Hala Privacy Policy

Version: 0.6 (beta) · Effective: 2026-10-28 · Applies to: the Hala iOS beta distributed through TestFlight Contact: hala.support[at]gomoblaqo.com Online: https://myhala.app/privacy

Who we are

Hala is a navigation app for drivers and motorcyclists in Malaysia, made by Faris Hassani. During the beta it is operated by one person, not a company.

What this covers

The Hala iOS app, the Hala service at alerts.gomoblaqo.com, and the pages at myhala.app. A trip you share is shown on a page at myhala.app, served by that same service.

What we collect

Your location. Hala reads your position while you use it. It keeps reading it in the background while it is guiding you, sharing your trip, or recording a ride you switched recording on for, in Settings or with the Record button. That is what keeps directions, hazard warnings and the ride coming with the screen off. When you are doing none of these, it stops. Your position draws you on the map, plans routes, and decides which alerts are ahead of you.

Your start and destination are sent to a routing engine, and points along your route are sent to a map-data service to look up speed cameras. Which engine depends on whether you are signed in. The section "Who else sees anything" below lists all of them.

Reports you make. When you report a hazard, a camera, an animal or an accident, we store what you reported and where. This is the point of the app: other riders are shown it.

Traffic jams Hala reports for you. While you are being guided, signed in, and crawling forward on a stretch the route expected to be fast, Hala reports a traffic jam at your position on its own, without asking — the same report as if you had tapped it, marked as automatic. It lives ten minutes, and is filed again every ten minutes while you are still in the queue. Your speed is not sent; only that there is a jam, and where. If you are standing still instead, Hala asks you, and reports nothing unless you say so.

Your account. Signing in with Apple is needed for weather along your route, for community alerts, and for reporting anything. The map, search and routing work without an account. Signed out, your routes are planned by a public community routing service rather than ours.

What we store is the identifier Apple gives us for this app, and nothing else: no name, no email address, and no password, which we never see in any case. That identifier is specific to Hala and cannot be used to recognise you in any other app.

It is pseudonymous rather than anonymous. We cannot tell who you are from it, but we can tell that the same account made two reports. If you would rather we could not, delete your data in Settings and the link goes with it.

Diagnostics. If a build crashes, iOS may send us a crash report. If you send feedback, we get what you wrote.

Ride logs, only if you switch them on. Settings → Record rides is off by default. When it is on, Hala records guided trips and rides without a destination. A ride starts only while Hala is open, then keeps recording with the screen off until you have stopped for 20 minutes. Each ride is written to your phone, and the ride log itself never leaves it. The Record button before Start turns recording on or off for one ride. You can delete rides in Settings.

A ride with a destination is called by it. A ride without one is named after one point: where it ended, or, if it came back to where it started, where it turned back. If that point is within 500 metres of Home, Work or a place you saved, the ride takes that name and nothing is sent. Otherwise, once the ride has ended, Hala asks Apple's geocoder what is at that point. Once Apple has answered, with a name or without, it is never asked about that ride again. If the request does not get through, because there is no signal or Apple is too busy to answer, Hala names the ride after the nearest town from a list in the app, and tries Apple again later, at most once a day, until Apple answers. This includes rides recorded before this version of the policy. Only that point is sent to the geocoder, never the ride: the ride log itself never leaves your phone. The name is kept on your phone with the ride and deleted with it.

If you choose Satellite on a ride, the imagery under it comes from Apple Maps, so Apple receives the requests for the imagery of the area shown, as CARTO does for the map. The ride's line is drawn on your phone and is not sent.

Favourites stay on your phone, in a file the system cannot read while the phone is locked. They are sent to iCloud only if you turn on Settings → Sync favourites with iCloud, which is off by default. That copy goes to your own iCloud account, not to us.

Recent destinations also stay on your phone, but in ordinary app storage rather than the locked-file kind. They are protected by your passcode like the rest of the app's data, and no better than that. Clear them any time from the search screen. (Corrected 2026-09-08: an earlier version of this policy claimed they were in protected storage. They are not, and moving them is on the list.)

The names you give other riders stay on your phone and are never sent to us. Our record of a connection is two anonymous identifiers and a date.

Convoy, only while you are in one. Starting or joining a convoy is your choice, and the screen that does it says what follows before you agree. While you are in one:

• Everyone in that convoy sees where you are, which way you are heading and your last half minute of path — live while you have signal, or about once a minute if you save battery.
• They see the name you choose for that convoy (not your account), your role, whether you are saving battery, and when you say you have stopped, fallen behind or need help.
• If the convoy plans stops, its organiser, lead and sweeper see which released stops you reached and when.
• Joining a convoy never makes you a connection of anyone in it.

