Privacy Policy

1. Introduction

This Privacy Policy explains how the Optima application (the “App” or “Service”) collects, uses, stores, and protects users’ personal information. By using the App, you consent to this Policy.

The App is intended exclusively for volunteer community safety team members and civilian emergency response teams in Israeli settlements, by personal invitation from a settlement administrator. The App is not available for public sign-up.

1.1 Data Controller

The controller of the information and the database is OPTIMA (Optima-Shield), licensed dealer no. 023558448, owned by Doron Birman, 15 Dochal St., Bat Hefer, Israel. Phone: 054-588-9099. Email: contact@optima-shield.app.

With respect to data a user enters into the system within their organization, the organization that granted the user access acts as a Data Processor, under the agreement between it and OPTIMA.

2. Information We Collect

2.1 Personal Information

• Full name — provided by the settlement administrator upon account creation
• Email address — for login and communication
• Phone number — for signing in to the system and for voice calls between team members
• Unique User ID — generated automatically by the system

2.2 Precise Location — Shared Only by Explicit User Action

The App does not transmit location unless the user has turned it on. Location sharing starts only through an explicit action of the user, in one of four controlled modes. Once sharing has started it is continuous until it is stopped:

2.2.1 Manual Broadcast

• The user taps the share-location icon and may choose a duration from the options shown, including “until turned off”. The organization may set a time limit for sharing. When the organization has set a limit, sharing ends when it runs out. When the organization has not set a limit, there is no time limit and sharing continues until it is stopped. A commander or dispatcher may extend an active session, up to the organization’s limit if one is set, and the user is notified.
• Manual broadcast also starts when the user answers “On my way” or “Seen” to an “Emergency Mobilization” alert, including from the notification itself, and also when the answer is given through another channel of the same person, such as another device or the keypad of a voice call. “Unavailable” starts nothing. For an ordinary dispatch that is not an Emergency Mobilization, “Seen” starts no sharing: a separate question, “Location sharing”, appears, and sharing starts only if the user answers “Allow”. An alert that comes from another organization has no answer, and sharing starts only if the user taps “Share location” in a separate question. When no duration is chosen, the organization’s time limit applies, and if there is none, sharing continues until it is stopped.
• While sharing in the background, the operating system shows an indicator: a persistent notification on Android, and a status-bar indicator on iOS while the App is in the background. If the operating system does not allow the notification to start, sharing may run without it. With the “while the app is open” option there is no system indicator, and sharing is shown on the location button on the map.
• The user can stop sharing at any time by tapping the location button on the map.
• Without any action by the user, sharing ends only in these cases: the time limit that was chosen or that the organization set has run out; “while the app is open” was chosen and the App was closed; the user signed out or switched to another organization; the account was blocked or deleted; someone the organization authorized stopped the sharing; or 30 consecutive days passed with no location point and no contact from the device. Loss of reception, a network outage or missing GPS do not end sharing: during that time location is not sent, the user is warned, and sharing resumes by itself when a location is available.

2.2.2 SOS Broadcast

• Activated by a long-press on the SOS button, to prevent accidental activation.
• An SOS broadcast is not closed because of silence or loss of reception.
• An SOS broadcast shows the same system indicator as a Manual broadcast: a persistent notification on Android and a status-bar indicator on iOS.

2.2.3 Sharing in Response to a Request

• The organization may send the user a request to share location. Sharing starts only if the user accepts the request; a declined or unanswered request starts no sharing.
• Sharing ends when the time limit of the organization expires, if one was set. If the organization has not set a limit, it continues until it is stopped, and in the other cases listed under Manual Broadcast.

2.2.4 Chase

• A chase records and shows live the route of a drive. It is available only in an organization that has turned it on, and it starts only when the user starts it from the map of the App. At the start the user chooses who sees it: the whole organization or the user’s team.
• During a chase the App sends the user’s location continuously, every few seconds, also in the background, and stores the route. A chase runs also when no Manual broadcast is active, and does not depend on one. A chase in the background shows the same system indicator as a background Manual broadcast.
• A chase of the whole organization sends a notification to all members of the organization when it starts. Who may see a chase and its route, including another organization your organization chose to share chases with, is set out in section 2.2.6.
• The user stops a chase at any time with the stop button in the App, after a confirmation. An organization administrator can end another user’s chase, and the action is logged. A chase also ends when the user signs out or switches to another organization. A chase has no time limit and does not end by itself. Loss of reception does not stop it: the route is kept on the device and sent when reception returns.

