Privacy policy

Last updated 23 October 2026

Navilah is a navigation app for Malaysia, Singapore and Brunei. It uses your location to find places, plan routes, show live traffic and share road reports. We don't show ads, we don't sell your data, and we don't track you across other apps or websites.

You don't need an account

Navilah works without signing in. On first launch the app creates a random ID for your install (not your phone's hardware ID). It resets if you reinstall the app.

What we collect, and why

• Location while you drive. When you allow location access, Navilah sends GPS points (position, speed, direction, accuracy, altitude and time) with your install ID. If you allow Motion & Fitness access, each point also carries whether your phone thinks you are driving, walking, cycling or still, so only trips in a vehicle count towards live traffic. They are turned into anonymous traffic speeds for each stretch of road, which is what shows live traffic to everyone. If you allow location "Always", trips keep recording while Navilah is in the background. Raw GPS points are deleted within about an hour; the traffic speeds that are kept don't include your install ID or account.
• Road reports and votes. When you report something (e.g. a crash or roadblock) or confirm one, we store the report type, location, direction, time, your install ID, your account if you're signed in, and a one-way hash of your IP address. Other drivers see the report on the map, never who sent it. The install ID and IP hash are used to stop abuse. Reports are deleted 30 days after they expire.
• Searches and routes. What you search for, and your approximate location to rank nearby results, go to our search servers. Route start and end points go to our routing server (route.navilah.com), or to the public OSRM server (project-osrm.org) if ours is unavailable. We don't keep a history of your searches or routes.
• Places you add. When you suggest a missing place, we store what you entered (name, category, address, location, and any phone, hours or website), your install ID, your account if you're signed in, and a one-way hash of your IP address. We check suggestions before they appear on the map; approved places are shown to everyone, never who added them. Deleting your account deletes your suggestions.
• Photos of places. When you add a photo of a place, the app first removes its hidden details (such as where and when it was taken, and your phone's model) and makes it smaller. We store the photo, the place's name and location, your install ID, your account if you're signed in, and a one-way hash of your IP address. We check photos before they appear; approved photos are shown to everyone with the place, never who sent them. Photos we don't approve are deleted. Deleting your account takes the photos you sent off the places they were on.
• Places you open. When you open a place from search, tap one on the map or get directions to it, we add one to a count of how often that place is opened, so popular places show earlier on the map. Only places already on the map are counted, never a dropped pin or a place you saved under a name. To count each phone once a day, we keep which install opened which place for two days, then delete it; the counts themselves aren't linked to anyone.
• Shared places. When you share a place, we store the place and your install ID so the link can open it.
• Account (optional). If you sign in, we store your email address, or the address Apple gives us if you use Sign in with Apple (which can be a private relay address), and your name if Apple shares it. Trips and reports made while signed in are linked to your account.
• Notifications. If you allow notifications, your install ID and push token are registered with OneSignal so we can send you messages, such as finishing a sign-in you started on a computer.
• App access. Each time the app opens it checks in with our server (install ID, platform and time).

Who processes your data

• Supabase hosts our database and sign-in, in Singapore.
• OneSignal delivers push notifications.
• OpenFreeMap serves the map tiles. Like any website, it sees your IP address and which part of the map you're viewing.
• Apple, if you choose Sign in with Apple.

These providers also keep short-lived technical logs (such as IP addresses) to run and protect their services.

Deleting your data

If you're signed in, open the account button in Navilah and tap Delete account. This deletes your account, and the trips and road reports linked to it, straight away. You can keep using Navilah without an account.

Without an account, there is little to delete: raw GPS points are gone within about an hour, and reports within 30 days of expiring. To have anything else removed sooner, email us.

You can also turn off location or notifications for Navilah in your phone's settings at any time.

Children

Navilah is meant for drivers and isn't directed at children under 13.

Changes

If we change this policy, we'll update this page and the date at the top.

Contact

Questions or requests: [email protected]