Privacy policy

The Lupix app ("the app") is run by Tal Golan ("the operator"). This policy sets out what information the app keeps and sends, and for what purpose. Travellers do not register or sign in, and give no name, phone number or e-mail. Only staff of companies that run trips through Lupix, and their guides, sign in, in a separate area (the "client area").

The trip itself is organised and run by the trip organiser and is not covered by this policy.

To work without signal, the app keeps on the device a copy of the trip's pages, pictures and map (in the browser, or as files in the app's storage when it is installed from the App Store or Google Play), as well as the "seen" marks on animals, the "what to bring" ticks on the day card, the text size, the language chosen for the legal pages, the last region chosen, the fact that the install offer was shown and which page guides have already been seen. The install offer mark is also kept in the app's own cookie, for up to 180 days; the page guide marks are kept on the device only, with no cookie. This information stays on the device only and is not sent to the operator. The device also keeps the last message received from the guide and the trip's status, to show them without signal too.

When the app is downloaded from the App Store or Google Play, the trip is kept as files in the app's storage on the phone, and they are not included in the phone's backup. When the trip is downloaded, and once at each launch with a connection (to check for an update), the phone contacts the app's server at Cloudflare and the trip code is sent in the request address, together with the IP address that every internet request reveals. The operator does not keep these addresses. The marks and settings are kept in the app's storage and are not sent. Travel documents and the location stay on the phone only. On Android phones the location is worked out on the phone by the Google location services on the device. Deleting the app deletes everything kept in it, and a trip can also be deleted on the "Storage on this device" page. Apple and Google receive no information from the app beyond what the store itself collects under its own policy.

In trips that have the "My documents" page, photos and PDF files of personal documents can be kept there, such as a passport, insurance, flight tickets, bookings and prescriptions. The files are kept on the device only, in the storage of the browser or of the installed app: they are not uploaded to a server, not sent to the operator or to any third party, and the operator cannot see them. Photos are made smaller on the device itself before saving. The files are deleted together with the rest of the trip's data (for this trip: 20 March 2038), or at once when they are deleted on the page itself or on the "Storage on this device" page. It is worth keeping a copy before the deletion date.

On trips with a guide area, the guide opens it with a code. What is entered there - the headcount, a list of names and phones if the guide adds one, rooms, vehicles and transfers, and notes per day and site - is kept on the guide's phone only. It is not uploaded to a server, not sent to the operator or any third party, and the operator cannot see it. A list leaves the phone only when the guide sends it with the send button, to whoever the guide chooses. It is deleted with the rest of the trip's data on the phone, or at once on the "Storage on this device" page.

The trip content shows the names and phone numbers of the guide, of the trip organiser's offices and of local contacts, as well as messages the guide writes, so that travellers can get in touch and stay informed. The trip organiser supplies these details, with the consent of the people named. Anyone who has the trip code can see them, so the code must not be published. They are deleted from phones together with the rest of the trip's data. No traveller's details appear in the trip content.

The app asks for access to the location only when "My location" is tapped on the map, and after approval on the device. The location is used only to show it on the map, is kept only in the page's memory and is not stored or sent to a server. The permission can be withdrawn in the browser settings, or in the phone settings for the installed app.

While the app is used, the browser contacts outside services, and they receive an IP address and technical details about the browser and the device:

• MET Norway (the Norwegian Meteorological Institute, met.no), for the weather forecast. The request goes through the app's server, so MET Norway does not receive the IP address or details about the device. What is sent is the coordinates of the place in that day's schedule and its height, the date and the device's time zone, not the user's location.
• Cloudflare, the app's hosting provider, from which the installed app also downloads the trip files. Only the trip code is sent.
• Supabase (supabase.com), to show messages from the guide and to keep feedback. With signal, when the trip's home page opens, the app asks its own server at Cloudflare whether there is a message, and the server asks Supabase: only the trip code is sent, and the device's IP address does not reach Supabase for this question. When feedback is sent, the browser contacts Supabase directly. The operator also signs in to it to manage the trips, with a Google account, and this does not concern travellers.
• Supabase (supabase.com) and Google (Sign in with Google), for the client area: the e-mail address, role, notes, requests and uploaded files of company staff. Resend (resend.com), for the system's e-mails to company staff: the e-mail address and the e-mail's content. Travellers do not sign in, and nothing of theirs is sent there.
• Google Maps, when "Navigate" is tapped.
• WhatsApp, Google Calendar, Google and TripAdvisor, only when you tap their link on a trip that offers its WhatsApp group, adding to a calendar or writing a review. The calendar file is part of the trip's own files, and opening it sends nothing to anyone.

Each service has its own privacy policy and also runs servers outside Israel. The operator does not sell information and does not pass it to others for marketing.

The services listed above store and process information outside Israel: Supabase on servers in the European Union, MET Norway in Norway, and Cloudflare, Google and Resend, American companies that run servers in the United States and in other countries.

Sending feedback is your choice. The rating, the texts you wrote and the trip code are sent, and they are kept together with the time of sending, to improve the app and the trips. The operator does not keep an IP address or any other identifier of the sender in the feedback data. The hosting providers may record an IP address in server logs for a short time. Do not write identifying or sensitive details in the text fields. The feedback is kept by the operator's hosting providers, Cloudflare and Supabase (see above). It is also shown to the trip organiser: to the company that runs the trip and to that trip's guides, to improve the trips. It is not passed to anyone else.

The client area is for staff of companies that run trips through Lupix and their guides, added by the operator or the company admin by e-mail address. Sign-in is with a Google account.

Someone who signs in with a Google account not linked to a company: the e-mail address, name and picture Google supplies are deleted automatically within a day.

