KejarWho we are
Kejar is operated by Auraprima Global (M) Sdn Bhd (SSM 202001023908 (1380228-X)), No 14A, Jln Kencana 1A/21, Tmn Pura Kencana, 83300 Sri Gading, Batu Pahat, Johor, Malaysia. Contact us at [email protected].
Data we collect
| Type | Examples | Why |
|---|---|---|
| Account | Email, username, name, password (hashed), profile photo, bio | Your account and sign-in; announcement and weekly summary emails only if you turn them on in Settings, Notifications |
| Profile | Date of birth (required: Kejar is for people aged 13 and over). Optional: gender, state, city, weight, height, maximum and resting heart rate | The age limit; age and weight groups on leaderboards; training zones; calories; state league |
| Precise location | GPS points while you record an activity and while Beacon is on; your position when you look for nearby segments, clubs, events or suggested routes, search, or check the weather while the app is open; privacy zones you set | Distance, pace and segments; maps; finding things near you; sharing your location with people you choose |
| Fitness and health | Activities, duration, distance, elevation, heart rate from Bluetooth sensors you connect, cadence, power, calories, strength sets, goals, training plans. Workouts from Apple Health or Health Connect that you pick, or that come in automatically when you turn on auto import (route where the phone provides one, heart rate, distance, steps, calories). Weight, date of birth, sex and resting heart rate only when you choose Complete your profile and confirm. When you turn on Send to Apple Health or Health Connect, the activities you record are written there as workouts. Kejar never uses this data for advertising and never shares it | Statistics, progress, personal records, challenges |
| Your content | Photos, titles, descriptions, comments, posts, gear, messages and images in messages, clubs, athletes you follow, the Beacon alert contacts you save (name and email address, or the athlete you pick), GPX, TCX and FIT files you import, the Strava export ZIP you upload | Showing it according to your privacy settings; alerting the contacts you chose |
| Purchases | Plan, store transaction ID, renewal date, receipts. We never receive card numbers: payment is handled by Apple and Google | Unlocking Kejar Plus, receipts, refunds |
| Support | Tickets, emails to us, attachments | Helping you |
| Device and usage | App-generated device ID, model, system and app version, push token, IP address, screens opened, response times, crash counts, battery level while Beacon is on | Account security, push, fixing problems, usage statistics |
We do not sell your data, do not show ads and do not track you across other apps or websites.
Who sees your activities
You choose who can see each activity: everyone, followers, or only me. Accounts can be private. Privacy zones and hiding the start and end trim the map other people see. Only-me activities never appear in feeds, leaderboards or heatmaps.
Beacon and safety alerts
Anyone holding a Beacon link can open it until the link ends. If you press SOS, or do not check in by the time you set (after a short grace period), Kejar sends an alert to the alert contacts you saved, with a link to your live location. The location shown is the last one your phone sent. That link, and the view of anyone who can see you only because of the alert, ends when you mark yourself safe or stop, or when you check in after a missed check-in. Checking in does not end an SOS.
Kejar tells an email contact when you add them (at most a few such notices per address each day), unless they have already stopped these emails. Each email has a link to stop these emails for good, even after you remove them, for you alone or for every Kejar athlete.
Alerts are not guaranteed to arrive: they depend on email and push delivery, and on your contacts. After the first alert, further SOS notices can be a few minutes late, and the number of alert emails is limited each day, for each athlete and for each email address: emails over the limit are not sent. Kejar does not call emergency services and nobody at Kejar watches these alerts. In an emergency, call 999.
Kejar staff
Staff can see account data for support and safety, and every significant access is recorded. The text of private messages is revealed to staff only when that message is reported, with a recorded reason. Staff never see Beacon coordinates or the true points of your privacy zones, and see only how many alert contacts you saved, never who they are.
Third parties
- Apple and Google: sign-in, purchases and push delivery (Apple Push Notification service, Firebase Cloud Messaging).
- Resend, our email provider: verification codes, receipts, support replies and safety alerts to the contacts you chose.
- Cloudflare: network and site protection.
- Open-Meteo: weather and elevation. For weather, only the centre of an area of about 5 km is sent; for elevation, coordinates are rounded to about 11 m, without your identity.
- Map provider: your phone downloads map tiles directly from the provider, which sees your IP address and the map area you open.
- Route builder: routes are worked out on our own server with open-source software and OpenStreetMap data. The points you tap are not sent to any other company.
Some of these providers process data outside Malaysia. These providers are bound to give your data protection equal to this policy.
How long we keep data
Data is kept while your account exists. Activities you delete are removed permanently within 30 days. A Strava export ZIP is deleted once its files are read, and an upload you abandon is deleted within a day. Operational logs are removed on a schedule: app events after 180 days, notifications after 180 days, push logs after 60 days. Audit log entries move to a closed archive after 365 days and are kept for 2 years; some keep an email address as a record of who was involved. A message you unsend, or that staff remove, keeps its text and images for 30 days for safety review, and longer only while a report on it is open. The edit history of a post is kept for staff, and images removed from a post are kept for 90 days. Transaction records are kept for 7 years, as Malaysian tax and company law requires.
Your rights
- Download your data: Kejar app, Settings, Download my data.
- Correct your data: Settings, Edit profile.
- Delete your account: Settings, Delete account, or without the app. The account is deleted after 14 days.
- Withdraw location, camera, motion, Bluetooth, notification, Apple Health or Health Connect permission in your phone settings at any time.
- Questions or complaints: [email protected].
Children
Kejar is for people aged 13 and over. If you believe a child under 13 has signed up, contact us and we will delete the account.
Athletes under 18 get extra protection: their activities and messages can never be opened to everyone, only people they follow can message them, they are never added to challenge group chats, and the map of a new activity starts hidden. Read our Child Safety Standards.
Security and changes
Data is encrypted in transit (HTTPS). Passwords are hashed, and photos are processed again so their location metadata is removed. We will tell you about major changes to this policy in the app.