Privacy
Privacy at mylaw.my
mylaw.my is a free, public interface for Malaysia law. You can read the entire corpus without an account. This page says exactly what is collected when you do, who it reaches, and what you can ask us to do about it.
01 · What we collect
If you never sign in
No account, no name, no email address. Reading is anonymous. What still happens is analytics (below), the reading-limit cookie (below), and advertising (below).
If you create an account
We store your email address, a display name, and either a hashed password or the identifier your sign-in provider (Google) returns. We never receive or store your Google password. Sign-in sessions record the IP address and browser user-agent of the session, which is how a session can be recognised and revoked.
Tied to that account we also store the laws you save, any API tokens you create for AI access, your assistant conversations, and a per-day count of assistant messages used for the fair-use limit.
Analytics
We use PostHog to understand which pages are used and how fast they load. It is configured tightly, and these are the actual settings:
- — All text is masked. Session recordings replace every piece of on-page text and every form input with placeholders. What a recording shows is layout and interaction, not content.
- — URLs are stripped. Query strings and fragments are removed before an event is sent, so what you typed into the search box does not leave your browser as part of an analytics event.
- — No console capture. Browser console output is not recorded — it is the one place page text could otherwise appear verbatim.
- — No analytics cookie. PostHog is set to in-memory storage, so it does not persist an identifier on your device between visits.
- — Do Not Track is respected. With DNT enabled in your browser, no analytics events are sent.
- — Signed-in events carry an ID, not a person. After you sign in, events are associated with your account's internal ID only. Your name and email are never sent to PostHog.
What you send us on purpose
If you report an issue, suggest a correction, or use the AI assistant, the text you write is transmitted and processed so we can act on it. Assistant questions are sent to our model provider to generate an answer. Do not put confidential or personal information into these boxes — they are for the law, not for your matter.
Abuse prevention
Anonymous submissions are rate-limited. To do that we store a salted SHA-256 hash of your network address — never the address itself — and delete those counters on a rolling basis.
03 · Advertising
mylaw.my is free to read, and advertising is what pays for the hosting and the ingestion pipeline behind it.
- — Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites.
- — Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the internet.
- — You can opt out of personalised advertising by visiting Google Ads Settings.
- — You can opt out of some third-party vendors' use of cookies for personalised advertising at aboutads.info.
Advertising is never targeted using the content of the laws you read, because we do not send that content to any ad network. Google's own handling is governed by the Google privacy & terms.
05 · How long we keep it
Account data and saved laws are kept until you ask us to delete them. Sign-in sessions expire on their own. The reading-limit cookie lasts two days. Rate-limit hashes are swept continuously. Corrections and issue reports are retained as part of the corpus' audit trail, because the record of why a legal text changed has to outlive the request that changed it.
06 · Your rights
You can ask for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete your account and everything tied to it. There is no self-service delete button today — ask through the form below and we will action it.
You can remove saved laws and revoke API tokens yourself at any time from your account. Clearing your browser's cookies and site data removes the reading-limit cookie and the theme preference.
mylaw.my is not directed at children, and we do not knowingly collect data from them.
07 · Contact & changes
For any privacy or data request, use the feedback form. It reaches us directly and is the channel we actually monitor.
If this policy changes materially we will update this page. Nothing here is legal advice — see methodology for how the legal text itself is sourced and verified.