Jalan is a Singapore transport information application operated by MOPy Studio Pte. Ltd., a company incorporated in Singapore ("Jalan", "we", "us", or "our"). This Privacy Policy explains what information Jalan handles, why it is used, when it is disclosed to service providers, and the choices available to you.
This policy applies to the Jalan mobile application, Jalan account services, and the related Jalan application programming interfaces ("Services"). It does not apply to third-party websites or applications that you choose to open from Jalan.
You may use most transport features without creating an account. If you choose to register or sign in, we handle:
If you contact us, we also receive the information contained in your message and the contact details you use.
With your permission, Jalan accesses your device's current precise or approximate location to:
Many nearby and distance calculations are performed on your device using downloaded transport data. For bounded nearby bus-stop searches, Jalan may send your current latitude and longitude to Jalan.API so that the server can rank the closest stops. The coordinates are used to answer that request and are not stored against your account or used to create a location history. They may pass transiently through ordinary network and operational systems. When the app downloads maps, styles, sprites, or fonts, the hosting service receives the requested resource and standard connection information such as your IP address. A requested map area may reflect the area you are viewing.
Location access is optional. You can decline the system permission, turn off Location Services in Jalan's settings, or revoke the permission in your device settings. Features that require your current location may then be unavailable or use a general Singapore view.
Jalan integrates Google Firebase Cloud Messaging, which may create and process a Firebase installation identifier and related technical information when the app initialises. If you enable notifications, Firebase Cloud Messaging and, on Apple devices, Apple Push Notification service use app-instance or device notification identifiers so that announcements and transport alerts can be delivered.
If you start an iOS Live Activity for a bus arrival, Jalan sends an ActivityKit push token and the selected bus stop, bus service, operator, and destination details to Jalan.API. This lets the Live Activity update while the app is suspended. The subscription expires automatically after 30 minutes and may be removed earlier when tracking stops or the app observes that the activity was dismissed. On supported Android devices, bus-arrival tracking uses a foreground notification managed on the device.
Depending on the features you use, Jalan stores some information locally on your device, including:
You can clear favourites and cached data from Jalan's settings. Other local data can be removed by clearing the app's storage or uninstalling the app.
The free version of Jalan may request active banner campaigns from Jalan.API. A campaign can include an image hosted by Jalan or an advertiser and an HTTPS destination link. Jalan does not use an advertising SDK, does not create an advertising identifier, and does not use account or location information to target campaigns. The host serving a campaign image, or the destination you choose to open, receives standard connection information such as your IP address and browser or device information.
If you purchase or restore Remove Ads, Jalan sends the store name, product identifier, and the purchase token or transaction identifier supplied by Apple App Store or Google Play to Jalan.API. Jalan.API uses it to verify the transaction with the applicable store. Verification request bodies are not intentionally included in operational telemetry, and Jalan does not persist the raw purchase token or transaction identifier in its application database. The app stores the entitlement and verification information in operating-system protected secure storage so the permanent entitlement can work offline and be periodically revalidated.
When the app communicates with Jalan.API, our hosting and monitoring systems may process:
We use this information to operate, secure, troubleshoot, monitor performance, prevent abuse, and improve the reliability of the Services. Jalan does not use this information for behavioural or location-based advertising.
Usage Analytics is disabled by default. If you opt in under Settings → Data & Privacy, Jalan creates a random app-instance identifier and periodically sends limited usage counts to Jalan.API while the app is active. Jalan.API stores only a one-way cryptographic hash of the identifier. These records can include app opens and sessions, broad feature and tab usage, app and build version, operating-system version, device model and manufacturer, device form factor and architecture, locale, time zone, installation channel, and whether the device is physical. If you are signed in, the analytics record may be associated with your internal Jalan account identifier.
Usage analytics does not include precise location, search text, favourites, bus stop or route choices, email address, display name, passwords, notification content, or advertising identifiers. You can turn it off at any time; this stops future analytics events, clears queued events and the local analytics identifier, and prevents normal API requests from carrying an installation identifier. A later opt-in creates a new identifier. Operational security and reliability logs described above are separate and may still be produced when the app communicates with Jalan.API.
