Joey — Privacy Policy (English)

Draft prepared 30/08/2026 for legal review. Not a final, legally-binding document. Every [BRACKETED] item is a legal or business decision that has not been made yet and must be filled in by a lawyer or by Joey's ownership before this is published anywhere — nothing here should be treated as final. A complete list of every open item is repeated at the end of this document, in one place, for convenience. This draft is grounded in what the Joey Rider and Joey Driver apps actually do today, verified against the codebase — not a generic template. Facts that are genuinely uncertain (not business decisions, just unverified facts) are marked [VERIFY].

Effective date: [EFFECTIVE DATE] Last updated: 12/09/2026 (draft)

1. Who we are

This Privacy Policy covers both Joey mobile applications — Joey Rider and Joey Driver (together, "Joey," "we," "us," "our"). One policy covers both apps; sections that apply to only one app say so explicitly.

Joey is operated by:

Y.A.R. Zemach Holdings Ltd. 25/4 Nissenboim, Netanya, IL 4247261 [BUSINESS REGISTRATION NUMBER — ח.פ. / עוסק מורשה]

Contact for privacy questions: support@joey-go.com

2. Information we collect

2.1 Information every account provides

• Full name

• Phone number (used to sign in — Joey uses phone number + one-time SMS code, not a password)

• Email address (optional)

• Preferred language

• Country

• Profile photo, if you add one (Joey Rider does not currently have a working photo-upload feature; this may change in a future update)

2.2 If you're a rider

• Pickup and drop-off addresses and precise GPS coordinates for each ride you request

• Your ride history: service type (ride or delivery), vehicle type requested, status, prices, and timestamps

• Chat messages you exchange with your driver — only visible while a ride is in the accepted/arriving/in_progress stages; not accessible before or after

• Ratings you give to drivers and receive from them

• Emergency contacts you choose to add (name and phone number), if you use that feature

• Your location and timestamp if you use the in-app SOS button

• A device push-notification token, so we can send you ride-status notifications

• A promo code, if you enter one

2.3 If you're a driver

Everything in 2.1 and 2.2 that applies to a driver role, plus:

• Vehicle information: type, plate number, model

• Identity and vehicle documents you upload during onboarding (ID card, driving license, vehicle photo) — stored in a private file storage bucket, never publicly accessible; only accessed through short-lived, individually-generated links

• Your live location while you are online in the app or on an active ride (see §3, "Location," below for exactly how this works today)

• Your wallet balance (accumulated earnings)

• Your driving/service rating

2.4 Payment information — what we do not store

When you add a payment card, card entry happens on PayPlus's own secure payment page — not inside the Joey app, and not on Joey's servers. Joey never receives, sees, or stores your full card number, expiry date, or CVV. What we do store, after PayPlus confirms your card is added, is:

• The last 4 digits of your card and the card brand (e.g., "Visa •••• 1234"), so you can recognize which card is saved

• PayPlus's own reference tokens for that card, which we use to ask PayPlus to charge you — these tokens are meaningless outside PayPlus's own system

2.5 Information we generate automatically

• Ride/trip records, prices, and transaction records (see §7, "Payments," for how pricing works)

• Records of driver-approval decisions and the reasons for them

• Basic app usage/error logs

2.6 If you send a delivery — the recipient's details

When you book a delivery, you give us the name and phone number of the person receiving the package, so the courier can hand it over. That person has not signed up to Joey, has not agreed to this policy, and has no way to ask us to delete anything themselves — so we treat their details differently from yours:

• Use: only to deliver that package. The name and phone number are shown to the courier carrying it out and are used for nothing else — no marketing, no later contact.

• Automatic deletion after 30 days: 30 days after the delivery is completed or cancelled, the recipient's name and phone number are deleted from the record. The delivery record itself (addresses, price, times) is kept like any ride — only the recipient's details are removed. The 30 days exist so that a delivery that went wrong can be looked into.

• This deletion does not depend on your account — it happens whether your account stays open or you delete it.

• Before you give us someone else's details, make sure they are expecting the delivery and do not object to the courier having their phone number.

2.7 A photo of the package, when the courier reports it is bigger than declared

If the courier arrives for pickup and finds the package is bigger than the size that was chosen, they must photograph it before reporting it. The photo has one purpose: so you can see what it is about before you approve a new price or decline, and so we can look into a complaint if there is one.

