Privacy Policy

Effective date: 15 October 2026

GreenMiles is a campus commute and green-mobility app for Universiti Malaysia Sabah (UMS). This page explains, in plain words, what we collect, why, and what you can do about it.

Who we are

The data controller is GreenMiles by Respire, a UMS student project. Contact: contact the developer directly at hi@respire.my. We follow Malaysia's Personal Data Protection Act 2010 (PDPA).

What we collect

• Account. You choose either a passkey with a nickname, or Sign in with Google. With a passkey we keep your nickname and the passkey's public key. We never see your fingerprint, face or screen lock, because those stay on your phone. With Google, Google sends us your name, email address and Google account ID. We store only a scrambled (hashed) form of your Google ID. We use it to recognise you next time. We do not store your name or email.
• Location, only during a trip. GPS is used only while you have pressed “Start journey” and a trip is running. We use it to check that the trip really happened: where it started and ended, its speed, and its distance. When you finish, the GPS points of that trip are sent to our server to verify it. We do not track you in the background.
• Trips, points and rankings. For each trip we keep the mode (walk, cycle, bus, car), the start and end place, the time, the distance, the duration, the verification result and the points earned.
• Technical data. We use a sign-in session cookie, and briefly use your IP address to limit abuse (rate limiting).

What is shown publicly

Only your nickname, a short random tag and your points appear on the campus leaderboard. Never use your real name as a nickname.

Where it is stored

Trips, points and accounts are stored in PostgreSQL and Redis databases hosted on Zeabur (Jakarta, Indonesia). The app and its server code are hosted on Vercel, which may process requests outside Malaysia. Map tiles come from OpenStreetMap. Trips saved before you sign in stay on your own device.

Cookies

We use one essential, secure, http-only session cookie to keep you signed in, plus a short-lived one during passkey sign-in. We use no advertising or tracking cookies.

What we do not do

We do not sell, rent or share your personal data. We do not show ads, and we do not use your data for marketing. We disclose data only if the law requires it.

How long we keep it

We keep your data while your account exists. Abuse-limiting data expires within hours, and sessions expire after 30 days.

Your rights

Under the PDPA you can access and correct your data, and withdraw consent. You can delete your account and all your trips and points at any time in the app (👤 → Delete account), or contact the developer directly at hi@respire.my. You can also sign out of every device from the same screen.

Children

GreenMiles is meant for UMS students and staff. It is not aimed at children under 13.

Changes

If this policy changes, we will update this page and its effective date.