Alight Privacy Policy
Alight reminds you before your KRL Commuter Line stop. We built it to need as little of your data as possible: there is no account, your location is processed on your phone, and we do not keep a copy of anything you do in the app. This policy explains the details in plain language.
A Bahasa Indonesia version is available at /alight/privacy/id. If the two versions differ, the Bahasa Indonesia version applies.
1. Who we are
Alight is published by Arvella Technology Labs ("we", "us").
- Email: hello@arvellalabs.com
For the purposes of applicable data protection laws, we are the controller of the limited personal data that Alight processes.
2. The short version
- No account, no sign-up. We never ask for your name, email, or phone number.
- Your location is used only while a journey you started is running. It is processed on your phone and is not sent to us or to advertisers.
- Your journey, settings, and recent destinations are stored only on your phone.
- Alight shows ads from Google AdMob. Google receives some device data (such as your advertising ID and IP address) to show and measure ads.
- Alight downloads station data from our server. That request contains no location or personal data.
3. What Alight uses, and why
3.1 Location
What: Your phone's precise location (GPS).
When: Only after you start a journey. Alight runs a location service with an ongoing "active journey" notification so reminders keep working when your screen is locked or you use other apps. This is why Android asks you to allow location "all the time". The service stops when you arrive, or when you end the journey.
Also, while you are setting up a journey, Alight may read your phone's last known location once to suggest your starting station.
Why: To work out where you are along the line, how far you are from your destination, and when to send your reminder.
Where it goes: Nowhere. Location is processed on your phone. It is not sent to us, and it is not passed to Google AdMob or any other company.
3.2 Notifications
What: Permission to show notifications.
Why: To send your "get ready" reminder, your arrival notice, the ongoing active-journey notification, and test notifications you request. These are local notifications created on your phone. Alight does not use push notifications from a server.
You can choose Senyap (silent), Getar (vibrate), or Suara dan getar (sound and vibrate) in Settings.
3.3 Data stored on your phone
Alight saves the following in the app's private storage on your device:
- The current journey: destination, line, reminder station, progress, and the starting and most recent location of that journey. The location fields are cleared when the journey ends.
- The time of the most recent location update.
- Your settings, such as your alert mode.
- Your recent destinations.
- Whether you have completed the first-launch setup and accepted this policy.
- Station and line data for KRL Commuter Line.
We cannot see any of this. It stays on your phone until you clear the app's storage or uninstall Alight.
3.4 Ads (Google AdMob)
Alight is free and shows ads through Google AdMob (Google Mobile Ads SDK). Ads appear as a banner on some screens and, sometimes, a full-screen ad when you start a journey. Ads are not shown on the active-journey screen.
To show ads, limit repeats, measure performance, and prevent fraud, the Google Mobile Ads SDK collects and shares with Google:
- your advertising ID and app set ID
- your IP address (which can be used to estimate your general location)
- device and app information, such as device model, operating system, and app version
- ad interactions, such as ad views and taps
- diagnostic information about app and SDK performance
Google processes this data under its own policies. Learn more: How Google uses information from sites or apps that use its services and the Google Privacy Policy.
Where required by law, Alight shows Google's consent form (User Messaging Platform) before ads load, so you can choose whether ads may be personalized. Alight never gives Google your location, journeys, or destinations.
3.5 Station data
Alight downloads KRL station and line data from our server (hosted on Cloudflare, at trainstop-api.arsyaadi.workers.dev) on first launch, and checks for updates when you open the app or tap update in Settings. These requests ask only for the data version and the station list. They contain no location, no identifiers, and no information about your journeys.
As with any internet request, our hosting provider, Cloudflare, receives your IP address and basic technical information (such as request headers) in order to deliver the data. We do not use it to identify you.
3.6 Map
When you open the map in station search, the map is loaded from third-party services: the map library from unpkg.com and the map style, tiles, and fonts from OpenFreeMap (tiles.openfreemap.org). Those services receive your IP address, basic device and browser information, and which map areas are loaded. Your own location is not shown on or sent to the map. If you never open the map, these requests are not made.
