TuJu is the wrong answer to the Waze question — and the bigger privacy risk is the government’s own app

On 20 October civil servants were told to stop using Waze, and the rest of us were urged to switch to TuJu, the highway authority’s app. I think the switch is the wrong answer to a fair question. Here is why — with what 220 Play Store reviews say, what the Israel claim actually rests on, and where the bigger privacy risk really sits.

By the VibeFlow team · 27 October 2026 · 12 min read

On 20 October 2026 a circular from the Chief Secretary to the Government told civil servants to stop using Waze, and the Prime Minister urged everyone else to do the same and move to local alternatives — first among them TuJu, the navigation app the Malaysian Highway Authority (LLM) launched with Prosignal Consortium in November 2025. The reason given is data: Waze Mobile is incorporated in Israel, and its terms are governed by Israeli law.

Who holds the record of where Malaysians drive is a fair question for a government to ask, and I take it seriously. I just think TuJu is the wrong answer to it, for three reasons. A map is never finished, and TuJu has nothing to keep finishing it with. TuJu was not ready for the job it was suddenly given. And the privacy argument, followed honestly, points at a government-run app at least as much as at Waze.

• 1.2★Google Play ratingAbout 5,100 reviews, read 27 October 2026
• 2.5★The same rating five days earlierAs reported by SoyaCincau on 22 October
• 111 of 119Reviews since 20 October giving one starPosted 20–25 October, the week of the push
• 500K+Downloads on Google PlayLaunched 26 November 2025

A map is never finished — and TuJu has nothing to finish it with

Building a navigation app is not the expensive part. Keeping its map true is. Roads open, U-turns close, a mall adds an entrance, a taman gets a new guardhouse, a lane is repainted. A map is only as good as the stream of corrections flowing back into it, and that stream has to be paid for — in surveyors, or in users.

Grab is the clearest example on our own doorstep. When it found in 2017 that the cities it served were badly mapped, it built its own map, GrabMaps, and fed it with what its business produces anyway: rides and deliveries every day, riders mapping alleys a car cannot enter, and drivers and merchants reporting closed roads and changed addresses. The result is good enough that Amazon now offers it to other companies through its cloud.

That is why a delivery app often knows things a general map does not. A shopping mall, a campus or an airport has many entrances and several levels, and a rider who has delivered there a hundred times knows which drop-off point is the right one — so the customer can pick it, and the next rider finds it first time. Every order is a small survey, and the business pays for it by earning money.

TuJu has no such loop. It has no meals, no rides and no parcels — only drivers on highways, who are already served by apps that do have the loop. What it has is a budget, and a budget buys a map once; it does not buy the next ten years of corrections. TuJu was not even building its own map in the first place: coverage of its launch reported that it runs on Google’s mapping data — from the company that has owned Waze since 2013.

Satellite imagery and GPS accuracy do not change that. Anyone can buy the same satellite pictures; what separates a good map from a poor one is the ground truth that comes back from the people using it. Spending public money to rebuild what already exists, without the one thing that makes a map improve, is the part I find hardest to justify.

It was not ready for the job it was given

To be fair to TuJu, it was designed as a highway companion: live toll charges, traffic and CCTV feeds from LLM’s traffic centre, R&R stops and their facilities, and a way to report a crash or a pothole. Those features are useful, and nobody else has the CCTV feeds. Being pushed overnight as the country’s replacement for Waze is a different job, and the reviews show it.

SoyaCincau drove with it after the announcement and published its review on 22 October. Turn-by-turn prompts kept repeating “keep straight” with no context about the exit coming up, one instruction appeared as raw HTML, and there was no live traffic, no speed-limit warning, and no Android Auto or Apple CarPlay. The app stood at 2.5 stars on Google Play that day. Five days later it is at 1.2.

I read every review Google Play listed as most relevant on 27 October — 220 of them — to see what people are actually complaining about. The picture changes sharply at 20 October, the day of the announcement.

Most of those reviews are not about subtle routing choices. They are about search. KLCC, Pavilion, Putrajaya, Hospital Kuala Lumpur, an Aeon mall, the nearest petrol station, the reviewer’s own taman — “no results found”, again and again. When a destination does come up, the next complaint is the one shared widely on social media: the route drawn as a single straight line from where you are to where you are going, as if the car could fly.

Others describe the map not following the car once navigation starts, or the location marker landing somewhere it is not — one reviewer in August, parked for half an hour, was shown sitting in the middle of the Straits of Malacca. A position that jumps instead of moving smoothly along the road is not a cosmetic problem: a driver who cannot trust the marker looks down at the phone more, not less.

One two-star review set out the order of work better than I could: make destination search return real places, draw real driving routes instead of straight lines, and clean up the turn-by-turn — before adding anything else. Those are the basics, and an app should not be recommended to a whole country without them.

An update listed on 23 October promises “faster maps and smoother turn-by-turn navigation”, and TuJu may well get better. My point is not that it can never work. It is that a highway information app was asked, with a few days’ notice, to replace a navigation network that Waze’s users have been building for nearly two decades.

What the Waze claim actually rests on

The case against Waze has two halves. The first is that its terms are governed by the laws of Israel, with disputes heard in Tel Aviv. That is true, and the terms have said so since 2008. The second half — that Israel uses Waze to watch the people who drive with it — is the one that would justify a ban, and nobody has shown it. Snopes looked in July 2026 and found no credible public evidence either way. Google, which owns Waze, calls the claim completely false and says naming the courts of a developer’s home country is standard industry practice.

