Privacy Policy
KL.my Bus Tracker is a free public tool with no accounts, ads, or payments. This page explains what data flows through the site when you use it.
Data we collect directly
Server logs — your IP address appears in standard server logs when your browser makes requests to our server. Used for security and debugging, deleted within 90 days, not shared.
Cookies
We do not set any tracking or analytics cookies. This site uses Cloudflare for DDoS protection — these cookies are set automatically by their network, not by us, and cannot be disabled without dropping Cloudflare entirely:
- __cf_bm — bot management, expires after 30 minutes
- _cfuvid — rate-limiting on shared IPs, session only
- cf_clearance — set only if Cloudflare presents a browser challenge
These cookies are set by Cloudflare, not by us, and are classified as strictly necessary for security. They do not track you across websites and do not require your consent under GDPR, but we are required to disclose them. See Cloudflare's cookie policy.
Third-party services
- Carto — map tiles load directly from your browser. They see your IP address.
- OpenStreetMap / Nominatim — map data source and trip planner geocoding (fallback). Requests go directly from your browser; IP is anonymised to 2 bytes.
- WeatherAPI — weather data, fetched server-side. Your IP is not shared.
- data.gov.my — RapidKL bus feed, fetched server-side. Your IP is not shared.
- Railway — our hosting provider. All traffic passes through their infrastructure.
- Cloudflare — CDN and DNS for our domain. All traffic passes through their network for DDoS protection.
Trip planner
The trip planner feature is optional and only active when you submit a route query. Place names you enter are sent to MapTiler (if a MapTiler API key is configured) or Nominatim/OpenStreetMap (fallback) for geocoding. We do not store your queries. The resulting coordinates are sent to our server to calculate a route — only the coordinates, not the original text.
Data retention
- Server logs (IP addresses): deleted within 90 days
- Bus GPS data (public infrastructure data, not personal): retained for historical analysis
- Trip planner queries: not stored
Questions: privacy@seevasantindran.com
Last updated: 22 May 2026