and approved discussion messages may be visible to other users. Photos are re-encoded to remove embedded metadata before storage. Incident-only photos require approval before others can view them; photos published in Ko-munity follow its immediate-posting rules. Do not upload private information, faces or registration plates unnecessarily. Moderators can review submitted content and abuse complaints.
Ko-munity profiles and groups
Ko-munity is a public social feature. When your profile is public, your chosen username, bio, display name, photo or Ko avatar, posts, replies and group memberships or leadership can be seen by other users. Private profiles show Kover and generic Ko artwork instead of your public handle, photo and bio; joined month, post content, time and group roles remain visible. Posts retain an internal account identifier for blocking, abuse reports and moderation, so private posting is not untraceable anonymous posting. Platform moderators can inspect account identity when investigating abuse. Profile photos are cropped and re-encoded to remove metadata, replaced photos are deleted from active storage, and photo access follows your current privacy and blocking settings. Verified brands and road operators use their reviewed public identity. Joining a group is optional. Photos and short videos are processed to remove embedded metadata before publication. Ko-munity posts are published immediately after automated checks; moderators can subsequently remove content that breaks the rules. A linked incident shares its precise reported map location; ordinary posts do not attach your GPS location. Brands and road operators receive a verification badge only after review by Soara.
Optional road-test diagnostics
When you explicitly start a diagnostic test, Komap records device/build information, diagnostic event times, GPS accuracy and recovery states, reroute events, camera measurements and voice-error states on your phone. The diagnostic record excludes exact coordinates, routes, road or destination names, instruction text, audio and contacts. Cloud backup is separately optional and requires a signed-in account: enabling it sends these diagnostic snapshots to Komap’s Google Cloud backend, associated with your account, to investigate reliability issues. Uploads retry while the app runs; OS suspension can delay them. You can pause uploads or delete the test and its active cloud backup from Road-test diagnostics. Cloud snapshots expire 30 days after the test starts, with active-storage cleanup within one further hour while the service runs. Account deletion also removes them. Only authorised owner/admin operations sessions with MFA can inspect these backups, and staff reads are audited. Encrypted infrastructure backups expire under the separate backup retention cycle. A local export is shared only when you choose to share it.
Voice guidance
When you choose an online character voice, instruction text and the selected voice are sent through our API to the voice service to generate speech. Instructions may contain road or destination names. The API keeps a small in-memory audio cache for up to five minutes and does not persist or log instruction text. Device-generated speech may be used when online speech is unavailable or navigation is in the background.
Providers and sharing
Mapbox supplies maps, place search, routing and traffic information. Mapbox receives requests needed to deliver these services, which can include search terms, map area or route locations. Native Google and Apple sign-in communicate with their respective providers. Firebase Crashlytics processes app crash diagnostics, device information and an installation identifier to help us find and fix failures. Hosting and database operators process service data for Soara. Our current API and primary database run on Google Cloud in Singapore; services such as Mapbox, Google/Firebase, Apple and email delivery can process information in other countries under their applicable arrangements. Being based in Kuala Lumpur does not mean all data stays in Malaysia. We evaluate safeguards for cross-border processing as required by applicable law. We do not sell your personal data or currently use advertising SDKs. Provider privacy notices also apply to their services.
Service activity and operations
To operate and protect Komap, our private staff console measures daily account activity, guest or registered status, app platform and version when available, and first/last service access for each day. Updated apps send a small heartbeat while open; it contains no GPS coordinates, advertising identifier or device fingerprint. Daily activity records are kept for up to 90 days and removed with active account deletion. Daily/monthly active counts refer to account identities rather than distinct people. The staff overview groups opted-in community presence into approximate 0.25-degree areas. A restricted street map shows opted-in vehicles using samples two to four minutes old, rounded to approximately 100 metres, together with reported incident locations. Private map profiles use generic artwork and hide public identity. Owner-only case review can reveal the associated account and up to 20 existing saved trip records, including start/end locations and recorded journey totals, after a recent authenticator sign-in and entry of a case reference and reason. Each review is recorded in the security audit trail. Saved trips are not continuous GPS trails or proof of the roads actually travelled. This feature does not grant external agencies access; any lawful disclosure is reviewed separately. Mapbox supplies the basemap and receives map-area requests; account details and incident records are rendered in the browser rather than submitted as Mapbox datasets. Authorised staff can review accounts and reported content, apply scoped restrictions, and review security audit records. Suspected scams, sensitive information and rapid posting may trigger rules-based review alerts; these signals are not an automatic determination of wrongdoing. Store purchase reporting, when connected, uses verified transaction records; payment card details are not stored in Komap.
Retention and deletion
We retain your account, saved places and trip history until you delete them or your account. Expired incidents and presence stop being shown but may remain stored until operational cleanup. Choose Profile → Delete account and data to remove your active account records, owned trips, saved places, reports, uploaded photos and videos, Ko-munity posts and replies, group memberships, discussions and rewards. Groups you own and their conversations are removed when your account is deleted. Other users’ independent contributions remain. In-app deletion removes active account records when the confirmed request succeeds; reinstalling the app is not required to request deletion. If you cannot use the app, email hello@soara.ai with the subject “Delete my Komap account” from the registered address where possible; include your @handle and sign-in method, never your password or verification codes. We verify ownership before acting, normally aim to resolve verified email requests within 30 days, and explain any lawful delay. Automated database backups retain seven daily backups and point-in-time logs for seven days. Separate recovery or migration snapshots may remain longer until retired under controlled access; deletion is not immediate erasure of every backup. Backups are restricted to recovery rather than ordinary app access; contact us if you believe deleted information has reappeared after a recovery. Other users’ independent content and any records that must be retained by law may remain only as necessary for their purpose.
Your choices and requests
You can disable community visibility, revoke location/photo/camera permissions, block users and delete your account. Email hello@soara.ai to request access, correction, deletion or portability where applicable, withdraw consent, limit processing or ask about processing and retention. We may request proportionate information to verify your request. Refusing data needed for an account, route or report can prevent that particular feature from working; optional phone, profile photo, social visibility and community media are not required for basic navigation. Withdrawing an optional permission does not cancel your account. You may also raise a personal-data complaint with Malaysia’s Personal Data Protection Commissioner at pdp.gov.my.
Lawful requests and account privacy
A hidden public profile is not anonymous to the service operator. Staff access is restricted and sensitive owner reviews are audited. We do not give police, agencies, brands or other users an open tracking dashboard or sell movement histories. Requests for disclosure are reviewed for identity, legal authority, necessity and scope; we disclose only information we actually hold when legally required or otherwise lawfully justified. We cannot reconstruct a continuous route history that was never recorded.
Security and changes
We use authenticated access, hashed passwords and secure token storage on supported devices. Public services use HTTPS and access controls. We investigate security incidents, assess notifications required by applicable law and provide affected users information where required. No service can promise perfect security. Material policy changes will be presented in the app; this document is dated 27 October 2026.
Contact hello@soara.ai.