Privacy Policy

Effective 4 October 2026 · Applies to the Jom app (iOS and Android) and jomjom.app

The short version

We collect what Jom needs to work: your account, your events, and your location while you use the app.
Identity checks keep only the result and a scrambled (hashed) form of your name. We don't keep copies of your MyKad.
Other members see your display name, photo and verified tick. Never your email.
We don't sell your data and we don't show ads.
You can delete your account in the app at any time.

1. Who we are

Jom is run by Team Forest in Kuala Lumpur, Malaysia ("we", "us"). We are the data user responsible for your personal data under Malaysia's Personal Data Protection Act 2010 (PDPA), as amended in 2024. This notice is given under section 7 of the PDPA.

2. What we collect

Data	Examples	Where it comes from
Account	Email address, password (stored hashed by our auth provider), or the account ID from Sign in with Apple or Google	You, when you sign up
Profile	Display name, profile photo, home area, language, interests	You
Identity check	Whether you passed verification, when, and a one-way hash of your name. Your MyKad image and selfie are processed by our verification provider and are not stored by Jom	You and our verification provider
Location	Your device's location while the app is open, to show nearby events and confirm check-in. Jom does not track your location in the background	Your device, only with your permission
Activity	Events you host, join, save or are reminded about; join requests and approvals; check-ins; badges; payment status you mark (paid, AA share reported); referrals; place claims	Your use of the app
Content	Event titles, descriptions, cover photos, notes for guests, WhatsApp group links you add as a host	You
Safety	Reports you make or that are made about you, blocks, moderation decisions	You and other members
Device	Push notification token, device type, OS version, app version, language	Your device
Feedback	When you shake to report a problem: your message, a screenshot, and device and app logs	You, only when you send a report

We don't collect your contacts, microphone or camera roll beyond the single photo you pick. If you add an event to your calendar, Jom writes that one entry and doesn't read your calendar.

3. Why we use it

To run Jom: create your account, show events near you, process join requests, send reminders and updates, and run check-in and badges.
To keep members safe: verify identity, handle reports and blocks, prevent fake accounts, spam and abuse.
To communicate: push notifications about your events (you control these in Settings), and service messages about your account.
To improve Jom: fix bugs from feedback reports and understand which features are used, using aggregated data.
To meet legal duties: respond to lawful requests from Malaysian authorities.

We process your data with your consent, which you give when you sign up and when you grant device permissions. Some processing is needed to provide the service you asked for. You can withdraw consent at any time by changing permissions or deleting your account, though Jom may then stop working for you.

4. Who sees what

Any member can see your display name, profile photo, verified tick, badges, and events you host.
A host sees the members who asked to join their event, and their payment and check-in status for that event.
Approved members see the exact meeting place and the host's WhatsApp group link. Before approval, only the area is shown.
Nobody else sees your email, your exact location, or your identity check details.
Links you share (for example, an event link with your referral code) can be opened by anyone who has the link.

We use these providers to run Jom. They process data on our behalf and only for these purposes. We don't sell personal data to anyone.

Provider	What for
Supabase	Database, sign-in and file storage
Expo, Apple Push Notification service, Google Firebase Cloud Messaging	Delivering push notifications
Apple, Google	Sign in with Apple and Google Sign-In, if you choose them
Mapbox	Maps. Mapbox receives map requests from your device, including the area being viewed
Identity verification provider	Checking your MyKad and selfie. We will name the provider here before verification goes live
Shake	In-app bug and feedback reports
Vercel	Hosting jomjom.app

Some of these providers store data on servers outside Malaysia. Where that happens, we rely on the provider's contractual and security commitments so that your data gets protection comparable to the PDPA.

Payments are made directly between members, for example by DuitNow QR. Jom never receives your bank or card details.

6. How long we keep it

Account and profile: while your account is open.
When you delete your account: your profile is hidden straight away. We then erase or anonymise your personal data within 30 days. We may keep the minimum needed for up to 12 months to resolve open safety reports, prevent banned users from rejoining, or meet legal duties.
Feedback reports: up to 12 months.
Push tokens: removed when you sign out, delete your account, or the token stops working.

7. Your rights

Under the PDPA you can:

Access the personal data we hold about you, and get a copy.
Correct data that is wrong or out of date. You can edit most of it in the app.
Withdraw consent or limit processing, including turning off location and notifications in your phone's settings.
Delete your account in the app: Me › Account › Delete account. If you no longer have the app, email us from your account's email address.
Data portability: ask us to send your data to you, or to another provider where technically feasible.

Email us at the address below. We reply within 21 days. We may ask you to confirm your identity first. If you're not satisfied, you can complain to the Personal Data Protection Commissioner of Malaysia.

8. Security

Data is encrypted in transit. Access is limited by database rules so members can only read what they're allowed to see. If a breach puts your data at risk, we will notify the Personal Data Protection Commissioner and, where required, you, as the PDPA requires.

9. Age

Jom is for people aged 18 and over. We don't knowingly collect data from anyone younger. If you believe a minor has an account, tell us and we'll remove it.

10. Changes to this policy

If we make a significant change, we'll tell you in the app before it takes effect. The date at the top shows the latest version.

11. Contact

Team Forest, Kuala Lumpur, Malaysia
Privacy and data protection: teamforest66@gmail.com

If there's a conflict between this English version and a translation, the English version applies.