Jalan does not use an IDFA, Android Advertising ID, third-party advertising, attribution, or analytics SDK. Jalan does not perform cross-app or cross-site tracking and does not request your contacts, photos, microphone, calendar, or health data. We do not sell your personal information and do not build a location or movement profile.
We use information described in this policy to:
We do not sell or rent your personal information. We do not use it for third-party behavioural advertising.
We disclose information only as reasonably necessary for the purposes above:
Singapore government transport and parking information shown by Jalan may be obtained from LTA DataMall, data.gov.sg datasets published by HDB or other agencies, and URA data services. Jalan does not provide your account credentials or a stored location history to those data providers.
Jalan does not disclose Usage Analytics to third-party analytics or advertising providers. It is sent directly to Jalan.API and stored in Jalan's database hosted on Microsoft Azure. We use the providers listed above only for their described infrastructure, notification, sign-in, purchase, content-delivery, or mapping roles. Their processing is governed by their applicable service terms and privacy documentation. Where a provider processes personal data on our behalf, we rely on its data-protection terms and configure the service with safeguards appropriate to the information involved.
These providers may process information in Singapore and other countries where they or their service providers operate, including countries whose data protection laws may differ from those in your home country. Where personal data is transferred outside Singapore, we take reasonable steps to ensure a standard of protection comparable to the PDPA, as required by applicable law. Their processing is also governed by their own terms and privacy documentation:
We retain information only for as long as reasonably necessary for the purposes described in this policy:
We may retain limited information for longer where required by law or reasonably necessary for security, fraud prevention, dispute resolution, or enforcement. Where possible, information retained for aggregate reporting is de-identified.
We use reasonable administrative, technical, and organisational safeguards designed to protect information. These include encrypted HTTPS connections, cryptographically hashed passwords and Jalan session refresh tokens, encryption of stored Apple credentials, access controls, rate limiting, managed secret storage, and operating-system protected storage for sign-in tokens on your device.
No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
You may:
You can permanently delete your Jalan account and its associated synchronised data at any time from the account deletion page, or in the app under Settings → Data & Privacy → Delete account. For any other privacy request, email support@mopy.studio from the email address associated with your account. We may need to verify your identity before completing a request. We aim to respond to verified requests within a reasonable time and in any event within the period required by applicable law. Deleting an account does not automatically remove information stored only on your device; you can clear the app's storage or uninstall Jalan to remove that information.
As Jalan is operated from Singapore, requests relating to Singapore users are handled in accordance with the Singapore Personal Data Protection Act 2012 ("PDPA"). Depending on where you live, applicable local law may provide additional rights concerning access, correction, deletion, restriction, objection, or withdrawal of consent. Withdrawing consent does not affect processing that occurred before withdrawal.
Jalan is a general transport utility and is not designed to solicit personal information from children. Jalan does not knowingly collect personal information from children under 13 years of age (or the equivalent minimum age in your jurisdiction). If you are a parent or guardian and believe a child has provided personal information to Jalan without appropriate permission, contact us at support@mopy.studio so that we can review and, where appropriate, delete it.
Jalan may display third-party transport data, campaign images, or links to external services. A third-party image host may receive standard network information when the image loads, and an external destination receives information normally sent when you open a link. We do not control the privacy practices of third parties you choose to visit or use. Review their privacy policies before providing information to them.
We may update this Privacy Policy when Jalan's features, providers, or legal obligations change. We will publish the updated policy with a revised effective date and update the "Last updated" date above. Where appropriate, we may also notify you in the app. We encourage you to review this page periodically.
This Privacy Policy is governed by the laws of the Republic of Singapore, without regard to conflict-of-law principles, unless applicable law in your jurisdiction requires otherwise.
For privacy questions, requests, consent withdrawal, access or correction requests, or complaints, contact our Data Protection contact:
MOPy Studio Pte. Ltd.
Singapore
Email: support@mopy.studio
If you are not satisfied with our response, you may contact the Personal Data Protection Commission of Singapore at pdpc.gov.sg.