1. Who we are and what this policy covers

"Avoda BeDaka 90" (Hebrew: עבודה בדקה 90) is a mobile app that connects job posters — businesses and private individuals — with available workers nearby, for shifts and urgent short-notice work. The service is operated by רותם פרץ ("we", "us").

This policy covers the Android app (package il.co.avodabedaka90), the iOS app under the same identifier, and the backend services behind them. It does not cover third-party websites or apps that a link in our app may take you to.

Privacy questions, rights requests and deletion requests: rotemimi10@gmail.com.

2. Summary

3. What we collect

All data comes either directly from you (what you type or approve) or from your device. We do not obtain data about you from outside sources.

3.1 Account and sign-in

3.2 Profile

3.3 Jobs, matching and assignments

• Jobs you post: title, description, category, free-text address, the precise coordinates of the workplace, start time, duration, pay type and amount, urgency, number of workers needed, status, additional details, and whether the job is recurring.
• Matches and offers: which workers a job was offered to, in which dispatch wave, the distance in metres between worker and job at the time of the offer, and offer/response timestamps.
• Applications and assignments: who applied, who was selected, who confirmed, confirmation/start/completion timestamps, and shift progress status.
• Cancellations: who cancelled, in which role, the reason, how many hours before the shift, and the effect on the reliability score.
• Earnings summaries: calculated from the jobs you completed. We do not move money between the parties and we do not see payments made outside the app.

3.4 Chat

• Message text, sender id, sent timestamp and read timestamp.
• Images sent in chat are stored in a private file bucket named chat-images, in a folder keyed by job id. Access is restricted to the parties to that job, and images are served through a temporary signed link valid for 8 hours that is re-issued on each view. This bucket is not public.
• Profile photos are stored in the avatars bucket. That bucket is public: anyone holding the image URL can view it without signing in.

3.5 Notifications

• An Expo push token and the platform (ios/android), stored when the device successfully registers for notifications. The token identifies the device for delivering notifications only.
• A history of notifications sent to you: type, title, body, accompanying data (such as a job id) and whether they were read.

3.6 Trust, ratings and safety

• Ratings (1–5) and reviews you wrote and that were written about you, including who rated whom and when.
• User reports: who reported, about whom, on which job, and the reason.
• Blocks between users.

3.7 In-app purchases

Job posters can buy job-posting packages. Payment details never reach us — the transaction is handled entirely by the Apple App Store or Google Play. What we store is: the product id, the number of posting credits added, the price and currency reported by the store, the store name, transaction identifiers, the purchase environment (production or sandbox), the RevenueCat event id, and the remaining credit balance on the account.

Note: in this version, in-app purchases are active on iOS only; the Android app does not initialise the purchase component, so no purchase data is produced there.

3.8 Technical data

• IP address and basic connection data are recorded in our infrastructure providers' server logs, for security and reliability.
• Your session token is stored locally on your device so you do not have to sign in every time. The name returned by Apple (if you signed in with Apple) is also stored locally so that it is not lost.
• The app checks Expo's update service for a software update; that request includes your IP address and the app version.

4. What we do not collect

• The app contains no analytics tools, usage-measurement tools, ad networks, advertising identifiers or install-attribution SDKs.
• We do not collect national ID numbers, bank account details or credit card details.
• We do not read your contacts, call log, messages or photo gallery. An image is uploaded only when you pick it yourself.
• We do not request camera or microphone permission, and there is no audio or video recording.
• We do not collect background location (see section 5).

5. Location — in full

5.1 Foreground only

The app requests "while in use" location permission only. It neither requests nor receives background or "Always" location permission, and it does not declare the ACCESS_BACKGROUND_LOCATION permission. In other words: when the app is closed or in the background, it cannot read your location.

5.2 When location is read

• When a worker turns availability on: a single fix is taken so we can find nearby jobs for you.
• On the active-shift tracking screen: while that screen is open and the shift is in an active state (on the way / arrived / arrival confirmed / arrival disputed / working), a fix is taken roughly every 25 seconds. The moment the shift ends or you leave the screen, the updates stop.
• When a poster creates a job: the workplace can be set from the current location, from an address search, or by dropping a pin manually on the map.

If you decline location permission the app still works, but we cannot show a worker jobs by proximity or turn availability on.

5.3 What is stored

• Only the worker's single most recent location point is stored, together with the time it was taken. Each new fix overwrites the previous one — we do not keep a movement history or a trail.
• The workplace location entered by the poster is stored per job.
• The distance in metres between worker and job at the moment of the match or application is stored.

5.4 When location is revealed to the other party

5.5 Turning coordinates into an address

To show a readable address instead of coordinates, the app uses the operating system's geocoding service (Apple on iOS, Google on Android). In addition, when a poster types into the address-search field, that text is sent to the OpenStreetMap Foundation's Nominatim service. See section 8.

6. What the other party sees, and when

Disclosure is staged: more details are revealed as the engagement progresses, and not before.

7. Why we use the data

We do not carry out automated profiling with legal effects on you, and we do not make such automated decisions.

8. Service providers and third parties

These are the only providers we use. Each receives only what its role requires:

We may also disclose data where required by law, court order or a demand from a competent authority, or to protect the rights and safety of users. We do not sell personal data and we do not pass it to advertisers.

9. Where data is stored

The database, authentication system and files are hosted with Supabase in the eu-west-1 region (Ireland, European Union). Some of the providers in section 8 — including Expo, Apple, Google and RevenueCat — also process data outside Israel and the EU, including in the United States. By using the service you are aware of this.

10. Security

• All traffic is encrypted with TLS.
• The database enforces Row-Level Security: every table defines who may read and write each row. Sensitive operations run through controlled server functions that check who is asking and what they are allowed to see — so even a direct request to the server cannot expose data that is not yours.
• Chat images live in a private bucket restricted to the parties to the job, and are served through temporary signed links.
• Passwords are stored hashed by our authentication provider and are not accessible to us.
• No system is completely immune. If we identify a security incident affecting personal data, we will act in accordance with applicable law.

11. Retention and deletion

• Account and profile data are kept for as long as the account exists.
• Job, assignment, chat and rating data are kept for as long as they are needed for both parties' history — and are deleted when the related job or account is deleted.
• Purchase records are kept for as long as the account exists; the store (Apple/Google) keeps its own records under its own policy.
• You can delete your account at any time from inside the app. Deletion is immediate and irreversible.

12. Age

This is an employment-related service intended for adults aged 18 and over only. The app is not intended for or directed to children, and we do not knowingly collect data about children. If you become aware that a minor has provided us with data, contact rotemimi10@gmail.com and we will delete it.

13. Your rights

• Access and correction: all profile details can be viewed and edited from the profile screen in the app.
• Deletion: full account deletion is available in the app (Settings → Delete account), or by email.
• Copy of your data: you can request a copy of your personal data at the address below.
• Withdrawing permissions: location and notification permissions can be revoked at any time in your operating system settings.
• Complaints: in Israel you may contact the Privacy Protection Authority. If you are in the EU you also have GDPR rights, including the right to lodge a complaint with your national supervisory authority.

14. Changes to this policy

We will update this policy from time to time. The update date appears at the top of the page. We will notify you in the app or by email before a material change takes effect.

15. Contact

רותם פרץ
Email: rotemimi10@gmail.com
We respond to privacy enquiries within 30 days at the latest.