Privacy Policy

KTM Watcher ("we", "us") is a train seat-alert service for KTMB intercity trains, run by an independent Malaysian developer — not a company. We're not affiliated with, endorsed by, or connected to KTMB. This policy explains what we collect, why, and how you can control it.

Contact: [email protected]

1. Information We Collect

• Account: If you sign up with email and password, we store your email as plain text (needed to log you in and send alerts) and your password as a secure hash — never in plain text. If you sign up with Google, we store the name and email Google gives us.
• Watches: The routes, dates, passenger counts, class preference, and departure windows you set up for monitoring.
• Notification channels: Telegram chat ID and link time (never your phone number), and a browser push subscription token — whichever channels you connect.
• Technical data: Standard server logs (timestamps, errors) to keep things running. Dismissed on-screen prompts are remembered locally in your browser only, never sent to us.
• What we don't collect: No payment or billing information (the Service is free). No KTMB login credentials — monitoring works anonymously. If we ever add an opt-in feature to securely store your own KTMB login for better alerts, it will stay opt-in, encrypted, and used only for your own watches.

2. How We Use It

To run your account and watches, send alerts through your chosen channels, fix delivery problems, and notify you of essential updates. We never sell your data or use it for advertising.

3. Public Status Page

Our live feed at ktmwatcher.com/status shows recent seat openings on popular routes, built entirely from anonymous, aggregated data — never anything that identifies you.

4. Who We Share Data With

We share only what's needed to run the Service, and never sell it: Railway hosts our database and cache; Telegram delivers alerts via your chat ID; and Google handles sign-in if you choose that option. No other third parties see your data.

5. Data Retention

Account and watch data is kept while your account is active. Seat history used to improve alert accuracy is retained for analysis but isn't personally identifying beyond your watches. Status feed entries are dropped after 24 hours and never tied to a user. Deleting your account permanently removes your watch data, seat history, Telegram link, and credentials.

6. Your Rights

Under Malaysia's PDPA, you can request a copy of your data, ask us to correct it, delete your account (Section 5), or disconnect a notification channel any time from your dashboard. Contact [email protected] to exercise any of these.

7. Security

Passwords are hashed, never stored in plain text. We don't require or store your KTMB credentials. Admin tools are restricted to the Service operator. No system is 100% secure, but we take reasonable steps to protect your data.

8. Children's Privacy

Not directed at children — we don't knowingly collect data from anyone under 13.

9. Changes to This Policy

We'll update the date above as the Service evolves, and notify active users of any material change.

10. Contact

Questions? Email [email protected].