# Privacy Policy — Born2Win (נולדת לנצח) **Last updated:** 6 September 2026 This Privacy Policy explains how the Born2Win volunteer application ("the App") collects, uses, stores and shares personal information. It applies to the Android app (package `il.org.born2win.app`), the iOS installable web app, and the web version at `app.born2win.org.il`. The App is operated by the Born2Win ("נולדת לנצח") non-profit organization ("we", "us", "the Organization"). --- ## 1. About the App Born2Win is a non-profit organization that coordinates volunteers who prepare and deliver home-cooked meals to families of patients. The App is the tool volunteers and Organization coordinators use to see open meal requests, register for cooking dates, coordinate deliveries, and receive operational notifications. The App is **not open to public sign-up**. Volunteers are onboarded by the Organization and receive a personal invitation link. If you have not been onboarded by the Organization, you cannot create an account. --- ## 2. Information We Process ### 2.1 Volunteer information For each registered volunteer, we process: - First and last name - Phone number - City and assigned district(s) - Kosher-observance level (used to match volunteers with families' dietary needs) - Active/inactive status, and — where applicable — a deactivation request and its stated reason - Meal registration history: past and upcoming cooking dates, and the family assigned to each This information originates in the Organization's volunteer records, which are maintained in Airtable (see Section 4). The App reads from and writes back to those records. ### 2.2 Patient-family information (visible to authorized coordinators only) To coordinate meal deliveries, the App processes information about the families being helped, including the family's district and delivery address details (street, number, floor, apartment), preferred cooking days, and dietary and allergy information. For designated family contact people, the App additionally processes: - First and last name - Role and relationship to the patient - Phone number and email address - Gender, age and date of birth - National identification number - ManyChat subscriber identifier (see Section 4) **This information includes sensitive personal data.** It is entered and maintained by Organization staff — not by ordinary volunteers — and access is restricted to authenticated users holding the corresponding administrative permission. Ordinary volunteers see only the limited delivery details needed to fulfil a meal they have registered for. ### 2.3 Account, device and technical identifiers - **Anonymous authentication identifier (UID).** The App signs you in to Firebase Authentication anonymously and links the resulting UID to your volunteer record, so the App recognizes your device on subsequent launches. We store the UID, the date it was linked, and whether it came from an iOS device. - **One-time password (OTP).** Your personal invitation link contains a one-time code used solely to verify that you are the intended recipient. It is valid for a limited period and is deleted from our database once your device is paired. - **Phone number verification code.** Where pairing is done by phone number, we send a verification code to that number and validate it. The code is short-lived and is deleted after use. - **Push notification token.** If you enable notifications, we store the Firebase Cloud Messaging token for your device so we can deliver messages to it. ### 2.4 Notifications The App sends operational push notifications in the following categories: general messages, alerts and reminders, links, greetings, and meal assignment updates. We store the notifications sent to you and their read/unread status so the App can display your message history and an accurate unread badge count. **Push notifications are opt-in.** They are off until you explicitly enable them, and you can opt out at any time — either from within the App or in your device's system settings. Turning them off in the App removes the stored push token for that device. Your choice is not permanent in either direction: you may opt back in, or opt out again, whenever you wish. ### 2.5 Photo gallery The App includes a gallery of Organization photos, stored in Firebase Storage. Uploading and managing gallery content is restricted to administrators. Ordinary volunteers can view gallery images only. ### 2.6 Analytics The App uses **Google Firebase Analytics** to understand usage and improve the service. We log: - Login events (distinguishing whether the App was opened from an invitation link or as an installed app) - Interaction events identifying which screen or component was used and which action was taken We do **not** use analytics for advertising, ad targeting, or profiling, and we do not sell analytics data. Firebase Analytics collects standard device and app information as described in Google's documentation. --- ## 3. How We Use Your Information We process personal information only to operate the service, specifically to: - Verify your identity and pair your device to your volunteer record - Show you meal requests relevant to your district and constraints - Register you for cooking dates and manage cancellations - Provide coordinators with the contact details needed to arrange a delivery - Send you operational notifications about assignments, reminders and updates - Maintain the Organization's volunteer and family records - Maintain the security and integrity of the App - Understand aggregate usage in order to improve the App We do **not** sell personal information, and we do **not** share it for advertising or marketing purposes. --- ## 4. Third-Party Services We share information with the following processors, only as needed to operate the service: | Service | Purpose | Data involved | |---|---|---| | **Google Firebase** (Authentication, Cloud Firestore, Cloud Functions, Cloud Storage, Hosting, Cloud Messaging, Analytics) | Application hosting, authentication, database, push notifications, analytics | All categories described in Section 2 | | **Airtable** | The Organization's system of record for volunteers, families and meal demands | Volunteer and family records (Sections 2.1, 2.2) | | **ManyChat** | Sending WhatsApp messages to family contact people | Contact first name, last name, phone number, gender | | **Google Play / Apple App Store** | App distribution and updates | As governed by the respective store's policy | Each of these providers processes data under its own privacy policy and its agreement with us. We do not authorize them to use the data for their own purposes. We may also disclose information where required by law, or to protect the rights, safety or property of the Organization, our volunteers, or the families we serve. --- ## 5. Legal Basis and Consent We process volunteer data on the basis of your consent, given when you accept the Organization's invitation and use the App, and on the basis of our legitimate interest in operating the meal coordination service. Family data, including sensitive data, is collected and maintained by the Organization under its agreements with the families it serves. --- ## 6. Data Retention - Volunteer records are retained for as long as you are an active volunteer, and thereafter as required for the Organization's records and legal obligations. - One-time codes and device fingerprints are short-lived and deleted immediately after pairing (fingerprints are additionally valid for at most one day). - Push tokens are retained until you disable notifications or the token is invalidated by the platform. - Notification history is retained to provide your in-App message history. --- ## 7. Your Rights Subject to applicable law, including Israel's Protection of Privacy Law, 5741-1981 and — where it applies — the GDPR, you have the right to: - Request access to the personal information we hold about you - Request correction of inaccurate or incomplete information - Request deletion of your account and personal information - Withdraw your consent and stop using the App - Object to or restrict certain processing To exercise any of these rights, contact us using the details in Section 10. We will respond within the period required by applicable law. **Account deletion:** to request deletion of your volunteer account and associated personal data, contact us at the address in Section 10. Note that some information may be retained where the Organization is legally required to keep it. --- ## 8. Security We protect your information using: - Encryption in transit (HTTPS/TLS) for all communication with our servers - Firebase Authentication, with server-side validation of every request - Role-based access control: sensitive family contact data is accessible only to users holding the relevant administrative permission - Server-side (Cloud Functions) enforcement of authorization, so permissions cannot be bypassed by a modified client - Storage rules that permit write access only to authenticated administrators No method of transmission or storage is completely secure, and we cannot guarantee absolute security. --- ## 9. Children's Privacy The App is intended for use by adult volunteers and Organization staff. We do not knowingly allow children to register as App users. Information about patients and their family members — which may include minors — is entered and maintained by Organization staff as part of the Organization's charitable activity, under its arrangements with those families. It is not collected from children through the App. --- ## 10. Contact Us For questions about this Privacy Policy, or to make a data access, correction or deletion request: **Born2Win (נולדת לנצח)** Email: info@born2win.org.il Website: https://born2win.org.il --- ## 11. Changes to This Policy We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page and publish the updated policy at this address. Material changes will be communicated through the App.