← Back

Privacy Policy

Last updated: 22 August 2026

Makan Lah! is a small, independently run food discovery site for Penang. This page explains, in plain language, what personal information the site collects, why it is collected, who else can see it, and what you can ask us to do about it. It is written to meet the notice requirement of Malaysia's Personal Data Protection Act 2010 (the PDPA).

If anything here is unclear or looks wrong, please tell us at edwin9950@gmail.com.

1. Who is responsible for your data

Makan Lah! is operated by Edwin Ooi, based in Penang, Malaysia. For the purposes of the PDPA, the operator is the data user. There is no separate company, group, or data protection department behind this site — it is run by one small team, and questions go to the address above.

2. What we collect, and why

If you answer the welcome questions

Why you are in Penang, what you don't eat (for example halal only or vegetarian), the area or hospital you are based near, and your usual budget are saved only on your own device, in your browser's storage. They are not linked to an account and we do not keep them. They are sent with each search so the results fit them, and are not stored with your search history. We keep the area you tap, never your exact location. Change them with “Edit” or clear them with “Reset” on any results page, or by clearing your browser's site data.

If you create an account

  • Your email address— required. It identifies your account, and it is how we would reach you about your points, a lucky draw result, or a problem with the account.
  • Your password— required, but never stored as you typed it. See section 6.
  • Your name— optional. Used only to address you in the app. You can leave it blank and the account works exactly the same.
  • Whether your email is verified, and the date it was verified.
  • Your activity in the rewards features— your points balance and points history, the restaurants you check in at and on which day, and any lucky draw entries. This is what makes points and draws work; without it we cannot award or count anything.

The account record also has an optional phone number field, kept for a future feature. Nothing on the site currently asks you for a phone number at signup, and it stays empty unless that changes and you fill it in.

If you send feedback, suggest a restaurant, or answer a survey

  • What you wrote — your message, the restaurant you are telling us about, and why you rate it.
  • Contact details, only if you choose to give them— an email address, a phone number, or a social media handle. These fields are optional. We use them to reply to you, to check a detail before we change a listing, or to reach you if your suggestion wins something. You can submit feedback and suggestions without any of them.
  • For our keyword surveys: a name or Instagram handle, again only if you type one in, plus the keywords you picked.

How the site is used (analytics we keep ourselves)

To work out what people are looking for and which listings need fixing, our own database keeps:

  • Searches— the words you searched for, the area, category and tags the search resolved to, how many results came back, and the time.
  • Page views— which restaurant pages were opened, and when.
  • Filter use— which filters were tapped.

These records do not contain your IP address or your browser's user-agent string. We deliberately do not store either one. There is no visitor profile, no advertising identifier, and no device fingerprint in our database. The only identifier these rows can carry is a short session id used to group one visit's activity together, and that id is not linked to your account.

Search text is free-form, so please do not type anything private into the search box — treat it like a public search bar.

Your approximate location

When you open the home page, your browser may ask whether you want to share your location. This is used for one thing: sorting and labelling results by how far away they are, so “near me” means something. If you say no, the site falls back to a default point in Penang and everything else still works.

If you allow it, your coordinates are held in the page while you are using it and sent with your search request so distances can be calculated on the server. Your coordinates are not written to our database — they are not saved in the search log or anywhere else, and they are gone once the request is answered. You can withdraw the permission at any time in your browser's site settings.

Cookies and browser storage

  • A login cookie (jjcm_session) if you are signed in. It holds a random session token, nothing about you, and it expires after 30 days. It is set as HTTP-only, so scripts on the page cannot read it.
  • Your last few searchesand your light/dark preference, saved in your browser's own local storage on your device. These never reach us. Clearing your browser data removes them, and there is a “clear” control on the search history itself.
  • Google Analytics cookies — see section 3.

3. Who else can see your data

We do not sell your personal data, and we do not share it with advertisers or data brokers. The services below are the ones that necessarily touch it in order for the site to run. Some of them store or process data outside Malaysia, which is normal for cloud-hosted services; by using Makan Lah! you accept that your data may be handled outside Malaysia in this way.

  • Neon— hosts the PostgreSQL database. Everything described in section 2 that we keep, lives there.
  • Vercel— hosts and serves the app itself. As with any web host, Vercel handles the network requests your browser makes and keeps its own operational logs of that traffic under its own policies, which we do not control.
  • Google Analytics— loaded on every page to count visits. This is Google's own measurement service running in your browser, and unlike our own analytics it does collect the kind of technical data we do not, including your IP address and browser details, under Google's privacy policy. It does not receive your account details from us. You can block it with a browser setting, an extension, or Google's own opt-out tools.
  • Google Places / Maps API — used from our server, by us, to look up and enrich restaurant information such as addresses, opening hours and photos. It is used on restaurant data, not on you: your account details, feedback and searches are not sent to it.
  • Anthropic API (Claude) — used from our server, in the admin tools only, to help tidy up and fill in restaurant listings. What is sent is restaurant information, such as a name or a Google Maps link. Your account details and your feedback text are not sent to it.

We may also disclose personal data where we are legally required to — for example to a court, a regulator, or the police acting under lawful authority.

4. Is giving us your data obligatory?

Only where we have said it is required. Your email address and a password are obligatory if you want an account, because there is no way to run a login, a points balance or a draw entry without them; if you do not want to give them, you can still browse and search the whole site without an account.

Everything else — your name, any contact details on a feedback or suggestion form, your survey answers, and your location — is voluntary. Leaving those blank or declining them does not stop you using the site; the only consequence is that we may not be able to reply to you, or that distances will be less accurate.

5. Your rights

Under the PDPA you have the right to ask us for a copy of the personal data we hold about you, and to have it corrected if it is wrong or out of date. You can also ask us to stop using it, or to delete your account and the data attached to it. To do any of these, email edwin9950@gmail.com from the address on your account, or tell us enough for us to find your record.

We will get back to you as quickly as we reasonably can. Be aware of two honest limits: we may keep a minimal record of a completed lucky draw or a points adjustment where we need it to show the draw was run fairly, and anonymous analytics rows described in section 2 cannot be traced back to you, so there is nothing in them for us to pull out and delete.

6. How your data is kept

Your password is never stored in plain text. It is put through scrypt, a memory-hard key derivation function, with a random salt per user, and only that result is saved. We cannot read your password, and we will never ask you for it — not by email, not on social media.

Login sessions are stored the same way: only a hash of your session token is kept in the database, so a stolen database copy cannot be replayed as a login. Traffic to the site is served over HTTPS.

We keep your account data for as long as your account exists. Feedback, suggestions and survey answers are kept while they are still useful for maintaining the directory. We do not claim to be certified against any security standard, and no small site can promise it will never be breached — what we can say is what is above.

7. Children

Makan Lah! is not aimed at children. If you are under 18, please get a parent or guardian to agree before you create an account. If you believe a child has signed up, tell us and we will remove the account.

8. Changes to this policy

If the data practices change, this page changes with them and the “last updated” date at the top moves. For a change that materially affects you, we will say so on the site rather than quietly editing this page.

Questions, or want your data removed?

Email edwin9950@gmail.com. You may also want to read our Terms of Service.