Stored: the Google account's e-mail address, and the name and profile picture Google supplies (kept by the sign-in service), sign-in times, the company and role, the notes and requests you write and when, the notices to travellers you post and the staff tasks you add or tick, with your address and when, and the acceptance of the terms and its date. If whoever added you typed a name, the name is stored too. For the company: its name, logo, phone and e-mail. The operator and the company admins see who is on the team, whether and when they last signed in, and which trips they are assigned to. No traveller's name, documents or contact details are stored. The sign-in provider (Supabase) keeps a sign-in log with the IP address and browser type for a short time, for security. The operator does not keep these addresses.

Alerts about actions on your trips are stored too (for example a request sent or decided, a guide assigned to a trip, a trip starting tomorrow), with the e-mail address of whoever took the action, and the alert settings you chose. Alerts are deleted automatically after 12 months, and with the account when it is deleted.

Your e-mail address is also used to send you e-mails from the system: a welcome e-mail when you are added to a company's team, an e-mail when a request you sent is decided, and a daily digest of alerts you have not read. In the alert settings you can stop the daily digest, a single kind of alert or all alerts. The e-mails are sent through the Resend mail service, and only the time they were sent is recorded.

Purpose: showing you your company's trips and feedback and handling your notes and requests. The data is kept by Supabase; sign-in goes through Google.

You can upload files to a trip (the trip dossier, flight times and numbers without passenger names, route: PDF, Word, Excel or an image, up to 20MB) and attach files to notes. The files are kept in private storage at Supabase, and only the operator, the company's admins and that trip's guides see them. Downloads use a temporary link valid for one minute, and the files are never opened or scanned on the server. Do not upload passports, ID cards or passenger lists. If such a file was uploaded by mistake, delete it or contact the operator.

A new-trip request: the form's answers are stored (for example dates, destinations, the options chosen, the trip guide's name and e-mail address, and notes), who wrote and changed it and when, and the files attached to it (up to 20MB each) in private storage at Supabase. It is seen by whoever wrote it, that company's admins and the operator. An unsent draft is deleted automatically 90 days after its last change, a deleted draft 30 days after it was deleted (a draft the operator deleted, at once), a rejected trip 30 days after the decision, and the request's details and files of a published trip 30 days after the date the trip is removed from the phones.

Building a trip in the client area: the content you write (days, sites, animals, contacts, safety notes and more) and the pictures you upload are kept at Supabase, the pictures in private storage, with the e-mail address of whoever wrote or changed each part and when, and are kept with the trip. What is published becomes part of the trip travellers see. To view a trip that is not published yet, the site keeps a strictly necessary cookie in the browser for one hour, for that trip's preview only.

Guides can send receipts for expenses from the trip (amount, currency, kind, date, note, and if they wish a photo of the receipt or a PDF, up to 10MB), so that the company repays them. Receipts are kept in private storage at Supabase, and only the guide who sent one and the admins of that company see it. The operator of Lupix does not see them. A photo is made smaller on the device before it is sent.

On the device: the sign-in session, messages not yet sent and receipts not yet sent (with their picture). All are deleted on signing out.

The data is kept while you are a member of the company. You can delete the account at any time with the "delete the account" button in the client area or by asking the operator. After the account is deleted, the notes and requests you wrote stay, without your name, until they are deleted. Notes and requests are deleted 12 months after the date the trip is removed from the phones.

A trip's files are deleted automatically 30 days after the trip is removed from the travellers' phones, and a file can be deleted earlier with the delete button. Files uploaded by someone who deleted their account stay with the trip, without their name.

Receipts are deleted automatically, with their pictures, 3 months after the trip's end date. When someone deletes their account, their receipts stay until then, without their name.

There is no legal duty to give the operator any information. Sending feedback and turning on the location are your choice. Contacting the outside services listed above is needed for the app to work.

• What the app kept on the device is deleted automatically 365 days after the end of the trip (for this trip: 20 March 2038).
• It can be deleted at once: on the Storage on this device page, in the browser settings, or by deleting the installed app from the phone.
• Feedback is kept with no time limit, without the sender's name or contact details. Deletion of feedback can be requested from the operator (see "Rights and contact").
• In the client area: account details are kept while the person is a member of the company, and deleted on request or with the "delete the account" button. A sign-in not linked to a company is deleted within a day. Notes and requests are deleted 12 months after the date the trip is removed from the phones.
• Files uploaded to a trip: deleted automatically 30 days after the trip is removed from phones, or earlier with the delete button.
• Guides' receipts: deleted automatically 3 months after the trip's end date.
• New-trip requests: an unsent draft is deleted 90 days after its last change, a deleted draft 30 days after it was deleted, a rejected trip 30 days after the decision, and the request details of a published trip 30 days after the date the trip is removed from the phones.

The operator takes reasonable measures to secure the information: encrypted transfer, access rights by role, private storage for files and automatic deletion. No security is perfect, so we ask you not to send the operator information that is not needed.

The app is meant for participants in organised trips, including children and teenagers travelling with their families. It asks no traveller for a name, phone number or e-mail address. Children use it under their parents' supervision, and we ask parents not to let children write identifying details in feedback.

Under the Protection of Privacy Law, 5741-1981, a person may inspect information about them held in a database and ask to correct or delete it. Feedback is anonymous, so finding it requires the trip code, the approximate time of sending and the text. We will answer any such request within 21 days. You may also contact the Privacy Protection Authority at the Ministry of Justice. Contact: Tal Golan, talgolan1999@gmail.com

The operator may update this policy. The version in force is the one shown here, with the date of the last update. Use of the app is also subject to the terms of use.