Privacy Policy

1. Your choices and core navigation

You can browse the map, search and plan a route without creating a NINJA 9 account. Location permission helps place you on the map and provide active guidance. You can decline it and select a starting point manually for route planning. Active guidance needs a usable current location.

We request location permission through your device. During a route you start, the app can continue location updates and supported spoken guidance in the background. Ending or manually pausing navigation stops that navigation-specific background activity. You can change location access and precision in your device settings.

2. Information used for navigation

On iOS, Apple MapKit provides maps and place search under Apple’s applicable privacy terms. On Android, MapLibre displays maps supplied by the NINJA 9 map service; loading map tiles sends the requested map areas to that service. Android uses the NINJA 9 search service for place queries and shows an unavailable state when results cannot be provided. Route calculation sends starting, destination and intermediate-stop coordinates to the NINJA 9 routing service. A request may include the requested guidance language. Our routing requests do not require a NINJA 9 account.

The app uses current location, location accuracy, speed and direction on the device to follow a route and evaluate whether guidance is reliable. It does not upload or store a continuous raw trip history by default. Current routing operations are configured to avoid retaining route-coordinate request logs; security rate controls still process request information to protect the service.

Our first-party application backend and database are hosted in Malaysia. Apple and other service providers may process information outside Malaysia under their own applicable arrangements; Malaysia hosting does not mean every third-party request remains in Malaysia.

3. Optional accounts and sign-in

Accounts use a name, username, email address and protected login-session tokens. Current mobile sign-in uses Apple on iOS and Google on Android. Existing password accounts use password reauthentication; passwords are stored as hashes rather than readable passwords.

If you choose Sign in with Apple, we process the Apple account identifier, authorization information, and the name/email Apple supplies. Apple may provide a private relay email address. Apple authorization and refresh credentials are used to maintain the sign-in relationship and revoke it when your NINJA 9 account is deleted.

On Android, Google Credential Manager provides an identity token tied to a one-use sign-in challenge. Our backend verifies the token and challenge nonce, then uses the Google account identifier, name and email to provide account access. We store the Google identity association and NINJA 9 account session; this sign-in flow does not request or store Google API access or refresh tokens. Accounts are not automatically linked because they share an email address.

At account registration and sign-in, the app sends the operating-system family (for example iOS) and OS version. These are stored with the account session to identify the platform/version used for that session. This is not an advertising identifier or hardware device identifier.

4. Community reports and rewards

When you tap an incident category in the quick-report screen, you send that category and the accepted location captured at the tap to our service. The screen explains this sharing before you select a category. The full reporting form can also include an optional description and explicit location-sharing confirmation. Do not include someone else's private information in a report.

Reports are stored with their time, category, location, status and reporter association. Recent reports may appear to other users as advisory, potentially unverified information. Public incident responses do not include the reporter's account identifier, name or email. A report may include an opaque contributor reference so your app can hide other reports from that contributor; this is not a public account profile. Reports remain associated with an account or guest identity in our database for operation, abuse prevention, feedback and deletion.

Guest reporting uses a random app-install identifier to obtain a guest identity. You can delete reports, votes and the guest identity associated with this installation through Settings → Privacy → Delete guest reports. The app resets its local guest-install identifier and token only after the service confirms deletion. Signed-in reporting uses the account identity. Confirmations/dismissals, active-day check-ins and reward points are retained with the relevant identity. These are application features, not a stored continuous driving history. We use validation, rate limits and moderation controls to protect the community service. You can hide reports from a contributor on your device; the saved blocking preferences contain opaque contributor references, not that person's account details or your GPS history. You can also open an abuse-report email for a report. Its prepared content identifies the incident without automatically adding your location or trip coordinates, and you choose whether to send it from your email app.

5. Information stored on your device

App and voice language, map appearance, saved places and recent destinations are stored locally. They are not synced to your NINJA 9 account by the current app; normal device backup settings may apply to ordinary app preferences.

Saving a parking spot stores one position on your device. On iOS it also stores the time and reported accuracy. Parking data is excluded from device backup and account sync. Find my car shows that saved point and may need map internet access. You can replace or clear the saved spot.

Optional trip diagnostics store only a limited set of aggregate event counters locally, without route coordinates, destination text or raw error payloads. You can turn them off and clear them in Settings. The GPS diagnostics view processes recent readings in memory; copying details is an explicit action you control.

6. Optional traffic contribution

The traffic-contribution pilot is not activated in the current service. Its presence in Settings does not mean the app is currently sharing traffic samples or that live traffic predictions are available.

If the pilot is activated, it requires a separate opt-in explaining the location, speed, direction, temporary contribution identifier and short retention rules before collection. It is off by default. You can withdraw that consent in Settings. We will update this policy and the relevant App Store privacy declarations before changing the collection practices.

7. Retention and deletion

We retain registered account information while the account remains active, until you delete it or another lawful reason requires a different handling. Account deletion removes the active account and its associated application data, including authored incidents and linked sessions, votes and rewards. Apple-token revocation is processed separately using a restricted temporary queue; this does not keep the deleted account active.

Incident visibility expires by category. Routine database cleanup removes incident records more than 30 days after expiry. Guest identities are eligible for cleanup after 90 days of inactivity when no reports, registered account or reward records require the association. Security rate-limit records older than one day and sessions more than seven days past expiry or revocation are removed by routine cleanup. These are cleanup eligibility rules, not a promise of deletion at an exact second.

Operational copies and backups, if maintained, require separate retention controls. For information about a specific deletion request or retained operational copy, contact team@ninja9.my. Any legally required retention will be limited to the applicable purpose. We do not sell personal data.

8. Delete your account and manage privacy

1. Open NINJA 9 and go to Settings → Account.
2. While safely stopped, choose Delete Account.
3. Review the deletion confirmation and complete the requested identity verification.

Apple accounts require fresh Apple reauthentication; Google accounts require fresh Google reauthentication. Existing password accounts use their password. If you cannot access your account, email team@ninja9.my for help. Do not email your password, sign-in token or Apple/Google identity credentials. We may need to verify your identity before handling a privacy request.

To delete the guest reports and guest identity associated with this installation, open Settings → Privacy → Delete guest reports and confirm. The app uses this installation's guest authentication to authorize deletion; no registered-account password is needed. This does not delete a registered account: use the separate account-deletion steps above for that. You can also clear local recent destinations, parking and diagnostics in the app, withdraw optional contribution consent, and change location permission through your device settings. Contact us about access, correction, deletion or other applicable privacy rights.

9. Sharing, security and changes

We use service providers to operate hosting and authentication and share submitted incident information with the community as described above. Access is limited to the purposes needed to operate, secure and moderate the service. We do not use the current app for cross-app advertising tracking or include an advertising network SDK.

Requests use HTTPS; backend access and authentication records are restricted. No system can guarantee perfect security. Contact team@ninja9.my if you have a concern. We may revise this policy as features or processing change, and will explain material new collection choices before they are enabled.