Privacy policy

In plain language

We keep a phone number, language, consents, and type/body/status. The story, chat and files are encrypted with a key on your device. Operators cannot read content. Disability and health data are sensitive — only with a separate tick. On the settings screen you can download your data or delete the account. Only approved cloud and AI vendors, without training on your content.

Full text

1. Controller. The site operator is the database controller for Israel’s Privacy Protection Law, 5741–1981, including Amendment 13 and regulations under it, and other applicable Israeli law. Where GDPR-style rights apply to a data subject in the EU, rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent will be honoured as required.

2. What we collect. Israeli mobile number; email address if you choose an email code or a test send; interface language; consent log (key, version, time, language — not the complaint story); complaint metadata: type, body name, branch, status, timestamps; per-recipient send status, send/delivery/response timestamps, a closed topic category and an outcome mark (resolved / partial / unresolved) without the letter body; if you paste or upload a reply — metadata and ciphertext only, unread by operators; one-time-code delivery logs (channel and vendor, not the code); minimal technical session data (session cookie).

3. What is encrypted. Chat content, complaint facts, drafts, file names, file bytes and extracted text are encrypted with a per-user data key. That key is wrapped with a wrapping key kept on your device, and a recovery copy is wrapped with a recovery code shown once. A database dump plus the application environment variables is not enough to read the content. Operators of the admin screen see counts only.

4. Especially sensitive data. Information about disability, health, medical treatment or welfare services is especially sensitive under Amendment 13. It is processed only with a separate explicit consent, to prepare the draft for you.

5. Purposes. Operating the account; preparing a draft; encrypted storage; sending an approved draft to recipients you confirmed, one at a time, or showing an official form to copy; recording a response timestamp if inbound mail is configured or you mark a reply yourself; storing an encrypted copy of a reply you paste; outcome feedback via a no-login link; technical help; security and abuse prevention; anonymous statistics and aggregate oversight files only if you explicitly agree. Those files are generated, not emailed automatically.

6. Legal bases. Consent; performing your request to prepare a draft; a narrow legitimate interest in security; a legal duty if one arises.

7. Processors. Application hosting (for example Vercel); database (Neon PostgreSQL); SMS (Brevo) if enabled; email (Resend) for one-time codes and approved complaint mail, and if configured an inbound webhook that stores only a timestamp, never the reply body; approved AI models only, according to configured keys: Anthropic, OpenAI, Google Gemini, xAI — for wording, questions, image text extraction and proposing recipients from the directory. Commercial API settings are used so content is not used to train models. Data is not sent to an unapproved provider.

8. Transfers. Vendors may process outside Israel. Appropriate processing terms will be sought.

9. Retention. An active account — while you use it or until you delete it on the settings screen. One-time codes — a few minutes, as a hash only. Consent logs — as needed to record consent. Deleting the account removes your complaints, files, consents and sessions. We log only an aggregate deletion count, with no user id, phone or email. If an automatic retention period is set (DATA_RETENTION_DAYS, a positive number of days), accounts that have not signed in for that many days are deleted the same way. Default: no automatic deletion. After deletion, decryption is not possible.

10. Rights. Access, correction, deletion, restriction, portability where feasible, withdrawal of consent for the future, and a complaint to Israel’s Privacy Protection Authority. Use the settings screen to download all your data or delete the account, after confirmation. Withdrawing sensitive-data consent means we stop processing new content; existing drafts are deleted on request.

11. Cookies. A necessary session cookie only, httpOnly. No targeted advertising.

12. Security. Encryption at rest for content; hashing of codes and sessions; per-user keys; file limits; security headers. No security is absolute.

13. Children. The service is not aimed at minors without an adult.

14. Changes. Policy updates will be published on the site with a date. New consents will be required if the substance changes.

15. Contact. Help button on the site. A complaint to the Privacy Protection Authority — as provided by law.