AHLAN — Privacy Policy

Last updated: 15 September 2026

This policy describes what AHLAN stores, why, who else receives it, how long it is kept and what you can do about it. It was written against the actual database and app, not from a template: every table and column named below exists, and the claims about what is not stored are claims about the schema.

Who we are

AHLAN is operated by [OPERATOR] (company number [COMPANY NUMBER]), [ADDRESS], which decides how the information described here is used and is responsible for it. For anything in this policy, write to privacy@auraforge-ltd.com.

AHLAN helps people in Galilee towns find what is around them: businesses, municipal services, events, deals, jobs and walking trails, and plan a day out from them. It is available in Arabic, Hebrew and English, and this policy is published in all three.

AHLAN is an independent service. It is not operated by, and does not speak for, any government or local council. Council information in AHLAN is published by the council, or by AHLAN on the council's behalf from information the council makes public, and each item says who it comes from.

The short version

• You can use AHLAN without an account and without telling us who you are.
• If you give a name, other people see it next to a review you publish; without one you appear as "AHLAN member". Your telephone number and email address are not shown to other residents.
• Your location is used to answer what you asked and is not kept, except where you deliberately attach it to something, such as a report to your council.
• AHLAN has no advertising SDK, no advertising identifier and no tracking across other apps. It shows listings that local businesses pay for, and they are marked as sponsored.
• AHLAN counts how its listings are used without storing who used them.
• You can delete your account inside the app at any time.

Do you have to give us any of this?

No law requires you to give AHLAN any information. Everything below is voluntary. What happens if you do not give it:

• Without an account you can still browse listings, the map, your town's notices, trails, events, deals and jobs, and search.
• Without signing in you cannot write a review, message or book a business, save a plan, join a group plan, report a problem to your council or ask to be told when AHLAN reaches your area, because each of those needs somebody to reply to.
• Without a name you appear as "AHLAN member" next to a review you publish, and a council receives your report without a name. A name is never required to sign in or to use any feature.
• Without a telephone number a business cannot ring you about a booking and a council cannot call you about a report. Without an email address we cannot write to you about your account.
• Without location access AHLAN shows your chosen town instead of what is nearest to you, and you mark places on a map by hand.
• Without notifications nothing reaches your phone; you can still read everything in the app.

What we store

If you are a guest

If you tap Continue as guest, turn on notifications without signing in (during setup or in Profile → Notification settings), or subscribe to AHLAN+ without signing in, a guest account is created: an anonymous account that is not linked to an email address, a telephone number or a name. Browsing AHLAN creates no account at all.

A guest account made only to receive alerts holds your town, your language, your interests, your notification choices and this phone's device token, and nothing else until you use another feature.

A guest account that nobody has used for 400 days is deleted automatically, with everything attached to it, unless an AHLAN+ subscription is still recorded against it or a phone's device token is still registered to it. Alerts for a guest account go to the phones registered to it — an emergency alert reaches the lock screen without anybody opening the app — so an account with a registered token counts as in use and is not deleted as unused. That is so even if notifications have since been switched off on that phone, in its settings or in AHLAN: switching them off does not remove the token. The token is removed when you sign out on that phone, or when the push service reports that it no longer works the next time AHLAN sends that phone a notice (for example after the app was removed). From then on the 400-day rule applies again.

If you let AHLAN choose your town from your location during setup, only the town is stored, not the position.

When a guest signs in. If you sign in or create an account on a phone where you were using AHLAN as a guest, what the guest account holds moves into your account so nothing is lost: favourites and follows, recently viewed places, notices, plans (including group plans and what you added to them), requests to be told when AHLAN reaches an area, deal codes, saved locations, blocks and reports. Where your account already has its own notification settings or job alerts, the account's choice wins. Your town, interests and language are the ones on the phone you are using: signing in on a phone never empties them, and whatever that phone has not been given yet — interests, or a town — is brought back from your account. The phone proves it is the same person with a code that works once, for 30 minutes, and is stored only in scrambled (hashed) form, with a count of what moved (guest_transfers). The emptied guest account is then deleted under the 400-day rule.

If you sign in

You can sign in with Google, with Apple, with a telephone number or with an email address. Everything above, plus:

Signing in with Google or Apple gives us your name and an email address. AHLAN does not keep your Google or Apple profile picture, and neither provider gives us your contacts, calendar or photographs. Apple's Hide My Email gives us a relay address, and that works here exactly as a real one does; if you turn off forwarding for it, Apple tells us and we record that, so nobody writes to an address that no longer reaches you (profile_contacts.email_relay_disabled_at). Neither provider gives a telephone number. You can add one, if you want to, on the profile screen after you sign in, where it is kept to fill in a booking; a number typed into a booking or a report without it is sent with that booking or report only.

