Privacy Policy

This Privacy Policy explains how the AutoMalaya OBD team (“we”, “us”, “our”) handles information in connection with the AutoMalaya OBD app and website (the “Service”). We designed the Service to be local-first and privacy-first. This policy is intended to align with Malaysia’s Personal Data Protection Act 2010 (PDPA) and applicable Apple App Store requirements.

1. Our core principle

By default, your vehicle and diagnostic data stay on your device. We do not operate an application server that collects your diagnostic data. We do not sell personal data, and we do not use it for advertising or cross-app tracking.

2. Information processed on your device

• Vehicle details: make, model, year, fuel type, nickname, and (optionally) VIN.
• Diagnostic data: fault codes, freeze-frame data, readiness monitors, live sensor snapshots, battery voltage, health score, and generated reports.
• Adapter info: the adapter’s name/identifier and connection details.
• Trip/location: optional and off by default. If you record a trip, your location is used only while recording — to map the route and measure distance — and the trip (route, distance, estimated fuel economy) is stored on your device and never uploaded.
• Service records: any maintenance, cost, and odometer entries you choose to log.

3. Bluetooth

Bluetooth is used solely to discover and connect to your OBD-II adapter. It is not used to track you or your location.

4. On-device AI

Reports are generated on your device. No diagnostic data is sent to any server for AI processing. The only optional network features are the VIN lookup (section 5) and private sync (section 6); both are off until you turn them on. If we ever introduce other cloud features, we will request your explicit consent and explain what is sent before any data leaves your device.

5. Optional online VIN lookup

If you tap “Decode VIN”, the app sends only the VIN to the U.S. National Highway Traffic Safety Administration (NHTSA) vPIC database to retrieve vehicle details (make, model, year, engine). This is optional and user-initiated — it never runs automatically, and no other data is sent. If you don’t use it, the app makes no such network calls. Your VIN is not sent to our servers (we don’t operate one).

6. Optional private sync

Sync is part of Pro and is off by default. If you turn it on, a small summary — car name, health score, risk band, findings count and date — is stored in your own cloud account: Apple’s CloudKit private database on iPhone, or a hidden app-data folder inside your own Google Drive on Android. It is not stored on our servers, we cannot read it, and it is governed by Apple’s or Google’s privacy terms. Your full scan history, reports and trips stay on the device. You can disable sync or delete the synced copy at any time.

7. Analytics

We collect no analytics. The app contains no analytics, advertising or crash-reporting SDK, and we operate no server that could receive events. The app keeps simple counters on your device — for example how many scans you have run — purely to power features such as your health-score trend. Nothing is transmitted to us.

8. Purchases

One-time purchases (Pro and the used-car report) are processed by Apple on iPhone and Google Play on Android. We receive only your entitlement status (for example, unlocked) from the store — never your payment-card details. There is no subscription.

9. How we use information

To provide diagnostic features, generate and export reports, enable optional sync and reminders, provide support, and (with consent) improve the Service. We process data on the lawful bases of performing our agreement with you and your consent, consistent with the PDPA.

10. Sharing & disclosure

We do not sell your data. Data leaves your device only when you choose to export or share a report, enable private sync (to your own iCloud or Google Drive), use the optional VIN lookup (only the VIN, to NHTSA — see section 5), or contact support. We may disclose information if required by law or to protect rights and safety.

11. Retention & your rights

Local data is retained until you delete it or uninstall the app. You can delete any vehicle, scan, or report, or wipe all data from within the app — see Delete Your Account for the full steps, including how to request deletion by email. Under the PDPA you may request access to, or correction of, personal data we hold (if any), and withdraw consent; contact us using the details below.

12. Children

The Service is not directed to children and is intended for adults.

13. Security

We rely on device and platform protections: app sandboxing on both iOS and Android, the device Keychain on iPhone, Keystore-encrypted storage for your signed-in account details on Android, and — where you enable sync — your own iCloud or Google account security. All network requests use HTTPS. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

14. Changes

We may update this policy; material changes will be posted here with a revised date.

15. Contact

For privacy questions or PDPA requests: hello@automalaya.app.

This document is provided for general information and does not constitute legal advice. Please have a qualified privacy/legal adviser confirm it reflects your registered entity and data practices before public launch.