4. What we do not collect
- No account, username, or password
- No name, email address, or phone number
- No contacts, photos, files, microphone, or camera
- No location history on any server
- No analytics or crash-reporting tools of our own
If you email or WhatsApp us, we will receive whatever you choose to send (such as your email address or phone number) and use it only to reply to you.
5. Does any data leave your phone?
Only in these cases:
| Who receives it | What | Why |
|---|---|---|
| Google (AdMob) | Advertising ID, app set ID, IP address, device and app info, ad interactions, diagnostics | Showing and measuring ads, fraud prevention |
| Cloudflare (hosting our station-data server) | IP address and basic request info. No location or personal data | Delivering station data |
| unpkg.com and OpenFreeMap | IP address, device/browser info, map areas viewed. Only when you open the map | Displaying the map |
We do not sell personal data. We do not share your location with anyone.
6. How long data is kept
- On your phone: Journey location is cleared when a journey ends. Other app data stays until you clear the app's storage or uninstall Alight.
- With us: We do not hold any Alight user data on our servers. Emails you send us are kept only as long as needed to help you, and then deleted.
- With Google, Cloudflare, and map providers: Kept according to their own policies.
7. Third-party services
- Google AdMob: partner sites policy, privacy policy
- Cloudflare: cloudflare.com/privacypolicy
- OpenFreeMap: openfreemap.org
- unpkg: unpkg.com
- Station data comes from OpenStreetMap (copyright). OpenStreetMap does not receive any data from Alight.
8. Your choices
- Location and notifications: Turn them on or off at any time in Android Settings → Apps → Alight → Permissions. Without location and notification access, Alight cannot run journeys or remind you.
- Ad personalization: Where the consent form is shown, you can choose your preference. You can also reset or delete your advertising ID in Android Settings (Privacy → Ads, or Google → Ads, depending on your phone).
- Change your ad consent: In-app ad privacy options will be available in Settings. Until then, clearing the app's storage or reinstalling Alight will show the consent form again where it applies.
- Stop a journey: End it at any time in the app. Location tracking stops right away.
- Remove everything: Clear Alight's storage or uninstall the app. This deletes all Alight data on your phone.
9. Deleting your data
Because Alight has no account and we keep no user data on our servers, almost everything lives on your phone, and you can delete it yourself by clearing Alight's storage or uninstalling the app.
You can still email us at hello@arvellalabs.com to ask us to delete data. We will delete any emails or messages you have sent us, and confirm in writing. For data held by Google for ads, you can also use Google's controls at myadcenter.google.com and your phone's advertising ID settings.
10. Your rights under UU PDP
Under Indonesia's Law No. 27 of 2022 on Personal Data Protection, you have the right to:
- get information about how your personal data is processed;
- access and get a copy of your personal data;
- correct or update inaccurate data;
- have your data deleted or destroyed;
- withdraw consent you have given;
- object to decisions made solely by automated processing that significantly affect you;
- delay or limit processing;
- receive or transfer your data in a commonly used format, where applicable;
- file a complaint and seek compensation for violations.
To use any of these rights, email hello@arvellalabs.com. We will respond within the time required by UU PDP. Since we hold almost no data about you, many requests will be answered by explaining what is on your phone and how to remove it.
11. Children
Alight is not directed to children under 13, and we do not knowingly collect personal data from them. If you are under 18, please use Alight with the knowledge of a parent or guardian. If you believe a child has sent us personal data, email us and we will delete it.
12. Security
Location and journey data stay in Alight's private app storage, which Android keeps separate from other apps. Network requests made by Alight, including those of the Google Mobile Ads SDK, use encrypted connections (HTTPS/TLS). No method of storage or transmission is perfectly secure, but keeping your data on your device means there is very little to expose in the first place.
13. Changes to this policy
If Alight starts handling data differently, we will update this page and change the "Last updated" date. If the change is significant, we will also tell you in the app before it takes effect.
14. Contact
Arvella Technology Labs