If you sign in with Apple, AHLAN also keeps the refresh token Apple issues for that sign-in (apple_sign_in_tokens). It is used for one thing: when your AHLAN account is deleted, AHLAN sends it back to Apple so that Apple revokes AHLAN's access. It is deleted once Apple confirms the revocation.

Your name is visible to some people. Your telephone number and email address are not. Other people see your display name next to a review you publish, unless they have blocked you; your council sees it with a report you send; people on the same business, council or newsroom team as you see it too; and the other members of a group plan you are in see it, as initials, with what you post there. A trail note is shown without your name, and a business you message or book with does not see your name. Contact details live in profile_contacts, whose access rules return your own row and nobody else's. They reach a business or a council only when you send them there yourself, with a booking or a report. AHLAN platform administrators can see them, for support, moderation and verification; that access is limited to administrator accounts, each time an administrator opens your contact details it is recorded, and so are changes administrators make to an account.

AHLAN sends no marketing email and no marketing SMS. The only promotional messages it sends are notifications on the Deals, Business updates and Recommendations channels, and only if you switch those channels on.

Sign-in and security records

When you sign in, and whenever the app talks to AHLAN's servers, our hosting provider records technical details: your IP address, your device or browser type (the "user agent"), the time, and sign-in events such as a code sent or a session renewed, with the account they belong to. They are used to keep accounts secure, to limit abuse (for example, how many codes one address can request) and to find faults. See "How long we keep things".

If you write something

Reviews carry your display name if you gave one, your rating and your text (reviews). Trail condition reports carry the status you chose (open, caution or closed) and your note (trail_conditions); other people see them without your name. Suggestions and corrections to a listing carry what you offered (moderation_queue) and go to AHLAN staff, who decide whether to apply them. Reviews and trail reports are shown to other people — that is their purpose.

Before anything you write becomes public, AHLAN checks it against a list of words it does not publish. A review that matches waits for a moderator instead of appearing; a message or note that matches is refused so you can rephrase it. Anyone can report a review, trail note, listing, event, deal, job, menu item, news story, announcement, display name or conversation, and a moderator reviews what is reported (reports). Moderators can hide a review, a trail note or a message, reset a display name, and close a conversation.

If you block somebody who wrote a review, their reviews and their name stop appearing for you everywhere in AHLAN (blocked_users); their trail notes do not. If you block the author of a trail note, their trail notes stop appearing for you and nothing else changes: trail notes are shown without a name, so that block is kept separately (trail_note_author_blocks) without revealing to you who the author is. The person you block is not told.

If you message or book a business

A message you send to a business (conversations, messages) is read by that business's team, which sees what you wrote but not your name. Either side can block the other, which stops new messages until it is lifted.

If either side reports a conversation, AHLAN's moderators read it: the conversation itself, with your display name, and a copy of its most recent messages (up to 50, with which side sent each one and when, and the account id of the resident in it) that is kept with the report (reports.snapshot) so it can still be reviewed if the conversation is deleted. Moderators open a conversation only to review a report about it, and each time they do it is recorded. They can hide a message or close the conversation. The copy is deleted once the report is closed and a year has passed since it was made.

A booking request (appointments) shares the service and time you chose, the telephone number you give and any note with that business, so it can confirm or decline. If you book with a doctor, clinic, dentist or another health provider, that provider receives the note too. AHLAN does not ask for health information: write in the note only what you want the provider to know.

When you redeem a deal (offer_redemptions), the business sees that the code was used, so it cannot be used twice, and may record what you saved.

If you use Discover plans

A plan you save (saved_plans, plan_stops) keeps its title, the area and time, who it was for, the vibes you chose and the stops. It is visible only to you. If you share a plan, anyone with the link sees the plan — never your name, account or anything else about you — until you stop sharing it.

Plans are made by fixed rules from the directory, not by an AI model. What you ask the planner — the kind of plan, the area and the day — is logged without your identity (planner_sessions and planner_events have no user column) so we can see which requests AHLAN cannot yet answer. It does not receive the id of a plan you save or the names of places you type. A random number created for one planning session groups its steps together, and is never linked to your account. The planner log follows the usage statistics switch: turn that off and nothing is logged.