2.2.5 Privacy Invariant

When no location sharing and no chase is active, the App does not transmit location continuously, in the foreground or in the background. Outside sharing and chases, location is sent only when the user chooses to in a single action, such as sending a location in chat, attaching one to a report or giving a command to the AI assistant, and it is stored as part of that message, report or command. There is no passive collection and no tracking that starts without an action by the user.

2.2.6 Sharing Scope

• Manual broadcast and sharing in response to a request — location is visible to members of your organization, according to the permissions and team structure it has set, and to organizations linked to it through an approved chain or regional group. It is also visible to another organization yours chose to share locations with, as described in section 4.4. A user who belongs to several organizations may choose, personally, to keep sharing their location with another organization they belong to, also while active in a different one. An organization may create a live view link, and locations are shown to anyone holding that link. OPTIMA administrators can view location to operate the system.
• Chase: the location and route are visible as the user who started the chase chose: to all members of the organization, or to the members of one team. In every case they are also visible to those with management and dispatch roles in the organization (administrator, commander, dispatcher and display screen). An active chase of the whole organization is also shown on a live view link, if the organization created one. After a chase has ended it appears in the chase history, and in an organization that does not separate teams, to all members of the organization. A chase is not shown to other organizations, nor to organizations linked through a chain or regional group, unless the organization chose to share chases with another organization, as described in section 4.4. OPTIMA administrators can view a chase to operate the system.
• SOS broadcast: location is visible to all members of the organization, to organizations linked to it through a regional group, to chained settlements (Interconnectivity), per the organization’s configuration, and to another organization the user chose to keep sharing their location with. An organization may choose to share SOS calls with another organization too, as a separate right, as described in section 4.4. If the organization created a live view link, the location is also shown to anyone holding the link. OPTIMA administrators can view location to operate the system.
• Location data is never shared with advertisers, data brokers, or any third party that is not a strictly necessary infrastructure provider, except through a link your organization creates and sharing with organizations that use the system, as described in this section and in sections 4.2 and 4.4, and a location sent with a command to the AI assistant, as described in section 4.5.

2.2.7 Retention & Deletion

• Location pings from a Manual broadcast, and from sharing location in response to a request to share, are retained for 14 days by default, then automatically deleted. An organization may set a different period for these pings, up to one year, and a new organization starts with 90 days.
• Location pings from an SOS broadcast are retained for one year, then automatically deleted, because an SOS track may serve as evidence.
• A recorded chase is kept, with its full route, without a time limit. The system does not delete chases automatically, and has no action that deletes a recorded chase. Deleting an account does not delete chases: they stay in the organization, and the user’s name in them is replaced with “Deleted User”.
• A copy of the location pings is kept in our data analytics system (Google BigQuery) for up to 60 days, then automatically deleted.
• Immediate deletion of your location history can be requested by emailing support@optima-shield.app. This request does not apply to chases.

2.3 User-Generated Content

• Chat messages
• Photos — attached to incident and event reports
• Event documentation — text, time, location

2.4 App Activity

• Usage history — for audit and investigation purposes
• Taps and screens viewed
• Where an organization chooses to share information as described in section 4.4, viewing the shared information

2.5 App Performance

• Crash reports — for bug fixing
• Diagnostics — performance, response times

2.6 Device Identifiers

• Device ID — for fraud prevention and unauthorized access prevention
• OS version, device model

2.7 Enquiries Through the Website

When you contact us through the contact form on optima-shield.app, we collect the details you provide: full name, organization name, phone, email, and the content of your message.

• Purpose: we use the details only to get back to you, arrange a demo, and manage our business relationship with you. They are not used for marketing mailings without separate consent, and are not sold to any third party.
• Providing the details is not a legal obligation. Without a phone number or an email address, however, we cannot get back to you.
• Who sees the details:the OPTIMA team, and infrastructure providers that host the website and relay the enquiry — only for that purpose.
• Retention: up to 24 months from your last enquiry, unless a business relationship is established between us.
• Your rights: you may ask to access, correct, or delete the details by writing to contact@optima-shield.app.

The website itself sets no advertising or tracking cookies.

3. How We Use Your Information

The collected information is used solely for the following purposes:

• Operating the service (map display, chat, events, patrols)
• User identification and management
• Communication between team members
• Event documentation and investigation
• Diagnostics and bug fixing
• Security and abuse prevention

We do not use data for marketing, advertising, or sale to third parties.

