Data has an address
Once your trips, searches or saved places leave your phone, they are stored on a server somewhere. That server sits in a country, and it is run by a company that answers to a country. Both countries’ laws apply to your data.
What can go wrong
- Another government can ask for it. For example, American law lets American authorities demand data from American companies, even when it is stored outside America.
- Malaysian law reaches less far. Malaysia’s Personal Data Protection Act protects you here. Once your data is abroad, enforcing it is much harder.
- It can become a national question. In October 2026 Malaysia told civil servants to uninstall Waze, and urged everyone else to as well, because the company that controls Waze’s data answers to Israeli law. Millions of people’s trips became a matter of policy overnight.
What Malaysian law says
Since April 2025, a company may send personal data out of Malaysia only under set conditions: for example, when the other country’s law protects it in a similar way, or when you have agreed. That came from the Personal Data Protection (Amendment) Act 2024.
What Bound does
- Our rule: anything that stores or processes your data runs in Malaysia, or Singapore at most. Before we add a service, we check where it runs and which country’s law governs it.
- Most of your data never leaves your phone. Saved places, recent searches and your trip diary stay on it.
- We name what’s still abroad. Four services we rely on today are outside Malaysia and Singapore: TomTom (Netherlands) for routes and traffic, MapTiler (Switzerland) for the map, Cloudflare (United States) for our gateway and website, and Proton Mail (Switzerland) for emails you send us. Each gets only what one request needs, and we replace them as we can. The privacy policy lists them all.
Three questions worth asking any app
- Where are your servers?
- Which country’s law governs your company?
- What do you keep about me, and for how long?