• Who sees it: you (the sender), the courier who took it, and Joey staff when handling an inquiry or a complaint. It is shown to no one else and used for nothing else.

• What it may show: a photo of a package may show a label with a name and address — yours or the recipient's. We ask couriers to photograph the package only.

• Deletion after 30 days: 30 days after the delivery is completed or cancelled, we begin deleting the photo and complete it without delay — for the same reason as the recipient's details (§2.6). The 30 days exist so that a delivery that went wrong can be looked into.

[LAWYER / JOEY OWNERS: the wording "begin deleting and complete it without delay" is deliberate — as at the date of this draft the deletion itself is triggered by hand from the admin panel, with a visible alert the moment a single photo passes 30 days (the same mechanism decided for driver documents). If this document commits to "deleted within 30 days", first confirm the deletion runs automatically]

2.8 Requests to the Joey team (in-app support chat)

When you write to us through "Chat with us" in the app, we keep your messages, the team's replies, and when each message was sent.

• Who sees it: you, and the Joey staff who handle requests. Staff may also see your recent rides, so they can answer a request about a ride or a charge. We record internally which staff member replied, but do not show you their details.

• Use: only to handle your request — not for marketing.

• Notification: when the team replies, you get a notification on your phone. It does not include the text of the reply, because notifications are also shown on a locked screen.

• Deletion: all your support conversations are deleted outright when you delete your account (see §7). This is different from ride chat with a driver or rider, which is kept — a support conversation has no other party who needs the record.

3. Location — how it actually works today

Riders: your location is used to set your pickup point and to show your driver's live location while a ride is in progress. It is not tracked when you're not actively planning or on a ride.

Drivers: while you are online (available for ride requests) or on an active ride, the app records your current GPS location so we can match you with nearby ride requests and so a rider on an active ride can see your live position. This location is stored as a current-state value only — the database keeps only your most recent location, not a historical trail of everywhere you've been. Riders can only see a driver's location during a ride they are actually matched to.

Location tracking today only happens while the app is open and in the foreground. Joey does not currently track location while the driver app is closed or backgrounded. [If/when background location tracking is added — see BACKGROUND_LOCATION_PLAN.md in the project repo — this section must be rewritten before Phase 2 of that plan, i.e. before a real user is ever shown the "Always" permission request, even during internal testing — not once the feature ships to production, and not just extended informally. This is a required update, not a legal decision, but it is called out here so it isn't missed.]

4. How we use your information

• To provide the core service: matching riders and drivers, navigation, calculating trip prices, processing payments, and enabling in-ride communication

• To verify driver identity and eligibility to drive (document review, approval workflow)

• To send you ride-status and account notifications

• To respond to support requests

• To investigate safety incidents (e.g., an SOS alert) and cooperate with emergency services where appropriate

• To maintain financial and transaction records for accounting and legal purposes (see §8, "How long we keep your information")

• To detect and prevent fraud and abuse

We do not sell your personal information. We do not use your data for third-party advertising.

5. Who we share information with

We share information only with the service providers ("processors") that are actually necessary to run Joey, and only the information each one genuinely needs to perform its function:

• Supabase — hosts our entire database and file storage. Effectively all app data passes through Supabase's infrastructure. [VERIFY: which region/country Supabase's infrastructure for this project is hosted in, for the purposes of any required international-transfer disclosure.]

• Twilio — delivers the one-time SMS codes used to sign in. Twilio sees your phone number and the fact that a code was sent to it.

• PayPlus — processes payments, as described in §2.4. PayPlus sees whatever information is needed to process a charge (amount, and the card details you enter directly on PayPlus's own page — never through Joey).

• Google (Places API) — Joey Rider uses Google's address-autocomplete service to help you search for pickup/drop-off addresses as you type. The text you type into the address search is sent to Google for that purpose. Joey Driver does not use this feature.

• Map rendering uses your device's built-in map framework (e.g., Apple Maps on iOS), subject to that platform's own data practices, not a separate data-sharing arrangement we've made with a mapping provider.

We also share limited information between the two parties of a ride: a rider and their matched driver can see each other's name, profile photo (if any), and — only while the ride is active — chat messages and live location, so the ride can actually happen. This is the minimum needed to complete a ride safely, not a general information exchange.