If you plan with other people

A plan you saved can become a group plan: you invite people with a link, and together you can chat about the plan, suggest places, vote in polls and say what you would like to do. Joining or posting needs an account that is not a guest account.

• The other people in the plan see your display name (shown as initials) and what you contribute: your comments, suggestions, reactions, poll options and votes, with your name, and your role in the plan. They see counts of everyone's preferences, not your own answers. They never see your telephone number, email address or account.
• Anyone holding an invite link sees only the plan's title, date and town, the number of stops and of people in it, its cover picture and the first name of the person who invited them — never the members' names, the chat or the stops. Invite links expire, can be withdrawn and work a limited number of times.
• What is stored: your membership and role (plan_members), invite links you create (plan_invites, kept as a scrambled form of the link), your comments and reactions (plan_comments, plan_comment_reactions), your suggestions (plan_suggestions), polls, options and votes (plan_polls, plan_poll_options, plan_votes), your preference answers (plan_preferences), and a record of changes to the plan (plan_activity), which refers to people by their place in the plan, never by account.
• Before anything you write in a plan appears, AHLAN checks it against the list of words it does not publish. Members can report a comment or suggestion and block another member, which hides that person's contributions from them. A report keeps a copy — the plan's title, the words and the author's display name — for moderators, and three reports hide it until a moderator decides.
• When you leave a plan, your votes in open polls, your preferences and your reactions are removed and your open suggestions are withdrawn; your comments stay in the plan without your name.
• Notices about a group plan use the group plans notification channel, which is off until you switch it on, and you can mute one plan.
• That a group plan was created, an invite was accepted or a comment, suggestion, vote or poll was posted is counted without your identity or the plan's, in the planner log described above.

If you join AHLAN+

AHLAN+ is paid for through Apple (In-App Purchase) or Google Play. The store takes the payment; AHLAN never receives your card number, the name on it, your billing address or any other payment detail. What AHLAN keeps is the subscription itself, so it can give you the benefits, notice renewals, refunds and cancellations, and let you restore it on a new phone:

AHLAN's server asks Apple or Google about your subscription when you buy, restore or open the app, and when the store sends a notification about it. The stores' own handling of your purchase is described in the Apple and Google privacy policies.

A complimentary membership AHLAN gives you is recorded with who granted it and why (premium_grants).

If you report a problem to your council

A report (resident_requests) carries its category, your description, your location — only if you tap Use my location — an address or landmark if you type one, and — only if you choose to give it — a telephone number. It is sent to your council's team, who see it together with your display name so they can reply to you. Replies and status changes are kept with the report (resident_request_events). If a council stops accepting reports from an account because of abuse, it records that, with a note (municipality_resident_blocks).

If you ask to list a business

List my business sends AHLAN the business name, its type and town, a contact name, telephone number and email address, the business's street address and map pin, and any note you add (moderation_queue). AHLAN staff use it to check the business and contact you. If the listing is approved, the business name, address and pin become its public listing; your contact details are not published.

If you claim a business

Claiming a business from its page sends AHLAN your role at the business, a contact name, a telephone number and/or an email address, how we can check the claim, a note and up to five links you choose (business_claims), linked to your account. Only AHLAN staff read them, to check that the business is yours — for example by calling the telephone number shown on the listing. You can withdraw a claim while it is waiting. If it is approved, your account joins the business's team and can sign in to the Business portal; the public listing stays as it was, and your contact details are not published. Claims are kept as the record of the decision.

If you ask to be told when AHLAN reaches your area

Outside the towns AHLAN covers, you can tap Notify me. We store the place rounded to about a kilometre and the place name your phone gave it (area_interest), linked to your account so we can tell you. Administrators see these only as counts per area.

If you allow location access

Your coordinates are used in the moment: to sort what is near you, to place you on the map, to plan stops near where you are, to search nearby, and to work out which area's results apply — including which labelled sponsored listings apply to that area, by the same area rules as every other result. They are sent to the server as part of a query and are not stored against your account.

Location is stored with your account only when you deliberately act on it:

• your position on a report to your council, if you tap Use my location;
• the map pin of a business you ask to list;
• the rounded place you give when you ask to be notified when AHLAN arrives;
• the area of a plan you save;
• the town chosen from your location during setup, if you let AHLAN choose it.

To turn a position into a place name, or a place name you type into a position, AHLAN asks your phone's own location service, which sends the coordinates or the text to Apple (on iPhone) or Google (on Android).

AHLAN asks for foreground location only. It has no background location permission, no geofencing and no ability to track you when the app is closed.