4. Sharing Data With Third Parties

4.1 Service Providers

We use infrastructure providers that process data on our behalf only:

• Mapbox (USA) — map display. Mapbox telemetry is fully disabled. Mapbox also finds an address from text or from a point, including a place name from a command to the AI assistant.
• Firebase Cloud Messaging (Google, USA) — push notification delivery
• Sentry (USA) — crash reporting and error diagnostics
• Expo Updates (USA) — over-the-air software updates
• Google Cloud (Tel Aviv, Israel) — server and database hosting
• Inforu (Israel) — SMS delivery
• Twilio (USA) — SMS and voice-call delivery

When signing in with a one-time code, the phone number and the code are passed to the delivery provider.

The infrastructure providers are contractually obligated to protect the information and use it solely for our management purposes. Besides them, Anthropic (USA) receives information to process it for us in the AI service, may not train models on it, and keeps it under its own terms, including to check for violations of its usage policy, as described in section 4.5.

4.2 Settlement Administrators

Your organization’s administrators can view your profile and your activity in the App. They can see your live location while location sharing or a chase is active. Where movement history is enabled, administrators, commanders and anyone else given that permission can view the recorded track of past location sharing during the retention period in section 2.2.7. Where the trail feature is enabled, members of your organization who may see a person on the map can also view the route that person recorded in the past, and an administrator or commander may create a public link to a movement recording, visible to anyone holding it, for up to 7 days. An organization may choose that another organization also sees the trail of its people, as described in section 4.4. This is necessary for operational coordination.

4.3 No Advertising and No Data Brokers

• No advertising in the App
• No sale of information to any third party, and no transfer to marketing entities, data brokers, or any other third party except through a link your organization creates (section 4.2) and sharing with organizations that use the system (section 4.4)
• No use of Advertising ID

4.4 Sharing Data Between Organizations

In this section “organization” also means a settlement. Besides a chain and a regional group, an organization may choose to share its information with other organizations it has a connection with. As long as an organization has not chosen to, its information is not passed on this way.

• Who decides: the administrator of the sharing organization decides what to share, with whom and with which rights. A connection between organizations is set up by the OPTIMA team, which may also update the rights on it. When an organization chooses to share, the receiving organization does not have to approve the sharing and is notified of it.
• What an organization may share: points and layers, hotspots, drone intrusions, events, alerts, readiness level, scenarios, situation report, forces summary, contacts, chat, radio (PTT), locations, SOS calls and chases.
• What the receiving organization sees and does: only what was shared with it. It can view and, where the sharing organization allowed it, also create, edit or delete. The sharing organization sets which roles in the receiving organization get each right, and the receiving organization decides who holds each role.
• Locations:the sharing organization chooses whose locations are shared, everyone’s or by role, and how far: the last point only, or also the trail, which covers the last 10 hours and the live view. An organization may show its people’s locations this way to another organization without each person’s consent, only while the person is active in the sharing organization. After a person moves to another organization, their personal choice whether to keep sharing their location with another organization they belong to applies again, as described in section 2.2.6. Sharing between organizations does not start anyone’s location sharing: it applies only to location sent as described in section 2.2. A location may be shown with the person’s details, such as name, role and phone.
• SOS and chases: each is a separate right. The sharing organization chooses whom to share SOS calls with regardless of whose locations it shares.
• Change and stopping: the sharing organization may change its choice or stop sharing at any time. A change applies from then on, and what was created before stays as it is. A point that a person from a receiving organization created in a layer of the sharing organization stays with the sharing organization, with its creator noted, and once sharing stops the receiving organization no longer sees it.
• Record: when an organization chooses to share this way, views and actions in that sharing are recorded: who, what, when and at which organization. The record is kept for two years and is available to the OPTIMA team.
• Responsibility: the organization that chose to share is responsible for that decision, as the one that sent the information.

