Privacy Policy

1. Who this policy is from

KL Trains (“the app”) is made by Heima Studio (“we”, “us”), Kuala Lumpur, Malaysia. This policy explains what the app does and does not do with information. It covers the iPhone app and this website at kl-trains.heimastudio.xyz.

Questions about anything here go to kl-trains@heimastudio.xyz.

2. What the app collects

Nothing. The app does not collect, transmit, sell, share or store any personal information on any server, because it has no server and makes no network requests.

Specifically, the app does not collect:

• Your name, email address, phone number or any other contact detail.
• Your location. The app never requests location permission.
• The journeys you plan, the stations you search for, or the routes you save.
• Any device identifier, advertising identifier or fingerprint.
• Usage statistics, event logs, session recordings or heatmaps.
• Crash reports sent to us. (See section 6.)
• Contacts, photos, calendar, microphone, camera or health data.

3. What is stored on your iPhone

The app stores a small amount of information locally so it is useful the second time you open it. All of it lives in the app's own preferences on the device, and none of it is transmitted anywhere:

• Saved routes — the two station codes and a signature identifying which of the possible journeys you kept.
• Recent stations — the last six stations you chose, so a field you open before typing has something useful in it.
• Your last session — the two station codes on the plate when you closed the app, and which route was open, so reopening puts you back where you were.

That is the complete list. Together it amounts to a handful of station codes.

This data may be included in your iCloud or iTunes backup of the device, as any app's local data may be. That backup is between you and Apple; we have no access to it and no way to read it. Apple's handling of backups is covered by Apple's own privacy policy.

4. Network connections

The app makes none. Every station, line, colour, platform number and timetabled ride time is compiled into the app when it is built, so there is no API to call and nothing to look up. This is why the app works identically underground, on a plane, and in airplane mode.

Timetable data is refreshed by rebuilding the app and shipping an update through the App Store — not by the app fetching anything at runtime.

5. Purchases and payments

KL Trains is free. There are no in-app purchases, no subscriptions and no advertising, and the app contains no payment or advertising code of any kind. We never see, handle or store payment information.

6. Third parties and analytics

The app contains no third-party SDKs: no analytics, no attribution, no advertising network, no crash-reporting service. There is no third party for us to share data with, because there is no data and no connection.

Two things sit outside the app and are worth naming clearly:

• Apple. Downloading and updating the app happens through the App Store, and Apple collects information about that under its own privacy policy. If you have opted in to sharing analytics with developers in iOS Settings, Apple may show us aggregated, anonymised crash and usage statistics in App Store Connect. We cannot identify you from these, and you can turn that off in Settings → Privacy & Security → Analytics & Improvements.
• This website. It is a set of static files with no analytics, no cookies, no tracking pixels and no embedded third-party scripts or fonts. Our hosting provider processes standard server request logs (IP address, timestamp, page requested) to serve the site and guard against abuse, as any web server does. We do not use those logs to build a profile of anyone.

7. If you email us

If you write to kl-trains@heimastudio.xyz, we will have your email address and whatever you put in the message. We use it to answer you and to fix what you reported, and nothing else. We do not add you to a mailing list and we do not pass your message to anyone. Correspondence is kept only as long as it is useful for supporting the app.

8. Children's privacy

KL Trains is suitable for general audiences and does not knowingly collect information from anyone, of any age — there is nothing to collect. It contains no advertising, no social features, no user accounts and no links out to third-party content.

9. Security

The strongest security property of this app is that there is no copy of your data anywhere but your own device. There is no database to breach, no credentials to leak, and no account to take over.

The data on your iPhone is protected by iOS and by your device passcode, Face ID or Touch ID. Keeping those enabled, and keeping iOS up to date, is the meaningful protection here.

10. Your rights

Data protection law — including Malaysia's Personal Data Protection Act 2010 and, where it applies to you, the UK and EU GDPR — gives you rights to access, correct, export, delete and object to the processing of your personal data.

We hold no personal data about you, so there is nothing for us to produce, correct or erase. You already have complete control of everything the app stores: it is on your device, and deleting the app removes all of it permanently. Individual saved routes can be removed from the home screen with a long press.

If you have emailed us and would like that correspondence deleted, ask at the same address and we will delete it.

11. International transfers

No personal data is transferred anywhere, because none is collected. This website is served from a content delivery network with points of presence in several countries; the static files it serves contain no personal data.

12. Changes to this policy

If this policy changes, the updated version will be posted here with a new effective date. If a future version of the app ever collects anything at all, that will be described here before the release that does it, and it will be opt-in.

13. Contact

Heima Studio, Kuala Lumpur, Malaysia
kl-trains@heimastudio.xyz

We aim to reply to privacy enquiries within seven days.