OUTR Privacy Policy

Effect Date: 30th June 2026

Imagine Sdn bhd (“Imagine”, “We”, “us”, or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use disclose, retain, and protect your Personal Data when you use the OUTR mobile application and its associated services (collectively known as “Services”)

This Privacy Policy is governed by and construed in accordance with the Personal Data Protection Order 2025 (“PDPO 2025”) of Brunei Darussalam.

1. Data Controller

The Data controller responsible for your Personal Data under this Privacy Policy is:

2. Personal Data We Collect

To ensure complete transparency, the categories of Personal Data we collect correspond With our App Store Connect privacy labels:

3. How Data is collected

We collect your data through three primary mechanisms:

4. Purposes of Data Processing

We process your Personal Data for the following Specific purposes:

1. Providing real-time route tracking and navigation assistance.
2. Enabling live location sharing with your designated “Friends”
3. Generating post-ride activity statistics, performance summaries, and historical logs.
4. Delivering safety features, such as automated alerts when you remain stationary for an unusual period during an active session.
5. Ensuring core app functionality, user authentication, and profile customisation
6. Maintaining security, preventing fraud, protecting community guidelines, and investigating misuse.
7. Complying with applicable statutory, regulatory, and legal obligations in Brunei Darussalam.

5. Legal Basis for processing under PDPO 2025

In accordance with the PDPO 2025, Imagine relies on the following legal bases to process your information:

6. Location Data & Visibility Settings

OUTR is a location-based activity and social application, it handles your geographic coordinates with granular security controls:

Foreground Location: Collected while OUTR is active on your screen to map your current ride and show nearby routes.

Background Location: Collected when the app is minimized or your device screen is locked. This ensures your ride records continuously without dropping telemetry points.

Visibility Privacy Modes: Your location is never shared publicly by default. You maintain full control over who can view your location via the following settings:

• Private (Hidden): Your location data is visible only to you.
• Friends Only: Your location is strictly visible to users you have affirmatively accepted or designated as "Friends".
• Public: Your location is visible to all active users on the OUTR platform map.

Identity Masking: Independent of your visibility mode, you can toggle your display name "on" or "off" to completely anonymize your visual marker on another user's map.

7. Background Location Consent & Withdrawal

Optional Track: Background location tracking is entirely voluntary and is not required to run the core app features.

Obtaining Consent: Consent is obtained through a separate, dedicated pop-up notice within the application requiring an explicit affirmative click ("I Expressly Consent").

How to Withdraw Consent: You can instantly revoke background location permissions at any time without penalty by:

1. Navigating to Settings > Privacy > Location Permissions inside OUTR App and choosing “Foreground Only”.
2. Accessing your mobile device’s operating system settings and removing “Always Allow” location access for OUR.

8. Data Sharing and Third-Party Processors

Imagine does not sell, lease, or rent your Personal Data to any third party. To execute technical delivery, your data is shared with trusted processors contractually bound to comply strictly with the PDPO 2025 and our explicit security directives:

• Cloud Infrastructure & Hosting: Supabase (for secure database execution and user account management)

• Mapping Services: Google Maps API/ Apple Maps (for rendering geographic routes and operational displays).

• Push Notification: Firebase Cloud Messaging / Apple Push Notification Service (APNS) (to dispatch route updates and safety alerts).

9. Data Retention Schedule

Imagine retains your data only as long as necessary for operational or compliance mandates, according to this retention schedule:

10. Data Security Measures

We use robust technical and organizational measures to safeguard your information against unauthorized access, loss, or alteration:

11. User Rights

Under the PDPO 2025, you have following rights regarding your personal information:

How to exercise your rights: You can manage or permanently delete your information directly within the app by going to Settings> Privacy > Delete My Data, or by executing account deletion. Requests can also be filed directly with our DPO.

12. Children’s Data

OUTR is intended solely for users aged 18 and older. We do not knowingly permit use of the Services by, or collect Personal Data from, individuals under 18 years of age, and users are required to confirm their age of at least 18 years before using the Services. If we discover or have reasonable grounds to believe that we have collected Personal Data from a User under 18 years of age, we will suspend or terminate the associated account and delete the relevant Personal Data as soon as reasonably practicable, in accordance with our Terms & Conditions.

13. Data Breach notification

In the event of a security incident resulting in a personal data breach, Imagine will immediately assess the severity and scope.

• If the breach poses a risk to your rights and freedoms, we will notify the appropriate regulatory authority in compliance with PDPO 2025 timelines.

• If the breach presents a high risk to your personal rights and freedoms, we will notify you directly via your registered email address or an immediate in-app warning without undue delay. This alert will outline the nature of the breach, its consequences, and our remediation steps.

14. Cross-Border Data Transfers

Your data may be processed and stored in external cloud hosting infrastructures managed by our authorized processors (such as Supabase cloud environments). While these data centers may be located outside of Brunei Darussalam, Imagine ensures all cross-border transfers are subject to strict contractual protections that guarantee a level of data protection equivalent to the mandates of the PDPO 2025.

15. Changes to the Privacy Policy

Imagine reserves the right to modify this Privacy Policy to reflect changing regulatory interpretations or app upgrades. We will notify you of any material changes via an explicit in-app notification or an email alert at least fourteen (14) days before the changes go into effect. Your continued use of the application after the effective date means you accept the revised policy.

16. Contact Details and Data Protection Officer

For any privacy-related questions, access requests, or data complaints, please contact our data protection team directly:

For general, non-privacy legal issues, please refer to our Terms & Conditions.