Privacy Policy

Privacy Policy

TT Spot ("we", "us") is a car community app for Malaysia. This policy explains what we collect, why, who we share it with, and the choices you have. It is written to meet the Personal Data Protection Act 2010 (PDPA).

What we collect

• Account: your email, username, display name and photo, plus your home state and bio if you add them.
• Phone number (optional): if you add one, friends who have your number can find you. It stays private (see "Your phone number").
• Your cars: make, model, year, colour, photos and the mods you add. If you add car papers: road tax, insurance, PUSPAKOM and service dates, your insurer and policy number, so we can remind you before they are due.
• Location: your position while the app is open, so friends can see your car on the map, TT now can find the nearest place, and check-ins can be verified. Only if you turn on "Share location when TT Spot is closed", also while the app is in the background or closed. We keep only your latest position; it expires after 24 hours.
• Content: posts, moments, comments, chat messages, voice notes, videos and meets you create.
• TiTi: your chats with TiTi and the photos you send in them.
• Activity: meets and events you join, check-ins, entry numbers, registration answers, booth stamps and freebies, show car votes, lucky draw entries and wins.
• Points, cards and blind boxes: your points history (each change and why), the boxes you open, the cards you own and trade, and the rewards and vouchers you claim.
• Device: app version, device model, a push notification token, and crash reports linked to your account, to keep the app working.
• Contacts, only if you turn on contact sync: scrambled codes of the phone numbers in your contacts, never names (see "Contacts").

There are no ads or ad tracking in TT Spot.

How we use it

• To run the app: show the map, deliver messages and notifications, run meets, events and rewards.
• To keep people safe: verify check-ins by location, check new posts and moments, review reports, and stop abuse.
• To improve TT Spot: understand which features are used. We do not sell your data.

Location, in detail

• Sharing runs while the app is open. Sharing while the app is closed is off unless you turn on Settings > Share location when TT Spot is closed. Then your phone sends your position about every 30 seconds while you move, to the same people your visibility allows, and never while you are on Nobody (ghost). On Android a notification with a Stop button shows while it is on.
• Turning it off, logging out, or another member logging in on the same phone stops it straight away.
• You choose who sees your car: Friends (the default), Friends + nearby within a distance you set, Everyone, or Nobody (ghost). Change it or go invisible any time on the map. Friends, and members of a club you share your location with, see your exact spot. On Friends + nearby and Everyone, people who are not your friends see only an approximate area (about 500 m), your username and your car on the map; never your photo, direction or exact spot.
• Meet and event check-ins record your position once, at the moment you check in, to confirm you are there. Booth stamps and a lucky draw roll call check it once in the same way. Other members never see these positions.
• Your spot on an event floor plan is deleted one day after the event ends.

Your phone number

• Your phone number is private. Members never see it on your profile.
• Friends can call or WhatsApp you only if you set Settings > Who can call me to Friends. It starts on Nobody. Strangers never get it.
• An event organiser gets it only if you tick the consent box on their registration form. A booth gets it only if you switch on "Share my contact with booths" on your event pass.
• TT Spot staff can see it to help with your account and stop abuse. We do not use it for marketing.

Contacts

• Contact sync is off unless you turn it on, when you sign up or in Settings > Privacy > Sync contacts.
• When it is on, TT Spot reads the phone numbers in your phone's contacts. On your phone, each number is turned into a one-way code (a SHA-256 hash). Only these codes are uploaded. Names, emails and the numbers themselves never leave your phone.
• We match the codes against members' phone numbers, coded the same way, to show you which of your contacts are on TT Spot, and to tell you when one of them adds their number later. We use the codes for nothing else, and only you can see yours.
• People in your contacts are not told that you synced. If you are in another member's synced contacts, they may see you under "From your contacts" or "In your contacts", and get one notice when you add your number.
• Turn it off any time in Settings > Privacy > Sync contacts. Your uploaded codes are deleted straight away. Deleting your account deletes them too.

