Arah Privacy Policy

Last updated 25 October 2026

Arah is a navigation app for Malaysia. It shows a map, guides you turn by turn, and warns you about cameras, police and hazards that other drivers have reported. We built it to work without collecting your personal data.

No account, no tracking

You don't sign up. Arah gives your phone a random anonymous ID so it can send reports and votes. That ID is not linked to your name, email, phone number or Apple ID. We don't show ads, we don't track you across apps, and we never sell data.

Your location

Arah uses your location on your phone to show where you are, guide you and check whether a report is ahead of you. We don't store your location or your trips.

Your location leaves your phone only in these cases:

• When you ask for a route. The start and end points go to our routing server so it can work out the route. The server keeps no record of them. It only adds one to two anonymous counts: a weekly count of trips between areas, such as Petaling Jaya to Kuala Lumpur, and a weekly count of how many people started or ended a trip in each area of about 2 km. These counts have no exact points and no ID. We only look at area pairs with at least five trips, and at 2 km areas used by at least three different people that week. To include live traffic, our server may send the start, end and stop points to a third-party routing provider in the United States. The provider doesn't see your phone or IP address.
• When you search for a place. Your search text and approximate area go to our search server. It keeps no record of them. If our search finds little, our server may send your search text and approximate area to a third-party place search provider to find more results. The provider doesn't see your phone or IP address. We don't keep your searches.
• When Arah checks for reports near you. It asks for an area about 30 km across, not your exact position.
• When you send a report. We store the type (camera, police or hazard), where it is, which way you were heading and when. Reports are deleted automatically after a few hours.
• While you navigate, if traffic sharing is on. Anonymous road speeds go to our traffic server, as described under "Anonymous traffic data" below. Points near the start and end of your trip are never sent.

Anonymous traffic data

When you navigate, Arah can share anonymous road speeds. We use them to give everyone better arrival times and to show traffic on the route. About once a minute, the app sends where you were and when, for the last minute of your drive. Arah sends nothing when you aren't navigating.

Arah never sends points within 500 metres of where your trip starts or ends, so places like your home and work stay out of it.

The points carry no name or account, and we don't store them with any ID. Our server matches them to roads, keeps only the average speed on each road, and throws the points away. To stop one person from faking traffic, the server briefly uses a scrambled version of your anonymous ID and IP address in memory. It never saves them. We never sell this data.

Sharing is on by default. You can turn it off any time with "Share Anonymous Traffic Data" in the app menu.

Usage and crash data

Arah sends some usage and crash data to PostHog, a service that helps us see which features people use and fix crashes. PostHog keeps this data on servers in the EU.

We send which features you use, for example that you started navigation or sent a report, with rough figures like "5 to 20 km" or "10 to 30 minutes". We also send the app version, your phone model, system version and language. If the app crashes, we send the technical details of the crash.

We never send your location, your routes, the places you search for or go to, or anything you type. Each install gets a random ID that isn't linked to you. PostHog doesn't keep your IP address.

We use this data only to improve Arah. We don't sell it or use it for ads or tracking.

Votes

When you answer "Still there?" we store your answer with the report so it stays up or disappears sooner. Votes are deleted along with the report.

Map tiles

Map images load from OpenFreeMap. Like any website, their servers see your IP address and the part of the map being loaded.

Services we use

• Supabase, in Singapore, stores reports and votes.
• Hetzner, in Germany, runs our routing, search and traffic server.
• OpenFreeMap provides map tiles.
• PostHog, in the EU, receives usage and crash data.
• A third-party routing provider, in the United States, adds live traffic to routes.
• A third-party place search provider, used only when our own search finds little.

Children

Arah is not meant for children under 13.

Changes

If we change this policy, we'll update this page and the date at the top.

Contact

Questions? Email durianatorsoftware@gmail.com.