Phone numbers — mutually visible during an active ride only. So that a rider and driver can coordinate by phone (for example when a rider cannot find the car), each one's phone number is visible to the other — but only while the ride is active (from the moment the driver accepts until the ride is completed or cancelled). Once the ride closes, access to the number is automatically blocked at the database level.

The call itself is placed through your device's own phone app, not through Joey. This means the call will appear in both devices' call history, and the number will remain there after the ride has ended — that is outside our control, exactly as with any ordinary phone call. [To consider with a lawyer: whether separate explicit consent is required for this mutual disclosure, or whether disclosure here is sufficient. When a number-masking mechanism is introduced (see CLAUDE.md §4.4 feature #9), this paragraph will need updating.]

We may disclose information if required by law, legal process, or a genuine safety emergency.

[We do not currently use Veriff for identity verification, even though it has been mentioned in project planning — this policy will need updating if/when that changes. Do not describe Veriff as an active processor until it is actually connected in the app.]

6. Payments — how pricing and charging work

Israeli law requires that a licensed taxi charge fares based on its official physical meter, not an app estimate. Because of this, who sets the price differs by vehicle type — but how it's charged does not: in every case, Joey charges your saved payment card automatically when the trip is completed. There is no cash payment, and you are never asked to pay the driver directly, for any vehicle type.

• For taxi (car) rides, the price you see in the app before and during the ride is an estimate only. The final amount is set by the driver's physical meter, entered into the app by the driver — and the app then charges your saved payment card that exact amount automatically.

• For every other vehicle type, and for deliveries, the app calculates the final price itself and charges your saved payment card automatically when the trip is completed.

• In every case: no manual "Pay" step, and no cash.

If you cancel a ride within a short free-cancellation window after a driver accepts (currently 3 minutes), there is no charge. After that window, a cancellation fee may apply (currently [₪15 for Israel — confirm this is still the current value in app_settings before publishing, as it can change]).

7. Account deletion

You can request deletion of your Joey account at any time from Settings in the app. Here is exactly what happens:

1. Requesting deletion starts a 30-day grace period. Your account is immediately locked — you can no longer request new rides — but nothing is deleted yet.

2. You can cancel the deletion request at any time during those 30 days by signing back into the app and choosing to cancel. If you don't cancel, deletion proceeds automatically once the 30 days pass.

3. What is permanently removed once the 30 days pass:

   • Your name, phone number, email address, and profile photo.

   • Your saved payment card details, emergency contacts, and push-notification token — deleted outright.

   • The last device location we held for you.

   • All your support conversations with the Joey team — your messages and the team's. Unlike ride chat (item 4 below), support conversations are not kept (see §2.8).

   • If you are a driver: the documents you uploaded (ID card, driving licence, selfie, vehicle photo) are deleted from storage; your driving licence categories are deleted; and your vehicle registration number and model are removed from your driver record.

   [LAWYER / JOEY OWNERS: if this document commits to a fixed window for completing deletion (e.g. "within 30 days"), confirm with the technical team that deletion of driver document files runs automatically rather than being triggered by hand — as at the date of this draft the mechanism exists and is tested, but is triggered manually]

4. What is kept — and exactly what that includes. Your identifying details (name, phone, email) are removed from these records, which remain linked only to an anonymous internal reference. But the content itself is kept in full, including:

   • The pickup and drop-off addresses of every ride you took — exactly as entered, including coordinates. If you used your home or work address, it is kept.

   • The full text of the chat messages you sent and received.

   • The free-text comments you wrote in ratings.

   • Your payment and transaction records, and any SOS alerts you raised — including the location they were raised from.

   We keep these specifically because: (a) the other party to a ride (your driver or rider) has a legitimate record-keeping interest in that ride's history that shouldn't disappear because you deleted your account, and (b) we have financial and legal obligations to retain transaction records (see §8).

   🔴 Please understand: removing your name and phone number does not necessarily make this information impossible to trace back to you. A home address held in ride history, or the content of a chat message, can in practice point to a specific person even without a name. We say this plainly so you do not read "deletion" more broadly than it actually is.

   [LAWYER: determine whether the retention described here meets the definition of "anonymisation" under the Israeli Privacy Protection Law and its regulations, whether separate consent is required for it, and whether users should be offered a more complete erasure on request]

5. Your phone number is released once deletion completes — a different person can sign up with that number in the future, and their account starts completely empty; nothing from your old account carries over to them.

