Privacy Policy.
Effective 29 October 2026
Ploop is a transit app for the Klang Valley, made by one person. The app has no accounts, and it doesn't want your name. This page explains what the app does use, where it goes, and what you can do about it.
1. What Ploop uses.
Your location
If you allow it, Ploop uses your phone's precise or approximate location to:
- show the station nearest to you on the Home tab,
- find buses and stops around you on the Live Map, and
- while you're tracking a bus, tell you when it's nearby or when it's time to get off.
All of this is worked out on your phone. Your location is not sent to Ploop's servers, and it isn't stored once you close the app. While you're tracking a bus, Ploop keeps running with a notification showing, so it can alert you; it stops when you stop tracking.
Your phone's location comes from Google Play services, which handles location data under Google's Privacy Policy. You can turn location off for Ploop at any time in your phone's settings. The app still works; you'll just pick stations yourself.
Notifications
If you allow notifications, Ploop can tell you about service alerts (delays, breakdowns and the like) and about the bus you're tracking. Alerts are delivered through Firebase Cloud Messaging, which gives your copy of the app a random delivery token. Every Ploop user receives the same alerts, so we don't keep or use that token to single you out.
Usage and crash data
Ploop uses Google Firebase to understand how the app is used and to fix problems:
- Firebase Analytics collects things like which screens are opened, how long the app is used, your device model and OS version, your general region, and a random ID for your copy of the app. It also records when a sponsored card is shown or tapped.
- Firebase Crashlytics collects a report when the app crashes: what went wrong in the code, your device model, OS and app version, and a random installation ID.
None of this includes your name, contact details or precise location.
Keeping the app genuine
Ploop uses Firebase App Check with Google Play Integrity to confirm requests come from the real app on a real device, which protects its transit data from abuse. This sends Google signals about your device and app install.
2. Where data goes.
To show you transit information, Ploop talks to these services. Like any website or app connection, each one sees your IP address and basic technical details of the request.
| Service | What it's for | What it receives |
|---|---|---|
| Google Firebase (Analytics, Crashlytics, Cloud Messaging, App Check, Remote Config, Firestore, Realtime Database, Storage) | Usage stats, crash reports, alerts, app protection, settings, and the station, line and alert data the app shows | The data described in section 1, plus random app and installation IDs |
| data.gov.my (Malaysian Government open data) | Live bus positions | A request for the live data feed; nothing about you |
| RapidKL journey planner (myrapid.com.my) | Fares and routes in the Planner | The two stations you're planning between (their map positions), and the departure time |
| OpenFreeMap | The map you see on the Live Map | Requests for the map tiles on screen |
Google's handling of Firebase data is described in Privacy and Security in Firebase and the Google Privacy Policy. Firebase data may be processed outside Malaysia.
Sponsored cards. Ploop may show cards for local businesses. Tapping one opens that business's website or app, and from then on their own privacy policy applies. Ploop doesn't share anything about you with them.
3. What stays on your phone.
Ploop saves a few things on your phone so it remembers you between visits: the stations and lines you've picked for Home, your favourites and recent journeys, alerts you've received, and cached timetables and transit data. These never leave your phone, and they're removed when you clear Ploop's storage or uninstall the app.
4. This website.
This website (ploop.dtan.io) is hosted by Cloudflare. It has no accounts, no ads, no tracking and no cookies. Like any web host, Cloudflare handles your IP address and basic details of your browser to deliver the pages and protect them from attacks.
The sign-up form
If you sign up to test Ploop, the form sends us the email address you enter, plus your name and message if you give them. They're delivered to our inbox by Cloudflare's email service; they aren't stored on the website or shared with anyone else. We use them only to:
- add your email to the app's tester list in the Google Play Console, so you can install the test version, and
- reply to you, if you wrote to us.
Adding you as a tester shares your email address with Google, which runs Google Play.
5. How long it's kept.
Location isn't kept at all. Analytics and crash data are kept by Google Firebase for a limited time, according to the retention settings of Ploop's Firebase project and Google's own policies, and are then deleted automatically. Sign-up emails are kept until testing ends or you ask us to delete them; we'll also take you off the tester list on request.
6. Your choices.
- Location and notifications: turn them on or off anytime in Settings → Apps → Ploop → Permissions.
- Advertising ID: you can reset or delete it in your phone's Google settings, under Ads.
- Everything on your phone: clear Ploop's storage, or uninstall the app.
- Your rights: under Malaysia's Personal Data Protection Act 2010 you can ask to see, correct or delete personal data held about you, or withdraw your consent. Since Ploop doesn't know who you are, data it holds can usually only be matched to you by the random ID of your install. Get in touch below and we'll help.
7. Children
Ploop is a general transit app and isn't aimed at children under 13. It doesn't knowingly collect personal data from children.
8. Changes
If Ploop starts handling data differently, this page will be updated and the date at the top will change. For bigger changes, the app will let you know.
9. Get in touch.
Questions, or a request about your data? Email privacy@ploop.app.
Ploop is not affiliated with Prasarana or Rapid KL.