Privacy Policy

Introduction and Definitions

Welcome to the "Stay or Pay" website and application (hereinafter: the "Platform," the "Application," or the "System"), available at https://stayorpay.app. The Platform enables the User to set a duration of non-use of the phone, to create a form of "commitment" (which has no legal validity and is for play purposes only) toward another user in the Application (hereinafter: "Partner"), and to send them updates on meeting goals. It is expressly clarified that use of the Platform constitutes full consent to this Privacy Policy. The User represents and agrees that they have read this policy, understood it, and that the information is provided voluntarily.

Identity of the Data Controller and Contact Details

The data controller for information collected through the Platform is Ella Azencot, whose registered address is 16 Emek HaChula, Modi'in.

The organization has appointed a Data Protection Officer (DPO), Mr. Yonatan Gottlieb. For any privacy-related question, you may contact him at privacy@stayorpay.app or by phone: 052-702-8868.

Data Minimization

The organization strictly adheres to the principle of minimizing use of information. We collect only the data necessary for proper operation of the Application and the service. It is clarified that the organization does not collect sensitive information, does not retain images except what the User chooses to upload to the Application (a Google photo is not stored as an avatar), and does not collect device identifiers or advertising identifiers for tracking or marketing purposes.

Information Collected and Its Sources

Information in the company's systems is divided into two categories:

User Data – active information: Information collected when creating an account or during use, including: full name (including the name from Google or Apple at sign-in, if the Platform receives it), phone number, and email address. Data relating to the nature of the service is also collected: partner selection, commitment, session data, and "lifetime" (time during which the User refrained from using the phone) earned by the User. Information is collected actively through registration and through third parties such as Google, Apple, and Twilio's SMS service.

Usage Data – automatic information: The system automatically collects system data during a session, including among other things: session times, heartbeat signal, background/foreground state, screen lock, call state (without exposing the incoming number), application version, and logs. In addition, upon sign-in, the cloud provider (Supabase) may store the User's IP address at the session level.

Cookies and Tracking Technologies

It is expressly clarified that the Platform's website does not use cookies for tracking or analytics tools. Within the Application, tokens stored locally in SharedPreferences are used for authentication and essential operation only.

Purposes of Collection and Use of Information

The company collects information for the following operational purposes only:

• Account creation, sign-in, and phone number verification.
• Partner selection and setting the commitment (penalty/promise).
• Running sessions in the Application and sending automatic messages to the Partner about session status (start, failure, success).
• Displaying the "lifetime" earned by the User to the Partner.
• Providing technical support and operating the account deletion mechanism.

The legal basis for processing information is the necessity to provide the service requested by the User. It is clarified that no artificial intelligence (AI) is used to process routine data for operating the Application. AI may be used to identify faults and for maintenance and upgrading of the system. The legal basis for processing information is the necessity to perform the agreement with you and provide the service, and sometimes also on the basis of your express consent.

Direct marketing: Information collected is used to operate the Application only. The company does not use information to send marketing content or direct mail, and therefore there is currently no unsubscribe mechanism for such distribution lists.

Transfer of information to third parties:

Information is transferred to third parties solely for the purpose of providing the services.

External service providers: Information may be processed through cloud providers, servers, and technology partners such as: Supabase, Google, Apple, Twilio, GitHub, Pages, Fastly, and Cloudflare. Google Play may receive crash reports in case of malfunctions.

Sharing with the Partner: The Partner defined by the User sees the relevant session details, the commitment, and the lifetime earned, but does not receive access to the full activity history. It is emphasized that the User may at any time choose whether information is shared, and may choose to delete shared information.

Information about use of the Application: If a User chooses to invite a contact to use the Application who already uses it, the system informs the inviter that the person already uses the Application. For this update, the system collects information about the fact of use of the Application; consent to use of the Application constitutes consent that another person who chooses to invite the User to use the Application will receive notice that the User already uses the Application.

The company works to select reliable and secure service providers, but is not responsible for the privacy practices or information security of those third parties.

Transfer of information outside the State of Israel:

The User hereby represents and agrees that their personal information may be stored and processed on servers located outside the State of Israel. Core systems and databases of the Platform are maintained through Supabase services located in Frankfurt, Germany.

Information security and retention period:

Information is retained using industry-standard safeguards. However, we do not perform field-level encryption within the database. It is clarified that the company does not undertake absolute immunity from breaches.

Retention period: Information is retained in the system as long as the User's account is active. After the User deletes the account, data is deleted completely. Technical backups at the cloud provider are kept for a short time only and are then deleted.

User rights:

Under the Privacy Protection Law, 5741-1981, the User has the right to review information about themselves and to request its correction or deletion. The system includes a clear mechanism in the dedicated area for complete account deletion. To exercise additional rights, you may contact the Data Protection Officer (DPO) using the contact details in Section 2 above.

Changes to the policy:

The company reserves the exclusive right to update, change, or delete provisions of this Privacy Policy at any time, at its sole and absolute discretion. Any change will bind Users from the moment of publication. Users are responsible for keeping up to date with the policy from time to time.