6. This process is irreversible once the 30 days have passed.

8. How long we keep your information

• While your account is active: for as long as you keep using Joey.

• Ride, payment, and transaction records: kept for [FINANCIAL RECORD RETENTION PERIOD — a legal/accounting decision, commonly several years under Israeli tax and accounting requirements; do not publish this policy with this value still blank], even after an account is deleted (see §7).

• A delivery recipient's name and phone number: 30 days after the delivery is completed or cancelled — then deleted automatically (see §2.6).

• A package photo taken by the courier: 30 days after the delivery is completed or cancelled — then we begin deleting it and complete it without delay (see §2.7).

• Support conversations with the Joey team: for as long as the account exists — and deleted outright when the account is deleted (see §2.8, §7). [LAWYER / JOEY OWNERS: whether to also set a maximum retention period for closed conversations of an active account]

• Identity documents (drivers): [RETENTION PERIOD FOR DRIVER DOCUMENTS — legal/business decision].

• SOS alerts and safety-incident records: [RETENTION PERIOD — legal/business decision, likely needs to be long enough to support any resulting investigation or legal process].

9. Your rights

You can:

• Access and review the personal information we hold about you (contact us, or use the in-app profile screens where available)

• Correct inaccurate information

• Request deletion of your account (§7)

• Withdraw consent for optional features (e.g., emergency contacts) by simply not using them, or removing what you've added

[This section needs a lawyer's review to state your rights accurately and completely under the Israeli Privacy Protection Law (חוק הגנת הפרטיות) as currently in force, including any rights introduced by the 2025-2026 amendment referenced elsewhere in this project's internal notes, and to name the correct regulator/complaints contact (e.g., the Israeli Privacy Protection Authority). Nothing above should be read as a complete or legally precise statement of your statutory rights.]

10. Children's privacy

Joey is not directed at children, and we do not knowingly collect personal information from children under [MINIMUM AGE — confirm with a lawyer which threshold applies; commonly 13 or 16 depending on jurisdiction]. [Confirm Joey's own minimum-age policy for using the service at all — see the Terms of Service for the related eligibility requirement.]

11. Security

We use industry-standard technical measures to protect your information, including encryption in transit, database-level access controls that restrict each user to their own data, and private (non-public) storage for sensitive documents accessed only via short-lived signed links. No system is 100% secure, and we cannot guarantee absolute security.

12. Changes to this policy

We may update this policy from time to time. [Decide and state the notice mechanism — e.g., an in-app notice, an updated "Last updated" date, or direct notification for material changes — this is a business/legal decision, not yet made.]

13. Contact us

Questions about this policy or your personal information: support@joey-go.com

Open items — everything that needs a decision before this can be published

This list repeats every [BRACKETED] item above, in one place, so nothing is missed:

1. ✅ Legal entity name — set 01/10/2026: Y.A.R. Zemach Holdings Ltd. (§1)

2. ✅ Business address — set 01/10/2026 (§1)

3. Business registration number (ח.פ. / עוסק מורשה) (§1)

4. Effective date (top of document)

5. Supabase hosting region — a fact to verify, not a decision (§5)

6. Financial-record retention period (§8) — legal/accounting decision

7. Driver-document retention period (§8) — legal/business decision

8. SOS/safety-incident record retention period (§8) — legal/business decision

9. Full, lawyer-reviewed statement of user rights under Israeli privacy law, including the correct regulator/complaints contact (§9)

10. Minimum age policy (§10, and related in Terms of Service)

11. Notice-of-changes mechanism (§12)

12. Confirm the current cancellation-fee amount (₪15 assumed, §6) is still accurate before publishing

13. Legal determination: whether retaining addresses, messages and comments after account deletion qualifies as "anonymisation" (§7.4) — added 10/09/2026, after checking in the code exactly what survives deletion

14. If this document commits to a window for completing deletion, confirm that deletion of driver document files is automated (§7.3) — added 10/09/2026

15. Retention period for closed support conversations of an active account (§8) — added 10/10/2026. Today they are kept until the account is deleted

16. Update §3 (Location) before Phase 2 of BACKGROUND_LOCATION_PLAN.md (repo root) — not once the feature ships to production, but as soon as a real user is shown the "Always" permission request during internal testing. Not a legal decision, a required technical/compliance update, flagged so it isn't forgotten