Unproven is not the same as false, and I am not saying the risk is zero. I am saying that a policy which asks a whole country to change apps should come with evidence, and the statements so far speak of “potential exposure”, not of anything that has happened. If there is evidence, publish it. If there is not, publish the risk assessment that led here.

The bigger privacy question is the government’s own app

This is the part of the argument I cannot get past. If the worry is that a foreign state could, in theory, reach the data of an app incorporated in its country, the same worry applies — more directly — to an app run by our own government.

TuJu asks you to sign in before it will navigate, and its permission screen says location, motion and usage data may be shared with a Malaysian government body for road-user analysis and product improvement. The Personal Data Protection Act 2010 does not apply to the federal and state governments, so the law most of us rely on to control what companies do with our data says nothing about what happens to it there.

Location and motion data over time is, in plain words, a record of where you drove and how fast. I am not claiming TuJu is used that way, and I have seen nothing that says it is. But nothing in its terms rules out that data one day informing where speed cameras or roadblocks go, or whose driving gets a closer look. That is exactly the kind of “potential exposure” the Waze decision was justified by — only closer to home, and with fewer legal limits.

Waze, whatever else is true of it, gives drivers autonomy. It was built on drivers warning each other — about jams, crashes, hazards and, yes, police checkpoints. Here I am speculating, and I want to be clear that I have no evidence for it: I suspect that last feature is part of why the authorities have never been fond of Waze. I would be glad to be proven wrong. Either way, it is an argument for letting drivers choose their own app, not for steering them to one.

Malaysia is not a closed internet

China’s map apps grew up in a market where Google is blocked; they never had to beat it on open ground. Malaysia has no wall. Google Maps, Waze, Grab, Petal Maps and others all work here, and they compete for drivers by getting better. A government-recommended app does not face that pressure in the same way: its users were sent, not won.

There is also the timing. A switch announced on the strength of where an app’s parent company is incorporated, with a replacement that could not yet find KLCC, reads to me more like a political gesture than a cybersecurity programme. If the security case is real, it deserves a better answer than this one.

What I would have done instead

• Set the rule for government phones and government data — that part is reasonable — and publish the risk assessment behind it.
• Write the data-handling rules every navigation app must follow in Malaysia, covering what is collected, where it is stored and who can demand it, and apply them to Waze, Google, Grab and TuJu alike.
• Bring the government’s own apps under the Personal Data Protection Act, or an equivalent law, so the public has the same rights against the state that it has against companies.
• Keep TuJu doing what it is good at — tolls, CCTV, R&R stops and incident reports — and open those feeds to every navigation app, so drivers get LLM’s data in whichever app they already trust.

What we built in VibeFlow — and what we have not

Since I build an app with maps in it, it would be odd not to say how it compares. VibeFlow is a community app, not a navigation company, and I do not claim it replaces Google Maps or Waze. But the complaints in TuJu’s reviews are the same basics we have had to get right, so here is where we stand — split honestly between what is in the app today and what is built but not yet in a store release.

Checked against the app in the stores and our servers on 27 October 2026.

I tested our route engine on 27 October from KLCC to Pavilion: 3.0 km, about five minutes, nine turn instructions along real streets — no straight line. The search in the next update draws on an index of 483,692 road and place names from OpenStreetMap and understands Jln, Lrg, Tmn and Kg. Finding a shop or a landmark by its name is the one place we are no better than anyone else yet — which is exactly why I think it is the first thing any new map app should be tested on, before it is put in front of a country.

Two things matter to me more than any feature. Once that update ships, routes are calculated on our own server, so a trip will not depend on Google. And every location feature is already off until you turn it on, with only your latest position kept. The full rules are in our post on what the app does with your location.

So, should you delete Waze?

If you are a civil servant, the circular is addressed to you, and you should follow it. For everyone else it is a request, not a law. My own view: keep the app that gets you there, read the privacy settings of whichever one you use, and give TuJu another look when it can find KLCC and draw a road. Which navigation app to trust is each driver’s own decision — and that freedom is worth more than any one app.

Sources

1. Waze ban for civil servants to prevent data misuse by Israeli regime, says PMO — The Star, 21 October 2026
2. From Waze to TuJu? Anwar backs Malaysian navigation app over data security concerns — Malay Mail, 20 October 2026
3. Find another way: civil servants effectively banned from using Waze app due to Israel ties — Malay Mail, 21 October 2026
4. Tuju review: can Malaysia’s navigation app replace Waze? — SoyaCincau, 22 October 2026
5. Most users game for TuJu, if it works well — The Star, 22 October 2026
6. Fact check: inspecting claim Israel controls Waze, surveils app’s users — Snopes, via Yahoo Tech, 15 July 2026
7. TuJu highway navigation app debuts with real-time traffic, toll and CCTV features — Malay Mail, 26 November 2025
8. TuJu app goes live with real-time traffic, toll and emergency tools — carz.com.my, November 2025
9. Uncharted no more: how Grab built its mapping tool GrabMaps — Frontier Enterprise
10. GrabMaps in Amazon Location Service — Amazon Web Services
11. TuJu on Google Play — rating, release notes and reviews — Google Play, read 27 October 2026