Privacy Policy

1. Introduction

This Privacy Policy explains how JomSnap App (“JomSnap”, “we”, “us”) collects, uses, discloses, and protects personal data through the JomSnap service, and applies to Hosts, Guests, TV Display operators, and visitors to this site. JomSnap is committed to complying with Malaysia’s Personal Data Protection Act 2010 (“PDPA”) in the handling of personal data.

2. General Principle — what we collect and why

The personal data we process differs by role:

• Hosts: name, email address, and a securely hashed password (or your Google account identity if you sign in with Google), plus the Event data you create — used to operate your account and Events, and to communicate with you about them.
• Guests: a display name unique to the Event you join, a device identifier stored on your own device, and — only if you set one — a hashed 4-digit PIN used solely to reclaim your display name on a different device. No email address, phone number, or account is ever required of a Guest.
• Content: the photos and guest-book messages you submit, together with the time of submission and, if the Event’s Host has turned on the optional location check, a location verdict (see section 2.1 below).
• TV Display operators: no personal data at all — a paired TV Display is unauthenticated and identified only by a pairing code.
• Site visitors and Contact form submitters: the name, email address, and message you choose to submit through our Contact us page.

2.1 Location data

If a Host enables the optional venue location check for an Event, your device’s location may be read once at the moment you capture a photo, solely to verify you were near the venue. JomSnap stores only the resulting verdict (verified, flagged, or the distance from the venue) — your raw coordinates are never stored, and this feature is entirely off by default.

3. Notice & Choice Principle

This Policy is our primary notice of how personal data is handled. Where a specific feature needs additional data — such as a browser location permission prompt when a Host has enabled the location check — you will see an in-context request from your browser before anything is collected, and you may decline it. Hosts separately choose their own Event settings, including whether AI-assisted moderation and location checks are enabled.

4. Disclosure Principle

We do not sell personal data, and we do not disclose it to third parties for their own marketing purposes. We do share limited data with the following service providers, each acting on our instructions to help operate JomSnap:

• Google — if you choose to sign in or register with Google.
• Brevo — our transactional email provider, used to send account verification, password reset, and co-host invitation emails.
• An AI content moderation processor — only for an Event where the Host has specifically opted a content type into AI-assisted moderation, photo or message content from that Event is sent to this processor to check for policy violations before auto-approval.
• Our hosting infrastructure provider — to store and run the service itself.

We may also disclose personal data where required by law or a valid request from a competent Malaysian authority.

5. Security Principle

We apply reasonable technical and organisational measures to protect personal data, including: passwords and PINs stored only as salted cryptographic hashes, never in plain text; signed, tamper-evident session cookies for Hosts, Guests, and administrators; access to an Event’s data restricted to that Event’s own Host and co-hosts; and an audit trail recording every sensitive administrative action taken on the platform.

6. Retention Principle

Host account data is retained for as long as the account exists. Event data follows the lifecycle the Host chooses: an active Event’s data remains live and browsable; an archived Event freezes new activity but keeps existing Content browsable and exportable; and a deleted Event permanently removes its Guests, photos, and messages, including the underlying stored files. Content that a Host rejects during moderation is hidden from view but not immediately erased from storage, so a moderation decision can be reversed — it remains subject to the same retention rules as the rest of the Event.

7. Data Integrity Principle

We take reasonable steps to keep personal data accurate and up to date. Hosts can correct their account and Event details at any time from their dashboard; Guests can update their own display name and content directly, or by asking their Event’s Host.

8. Access Principle

You may request access to, correction of, or deletion of your personal data. Hosts can manage most of this directly through their account and Event settings. Guests can ask their Event’s Host to correct or remove their Content, or reach us directly via Contact us. We will respond to legitimate requests made under the PDPA within a reasonable time.

9. Cookies

JomSnap uses a small number of functional cookies, and no third-party advertising or tracking cookies:

• a language preference cookie, so the site remembers your choice of English or Bahasa Malaysia;
• a Host session cookie, to keep you signed in to your dashboard;
• a signed Guest identity cookie, scoped to the Event you joined;
• an administrator session cookie, entirely separate from the above and used only by JomSnap platform staff.

10. Children’s privacy

JomSnap is intended for use at events attended by adults and families together, and we do not knowingly operate a service directed at children or knowingly collect personal data from children without appropriate oversight. Joining an Event as a Guest today does not require an age check, so we ask Hosts running events likely to be attended by children to exercise appropriate discretion — for example, over what is shown on a public TV Display — and to supervise participation accordingly.

11. Cross-border data transfers

Where personal data is processed by a third-party service provider (such as an AI moderation processor or hosting infrastructure) located outside Malaysia, we take reasonable steps to ensure that data continues to receive an appropriate standard of protection consistent with the PDPA.

12. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be notified through the JomSnap site, together with an updated “last updated” date on this page.

13. Contact

For any question about this Policy or how your personal data is handled, please reach us via Contact us.