Privacy Policy

Last updated: August 31, 2026

Am Echad ("we", "our", "the app") is a community safety network for Jewish communities. Anyone can create an account to receive real-time safety alerts; posting reports and other full-member features are unlocked with an invitation code. This Privacy Policy explains what we collect, how we use it, and the choices you have. We've designed the product with privacy first; most fields are optional, and the rest are kept only as long as they are needed to serve you.

What we collect

Account & identity

• Phone number: used once during sign-up to send a one-time verification code (via Twilio Verify). After you complete sign-up, we keep only an HMAC-SHA256 hash of the number on your account row — the plaintext phone is discarded.
• Nickname & region (optional): shown in comments, mentions, and chat headers. You may leave them blank, edit, or remove them at any time from the More tab.
• Device-bound public key: created during biometric set-up so we can verify future sign-ins. The private key never leaves your device's secure enclave.

Location

• Home location (when you enable location): stored as a single GPS point and a personal notification radius. Used only to fan out geofenced alerts to people near a reported incident — never shared with other members.
• Background location (only if you grant "Always" permission): amehad is a real-time safety app, so with your permission it updates your latest location in the background — even when the app is closed — so that alerts about a protest or danger can reach you before you walk into it while you are on the move. We keep only your single latest point (no location history or trail), use it solely to decide which nearby alerts to send you, and never share it with other members. You can decline background access and still use the app with foreground-only location, or turn location off entirely in your device settings at any time.
• Incident location: latitude/longitude of an incident you report. Visible to other members on the map.

Notifications

• Push token: an opaque Expo Push token used to deliver alerts to your device. Cleared automatically when you uninstall the app.
• Quiet hours (optional): the time window in which non-critical notifications are muted. Stored as two hours plus your IANA time zone — never the contents of any message.

Content you create

• Incident reports: title, description, category, severity, photos, and location. The description is encrypted at rest with AES-256-GCM. Photos you attach are uploaded to Cloudinary or Cloudflare R2.
• Comments & replies: body text and optional photos on incidents you participate in. Encrypted at rest, same scheme as descriptions.
• Direct messages: 1:1 chat messages between members. Encrypted at rest. Note: Am Echad currently operates server-side encryption — the server can decrypt to relay and store. We do not currently use end-to-end encryption.
• Verifications & likes: an opaque token identifying you as the verifier or liker. We do not display who specifically verified or liked a report; we only show the count.

Contacts (Android & iOS)

When you tap "Pick from contacts" while inviting a friend, we read your address book on-device only to render the picker UI. The contacts list is never sent to our servers. Once you pick a contact, only the chosen phone number is sent to generate the invitation.

Camera & photos

Used only to attach photos to incident reports or comments when you choose to. Photos go directly from your device to our hosting provider (Cloudinary / R2) — we never see your full photo library.

Diagnostic data

We use Sentry to capture crash reports and unhandled errors so we can fix them. Sentry payloads are scrubbed of any message bodies, descriptions, and contact details.

What we do with it

• Verify your phone number at sign-up, and — for full members — validate the invitation code that unlocks posting.
• Deliver alerts and advisories that are relevant to your location and notification window.
• Show your reports, comments, and chats to the people you intend.
• Enforce our community rules — soft-deleting content that violates them, suspending accounts when needed.
• Operate, maintain, and improve the service.

Who we share it with

We do not sell your data. We share the minimum necessary with the following service providers, all bound by data-processing agreements:

• Twilio — sends the SMS verification code (receives the phone number for that one transaction).
• Expo Push (Anthropic-unrelated) — relays push messages to your device (receives the push token and notification body).
• Cloudinary & Cloudflare R2 — store photos you attach to reports or comments.
• Sentry — captures crash and error reports.
• Our CRM provider — if you choose to provide your name and email during sign-up and agree to be contacted, we send those details (with your phone number) to our customer relationship management (CRM) provider so we can reach you about your membership. This is optional, tied to the consent checkbox on the profile screen, and kept separate from your in-app activity — it is never shown to other members.
• Fly.io, Supabase, Upstash — host the API, Postgres database, and Redis. Data lives in their managed infrastructure under our account.

We also share data when legally required (court orders, valid subpoenas) or to protect the safety of our community members.

Data retention

Our general rule: we retain personal data only while your account exists, and each category below has its own, shorter retention period where possible. When you delete your account (see “Deleting your account and data” below), all of it is deleted within 30 days.

• Account & profile (nickname, region, hashed phone number, settings): retained for as long as your account exists; deleted within 30 days of account deletion.
• Plaintext phone number: not retained — wiped after sign-up completes (typically within minutes); only an HMAC-SHA256 hash remains.
• Location data: we retain only your single most recent location point and your home point — no location history or movement trail is ever stored. Each new update overwrites the previous one.
• Incident reports: auto-deleted after 180 days unless flagged for ongoing review.
• Direct messages & comments: retained until you delete them or delete your account.
• Push token: cleared automatically when the app is uninstalled or reinstalled, and on account deletion.
• Photos you attach: retained with the report or comment they belong to, and removed with it.
• Diagnostic data (crash reports): retained up to 90 days and scrubbed of message bodies and contact details.

Your rights

You can, at any time:

• Update or remove your nickname, region, or home location from the More tab.
• Delete any comment or chat message you authored. Soft-deleted rows display as "[deleted]" but the body is replaced with a tombstone marker so threads don't break.
• Disable notifications, quiet hours, or location sharing in your device settings.
• Request export or full deletion of your account and all associated content by emailing uri.izhaki@gmail.com. We will respond within 30 days.

Deleting your account and data

There are two ways to delete your account and the data tied to it:

1. In the app: Profile → Delete account. The deletion starts immediately.
2. By email: send a request to uri.izhaki@gmail.com from any address, including if you no longer have the app installed. Include the phone number you signed up with so we can locate the account.

Either way, your account is deleted within 30 days: profile, phone hash, devices, location data, watch places, likes, dispatches, and direct messages. Comments and incident reports you authored may remain in anonymized form (no longer linked to you) so existing threads stay readable, within their normal retention window of up to 180 days. See the full details on our account deletion page.

Security

• All traffic is over TLS 1.2 or higher.
• Sensitive content fields (incident descriptions, comment bodies, message bodies) are encrypted at rest with AES-256-GCM using a server-managed key.
• Phone numbers are stored as HMAC-SHA256 hashes after sign-up, not as plaintext.
• Passwordless auth: biometric sign-in uses a device-bound ECDSA P-256 keypair; the private key never leaves your device's secure enclave.

Children

Am Echad is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child has registered, contact uri.izhaki@gmail.com and we will delete the account.

International transfers

Our backend operates from data centers in the United States (Fly.io, primarily IAD region). If you use Am Echad from outside the US — including Israel — your data may be transferred to and processed in the US under standard contractual clauses with our providers.

Changes to this policy

We will update this page when our practices change and bump the "Last updated" date at the top. For material changes, we will also notify you in the app.

Contact

Questions, requests, or concerns? uri.izhaki@gmail.com.