4.5 External AI Service

Some features use an artificial intelligence (AI) service from Anthropic, a company operating in the USA. The system sends the service the information described here, and the service returns an answer. Information is sent to the service only when a user uses one of these features:

• Identification:when a user photographs a document in the identification module, such as an identity card, a driving licence, a vehicle licence or a passport, or a vehicle with its number plate, the photo is sent to the service to read the identity number, name, father’s name, date of birth, address, plate number and vehicle details. The photo is sent with everything in it, including faces. Without signal, the photo is sent when signal returns. The details can also be typed in without a photo.
• Points import:when a user imports points from text, a screenshot or an Excel or CSV file, the text, the image or some of the file’s rows may be sent to the service to read coordinates and point names. Without signal, the sending happens when signal returns.
• AI assistant:in an organization where the assistant is enabled, a command the user gives the assistant is sent to the service with the user’s name and role, and with the user’s location and the map centre if the device sent them. To understand the command, details of people who match it by name or role are also sent, up to five per search, including people from organizations chained to the organization: name, role and organization name. No phone number, email or location of those people is sent. Names of groups, scenarios and places that match the command are sent too. A place name the organization does not know is also sent to Mapbox to find it. The service only proposes an action. An action that creates or sends information, such as a report, a message or a call-up, and switching location sharing off, run only after the user confirms. Other actions, such as opening a map, a card or a feed, and switching location sharing or a trail on, run at once.
• What Anthropic keeps: under its commercial terms, Anthropic may not train models on what is sent to it. Under the retention policy it publishes, it deletes what was sent to it and the answer within 30 days, unless the law requires keeping them longer, or they are kept to enforce its usage policy, in which case for up to two years.

5. Data Retention

• Active account — data is retained as long as the account is active
• Account deletion — the profile is anonymized immediately after a deletion request; some records may keep identifiers, as described below
• Location pings from a Manual broadcast, and from sharing location in response to a request to share — 14 days by default (a new organization starts with 90 days), then automatically deleted (an organization may set a different period, up to one year)
• Location pings from an SOS broadcast — one year, then automatically deleted
• Chases: kept without a time limit and not deleted automatically. Deleting an account does not delete them
• Copy of location pings in the data analytics system (Google BigQuery) — up to 60 days, then automatically deleted
• Crash reports — retained for up to 90 days
• Record of views and actions, when an organization chooses to share as described in section 4.4: two years, then automatically deleted. An action also recorded in the audit logs is kept as set out below
• Audit logs of sensitive actions (sign-ins, readiness-level changes, emergency broadcasts) — kept for security, oversight, and investigation, and not deleted automatically. Account deletion anonymizes the profile, but security and activity logs and incident records may keep identifiers such as email, phone, name, and IP address, for security and audit

6. Your Rights

Under privacy protection laws, you have the right to:

• Access — request a copy of your data
• Correction — request an update of incorrect information
• Deletion— fully delete your account: in the App, open the menu, tap your name, then in your profile tap “Delete my account” and confirm with an SMS code, or at https://optima-shield.app/delete-account/
• Location-history deletion — by emailing support@optima-shield.app (except chases, which the system has no action to delete)
• Objection — object to certain processing
• Portability — receive data in a structured format

To exercise any of these rights, contact us at support@optima-shield.app.

7. Data Security

Our protection measures:

• Encryption in transit (TLS 1.2+) for all communication
• Permanent login codes stored as a hash (bcrypt) — not in plaintext. One-time codes are stored as an HMAC-SHA256 digest under a server-side pepper, for a limited time only, and never in plaintext
• Authentication tokens (JWT) in HttpOnly cookies
• Encryption at rest for databases and files, with keys managed in a hardware security module (HSM/CMEK)
• Rate limiting to prevent attacks
• Audit logs

No system is 100% secure. We take reasonable measures to protect your information.

8. Children’s Privacy

The App is intended for users 18 years of age and older only. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and discovered that your child provided us with information, contact us and we will delete it.

9. Cookies and Tracking Technologies

• The App uses technical cookies only (session, CSRF) — essential for service operation
• No advertising, tracking, or third-party analytics cookies
• No cross-site tracking

10. International Transfers

Our servers are located in Tel Aviv, Israel (Google Cloud, me-west1 region). Israel has been recognized by the European Union as providing an adequate level of data protection (adequacy decision). Some service providers (Mapbox, Firebase, Sentry, Twilio, Anthropic) operate in the USA, and transfers to them are made on the basis of appropriate safeguards such as Standard Contractual Clauses (SCCs).

11. Changes to This Policy

We may update this policy from time to time. Material changes will be brought to your attention via in-app notification or email. Continued use of the App after an update constitutes consent to the updated policy.

12. Contact Us

For privacy questions, access, correction, or deletion requests:

• Email: support@optima-shield.app
• Website: https://optima-shield.app

Service operator: OPTIMA (Optima-Shield). Version 15.