Privacy Policy

JomMakan helps people discover Malaysian street food stalls, submit missing stalls for review, contribute community photos, and let verified merchants manage stalls they own.

Browsing public stall listings, maps, categories, stall details, reviews, and navigation links does not require a JomMakan account.

When you use JomMakan, the app may store the information needed to run the current product:

• Account information through Supabase Auth, such as email address, authentication provider, and user ID.
• Google sign-in information provided through Supabase Auth when you choose Google authentication.
• Anonymous contributor identity IDs created by Supabase when you submit a stall without creating a permanent account.
• Community stall submissions, including stall name, category, description, address or location description, latitude, longitude, opening hours, submission status, contributor type, and review status.
• Community photo uploads, including private Storage paths, upload reservation records, moderation status, and review metadata.
• Merchant account information, including business name, contact name, phone number if provided, email address, merchant profile status, claims, and owned-stall records.
• Reports and comments submitted on stall pages, including report type, optional note, author name for comments, comment text, and timestamps.
• Admin review records, such as reviewer IDs, reviewed timestamps, approval or rejection status, and admin notes where used.

JomMakan stores stall coordinates and location descriptions so stalls can appear on the map and users can open Google Maps or Waze navigation.

If you use your browser's current-location feature, the browser asks for permission. The app uses that location to help sort nearby stalls or help position a submission pin. The current code does not store your live device location as a user profile field.

Merchant official cover photos and community-contributed photos are separate. Community photos are uploaded to private Supabase Storage, reviewed by admins, and only approved photos are shown publicly through signed URLs generated by the app.

Pending or rejected community photos are not intended to be public. Admins may view pending community photos for moderation.

We use information to operate JomMakan, including showing stall listings, handling account sessions, enforcing contribution limits, preventing duplicate or abusive submissions, reviewing community content, supporting merchant claims and owned-stall management, and protecting admin-only moderation workflows.

We do not currently use app-level analytics, advertising trackers, marketing pixels, or advertising networks in the codebase.

JomMakan uses Supabase for authentication, database records, row-level security, and Storage. Google OAuth is used only when you choose Google sign-in. Public map tiles and map interactions use Leaflet with OpenStreetMap. Navigation links may open Google Maps or Waze outside JomMakan.

JomMakan is designed to be deployed on Vercel. Infrastructure providers may process technical information needed to host and secure the app.

Approved stall information, approved community photos, public reports where surfaced, and comments on stall pages may be visible to other users. Pending community submissions and moderation records are limited by the app's access controls.

We do not sell personal information. We do not add third-party advertising or analytics sharing in the current app.

JomMakan uses Supabase authentication, row-level security policies, protected server routes, private Storage for community photos, and role records for merchant and admin access. Authentication alone does not make a user a merchant or admin.

No system can be guaranteed completely secure, so please avoid submitting sensitive personal information in stall descriptions, reports, comments, or photos.

You can contact us to ask questions or request help with account or contribution information. Some records may need to be retained where required for security, moderation, fraud prevention, or database integrity.

Contact: jommakan.co@gmail.com