top of page

Privacy Policy — MyCuriousTrip App

Last updated: October 7, 2026

1. Who we are

The MyCuriousTrip mobile app is published by ABC Curious Enterprise (trading as Mycurioustrip), a company registered in Malaysia under SSM number 202403266288 (MA0322698-A), with registered address at No 20, Jalan Eco Grandeur 2/1F, 42300 Bandar Puncak Alam, Malaysia.

For any question about this policy or your personal data, contact us at: contact@mycurioustrip.com.

2. Who this app is for

MyCuriousTrip is intended for travelers who have paid for a tailor-made itinerary for a trip to Malaysia. Access is granted through an account created by our team after your purchase: we send you (by WhatsApp or email) your sign-in address and a personal access code. This is not an app open to free sign-up for browsing offers.

3. What data we collect

We only collect the data necessary to operate the app:

  • Account data: your email address and a personal access code, generated by our team and sent to you. This code works as your password; it is stored in hashed form by our authentication provider, so we cannot read it back, only generate a new one if needed. We may revoke this access once your trip has ended.
  • Profile data: your first and last name, as entered when your trip is created.
  • Your trip content: the itinerary, accommodations, transport, local contacts, and guide recommendations tied to your booked trip — prepared by our team as part of the service you purchased.
  • Session tokens: technical access/refresh tokens used to keep you signed in, stored securely in your device's Keychain.
  • Local offline copy: if you choose to ("Make available offline"), a copy of your trip and its photos is saved locally on your device for offline viewing. This copy stays on your device and is not sent to any third party.

We do not collect: your real-time location (map markers show your itinerary's stored coordinates, not your live position), advertising data, usage data for marketing analytics, and the app includes no third-party analytics or tracking SDK (no Firebase, Sentry, Mixpanel, or similar) and no cookies (this is a native app, not a website).

4. How we use this data

Your data is used exclusively to:

  • authenticate you and give you access to your own trip, and only your own trip;
  • display your itinerary, accommodation, transport, contacts, and guide information;
  • let you consult your trip offline if you choose to;
  • keep your account secure (session renewal, detecting unauthorized access).

Our system is built so that no traveler can ever access another traveler's data: each account only ever sees the information for its own published trip.

5. Legal basis for processing

  • Malaysia (PDPA 2010): processing is based on performance of the contract for the creation of a tailor-made itinerary that you entered into with Mycurioustrip, and on your consent when creating your account.
  • European Union (GDPR), where applicable to your situation: processing is based on contract performance (Article 6(1)(b)) to deliver the service, and on our legitimate interest in account security (Article 6(1)(f)).

6. Data sharing

We do not sell or rent your data to third parties. Your data is hosted and processed by the following technical providers, acting as processors under our instructions, solely to operate the app:

  • Vercel Inc.: hosting for the back-office application and API (mytravelstudio-app.vercel.app). Server functions run in Washington, D.C., USA (region iad1).
  • Supabase: database, traveler account authentication, and secure photo storage (signed, temporary URLs). Data is hosted in Singapore (AWS region ap-southeast-1).

These providers may not use your data for any purpose other than delivering these services. Because your data is hosted in Singapore and processed in the United States, outside the European Union, it is subject to international transfers; if you reside in the EU, these transfers are covered by the contractual safeguards of our processors.

7. Data retention

Your account data and trip content are kept for as long as needed for your trip, then for 12 months after the trip ends, unless you request earlier deletion.

8. Your rights

Whether you're covered by Malaysia's PDPA or the EU's GDPR, you have the following rights over your personal data: access, rectification, erasure, restriction of processing, portability, and objection. To exercise any of these rights, email us at contact@mycurioustrip.com; we will respond promptly and within applicable legal deadlines.

9. Security

Communication between the app and our servers is encrypted (HTTPS/TLS). Session tokens are stored in your device's secure Keychain, never in plain text. Access to each trip's data is strictly limited to the traveler concerned, enforced by our server-side security rules.

10. Children

The app is not designed for independent use by minors. Creating a trip and inviting travelers is handled by the person who booked the trip, typically an adult.

11. Changes to this policy

We may update this privacy policy to reflect changes to the app or to applicable law. The "last updated" date at the top of this document reflects the latest revision. We will notify you of material changes via the app or by email.

12. Contact

For any question about this privacy policy or your personal data:

ABC Curious Enterprise (Mycurioustrip)

No 20, Jalan Eco Grandeur 2/1F, 42300 Bandar Puncak Alam, Malaysia

SSM: 202403266288 (MA0322698-A)

Email: contact@mycurioustrip.com

bottom of page