TiTi and AI features

• TiTi, our assistant, runs on OpenAI. When you chat with TiTi, we send OpenAI your message, any photos you add, and what TiTi needs to answer: your first name, your cars and car paper dates, your rough location for nearby meets and spots, your points, cards, vouchers and meets.
• TiTi tips: TiTi may send you up to three short messages a day, written by OpenAI from your first name, nearby meets, your car paper dates, the weather in your area and your last few TiTi messages. Turn off Settings > TiTi tips to stop them.
• Car photos: OpenAI looks at a car photo you add to tell its make and model, and at a spot check-in photo to confirm it shows a real car.
• Safety check: every new post and moment (its photos, video still and text) goes through OpenAI's automated moderation, so objectionable content is hidden until a person reviews it.
• Toy car and portraits: Kie.ai turns your car's photo into a toy car model or a portrait.
• We ask your permission before TiTi, the car photo features or the toy car first send your data to OpenAI or Kie.ai. You can say no and still use the rest of the app. The safety check is part of posting.
• OpenAI and Kie.ai use what we send only to give us the answer or the image. OpenAI does not use it to train its models and keeps it no longer than 30 days.

Events and organisers

• When you check in to an event, its organiser sees your name, handle, home state, car, check-in time and entry number.
• Registration answers you give go to the organiser. Your phone and email go with them only if you tick the consent box on the form.
• Booths that scan your event pass get your name, handle, state and car. They get your phone and email only if you switch on "Share my contact with booths" on your pass. Your pass shows which booths have your details, and you can remove them.
• Once an organiser or booth exports your details, they are responsible for them under the PDPA.

Lucky draws

• Entry is free and automatic when you check in to an event that runs a draw. Nothing you buy or earn gives you extra entries.
• Winners are announced in the app to the people at the event. The stage screen shows the winner's masked name and entry number.
• The organiser sees winners' names to hand over prizes. We keep a record of each draw (entrants and results) so it can be checked.

Who can see what

• Your profile, cars and posts are visible to signed-in members. Your car papers are visible only to you.
• Moments are visible for 24 hours, then only in albums you make or at the place they were taken.
• Chat messages are visible to the people in that chat. TiTi chats are visible only to you; you can delete any of them.
• Partners see only the voucher you redeem and the bill amount they type.
• Live Activities on iPhone: the meet countdown on your lock screen runs on your phone. Nothing extra is sent for it.

Sharing with others

We use these services to run TT Spot. They get only what they need for their part:

• Supabase hosts our database, files and sign-in.
• Mapbox draws the map, finds nearby places and turns place names into map positions. The map on your phone may send Mapbox anonymous usage and location data to improve its maps; you can turn that off from the (i) on the map.
• Google Places looks up an address when you search for one. It gets the text you type and your rough position.
• Firebase (Google) delivers push notifications and collects crash reports. Apple also delivers notifications to iPhones.
• OpenAI and Kie.ai, for TiTi and the AI features above.
• Resend sends our emails.
• MET Malaysia weather: we download the public forecast and match it to your state or area ourselves. Nothing about you is sent.
• Event organisers and booths, as described above.
• Partners (workshops and shops) when you redeem their voucher.

Some of these services store data outside Malaysia. We choose providers that protect it to at least the standard the PDPA requires. We do not share your data with advertisers.

How long we keep it

• Your latest position expires after 24 hours.
• Contact codes stay until you turn off contact sync or delete your account.
• Event floor plan positions are deleted one day after the event ends.
• Everything else stays while your account is open, or until you delete it (a post, a moment, a TiTi chat, a booth's copy of your contact).

Your rights

• See, correct or export your data: email us.
• Delete your account: Settings > Delete account. Everything you posted goes with it within 24 hours; backups clear within 30 days.
• Withdraw consent for location: switch to Nobody (ghost), turn off "Share location when TT Spot is closed", or turn off location for TT Spot in your phone settings.
• Withdraw consent for AI features: turn off Settings > Notifications > Use AI in the app (this stops TiTi, TiTi tips and toy cars), or email us.
• Withdraw consent for contacts: turn off Settings > Privacy > Sync contacts, or turn off Contacts for TT Spot in your phone settings.

Keeping it safe

Data is stored in the cloud with encryption in transit and at rest. Only staff who need access have it.

Children

TT Spot is for people aged 18 and over. If we learn that a member is younger, we close the account.

Changes

We will tell you in the app when this policy changes in a way that matters.

Contact

team@ttspot.my