What is kept, where, and for how long:

• Your live position and heading pass through our server's memory to the others. Each is replaced by the next; they are gone when you leave or the convoy ends.
• Your latest position is saved on our server about every 15 seconds while you share, so someone reconnecting can see where you were last seen. It is cleared when you leave or the convoy ends.
• If you lead, your last 30 seconds of path — by the time on your own fixes — are kept only on the other members' phones, to draw your trail. Newer positions replace older ones, and the trail is cleared when you leave or stop leading.
• **Your convoy name, role, membership, sharing mode (live or saver) and what you said** — stopped, behind, needs help — are kept on our server for the convoy's members, along with its planned stops and who reached them, until the convoy is deleted a day after it ends. A convoy lasts at most twelve hours. The plan and who reached each stop are readable only by the convoy's organiser, lead and sweeper, and your arrivals stay in it if you leave.
• That you used your one free convoy, and which one, is kept on our server and never shown to anyone, until you delete your account.
• Your phone keeps a small record of the convoy you are in, and anything you said that has not reached us yet, so leaving still works after a restart with no signal. Something you said before leaving — a call for help — is still sent when you next have signal.

Leaving stops your phone sharing at once, and you can leave at any time. With no signal, the others are told you left, and your saved position is cleared, once your phone reaches us again; what they already received cannot be called back. We never show convoy members your account, and we do not use convoy positions for anything else.

What we do not do

• We do not sell your data, to anyone, at any price.
• We do not use your movements to work out where you live or work.
• We do not show anyone which account made a report.
• We do not show other users who reported something.
• We do not use advertising identifiers or third-party analytics in the app.

Who else sees anything

• CARTO receives which map tiles your phone asks for, so the map can be drawn.
• Komoot (Photon) receives what you type into search, and roughly where you are, so results near you rank first. Hala asks our own place index at the same time, and that half of the search does not leave our server.
• FOSSGIS receives your start, destination and any waypoints so a route can be planned, but only when you are signed out. Signed in, this goes to our own server instead and FOSSGIS gets nothing.
• Overpass (OpenStreetMap) receives points along your planned route, to look up which speed cameras are on it.
• Apple receives your location through our server, for the WeatherKit forecast along your route. It also handles your sign-in and receives crash reports. If you record rides, Apple's geocoder receives one point for each ride without a destination, rides recorded before this version included, once the ride is over: where it ended or turned back, so the ride can be named. Not if that point is near a place you saved. Once Apple has answered, it is not asked about that ride again; a request that does not get through, because there is no signal or Apple is too busy to answer, is tried again later, at most once a day, until it does. Nothing else of the ride is sent to the geocoder; the ride log itself never leaves your phone. If you choose Satellite on a ride, Apple Maps receives which imagery tiles your phone asks for, for the area shown, as CARTO does for the map.
• Our own server receives your reports, your account identifier, and route requests, because that is what running the service means. It is in Malaysia.
• Cloudflare carries every request between the app and our server, and the pages at myhala.app, including shared trip links. It decrypts each request on the way through, so it handles what is in it, your location and reports included, but does not keep the contents. It keeps records of connections, such as IP addresses, under its own privacy policy, and keeps copies of map tiles for up to a day so the map loads faster. Today these requests pass through Cloudflare in Singapore on their way to our server.

Requests to our own server go over HTTPS. We have not yet signed data-processing agreements with these providers. That work is tagged [KV-GA] in our register and is not complete. You should weigh that before joining the beta.

How long we keep it

• Reports expire on their own, most within 10 minutes to 4 hours, cameras and crossings for longer. Unconfirmed ones are deleted rather than archived.
• Account records last until you delete your account.
• Convoy data is kept as the convoy section above says: positions until you leave or the convoy ends, the rest until a day after it ends, and the record of your free convoy until you delete your account.
• Crash reports and feedback are kept while the beta runs.
• Backups of our server are made each night, encrypted, and kept on our own equipment in Malaysia: for 30 days, and one a month for 12 months. Something deleted from the server, your account included, is gone from the newest backup the next night and from all of them within 12 months. Backups are only ever used to restore the service.
• Ride logs live on your phone until you delete them, with the name each ride was given. We never hold a copy.

Your choices

• Turn location off in iOS Settings. Navigation stops working, and nothing else is taken.
• Turn off location history in Hala's Settings.
• Delete your data in Settings → Delete my data. This removes your account and your reports from our server. A convoy you organise ends for everyone; in any other, you leave it and your name there becomes "Rider".
• Leave a convoy from its panel, or from Settings → Convoy.
• Leave the beta at any time from TestFlight. Deleting the app removes everything held on the phone.

Under Malaysia's Personal Data Protection Act 2010 you may ask what we hold about you, ask us to correct it, and ask us to delete it. Write to the address at the top, replacing [at] with @. It is written that way to keep the address away from scrapers, not from you. We will answer within 21 days.

Children

Hala is not for under-18s and we do not knowingly collect their data.

Changes

Beta testers will be told through TestFlight when this changes materially. The version and date at the top always say which policy is in force.