Weather for your town

Where AHLAN shows the weather, AHLAN's server asks MET Norway (the Norwegian Meteorological Institute) for the forecast at the centre of each town AHLAN covers, and keeps the latest reading for each town (locality_weather). No personal data is sent to MET Norway: not your location, your account, your device or your IP address. The request comes from AHLAN's server, not from your phone, and the app asks AHLAN for a town's weather by the town, not by where you are.

If you turn on notifications

A device token from Apple or Google (push_tokens) is stored with your account, so a notice for your town can reach your phone. If you turn notifications on without signing in, the guest account described above is created to hold it, and it is not deleted as unused while this phone's token is registered to it, even if notifications are later switched off on the phone. Signing out removes this phone's token, so a signed-out phone stops receiving that account's notices. A token the push service reports as no longer working, when AHLAN next sends a notice to it, is deleted automatically.

Your per-channel choices (notification_preferences) — emergencies, municipality, local news, events, deals, recommendations, service updates, business updates, jobs, group plans — are stored so we honour them.

Identifiers on your device

AHLAN uses no advertising identifier. These technical identifiers exist so the app works:

• the device token above, once notifications have been turned on;
• on Android, the Firebase installation id that Google's messaging library creates to deliver notifications;
• a random update id that the app sends to Expo when it checks for an app update;
• a random installation id that the crash reporter creates, if crash reporting is on.

None of them is your name, telephone number or email address.

Usage statistics

AHLAN records that something happened, never who did it — including how many people opened a business's listing, a town's page, an announcement or a council service, and how often a listing appeared in results. Businesses and councils see these as counts. For a sponsored listing, the business that paid for it sees how many times it was shown and opened.

The analytics_events table has no user column at all. Each row holds the kind of event, what it was about, the town, the language and the day — not the time of day.

That means we can answer "did anyone call this bakery this week?" and cannot answer "who called this bakery?". This is a deliberate limit in the schema, not a policy promise: the columns to answer the second question do not exist.

What you type into search is sent to AHLAN's server to find results, and is not stored. AHLAN counts that a category was searched and which listings appeared, without the words you typed and without who searched.

We keep usage statistics because we have a legitimate interest in knowing whether AHLAN works for residents and businesses. AHLAN tells you about them, with a switch to turn them off, during setup, and the same switch is in Profile → About AHLAN. That one switch stops all of it together: the counts in analytics_events, the counts of how listings appeared in search and in ranked results, the counts of how often news was read, the planner log, the counts of how the AHLAN+ screen is used (premium_events: that it was opened, that a purchase was started, that a member pass was shown — with where it was opened from and the day, and no user column) and crash reports. See "Your rights".

Crash and performance reports

If crash reporting is enabled, a crash sends the error, the screen it happened on, the app version, your device model and operating system version, and the random installation id described above. For a small sample of sessions it also sends how long screens and requests took, with the request's address. Your account id and your coordinates are removed from addresses and messages before the report leaves your device, and no report is attached to your account. You can switch crash reports off with usage statistics.

What we never collect

• Your contacts, photos, calendar, microphone or camera
• Background location or a history of where you have been
• An advertising identifier. AHLAN has no advertising SDK or ad network and does not track you across other companies' apps or websites
• What you type into search — it is used to answer the search and not kept
• Payment details from residents. AHLAN+ is paid through Apple or Google, which process the payment; AHLAN receives the subscription's status, never a card. Nothing else in the app takes a payment: a deal is redeemed at the shop counter, a booking is confirmed by the business, and an order is placed on the business's own channel.

Sponsored listings and the order of results

Local businesses can pay AHLAN to appear in results. Those placements are marked as sponsored ("Sponsored", "ממומן", "مموّل"). They appear only when they match what you are looking for, in the area you are looking at, and they are never chosen from a profile of you: AHLAN uses the search, the category and the area, not your account, your history or your interests. Sponsored results come first in every sort order. After them, in the default order, businesses on a paid AHLAN business plan can appear before free listings; sorting by distance or by rating orders the rest by that alone. Tap the Sponsored label to see why a placement is shown, and to report the ad if something about it is wrong.

Who else receives your data

Every service provider in this table protects your data at least as well as this policy does. Supabase, Twilio, Resend, Expo, Sentry and Vercel process it only on our instructions and only to provide their part of AHLAN, under written agreements that require that protection and confidentiality. Apple and Google act under their own terms and privacy policies when they sign you in, bill AHLAN+, deliver notifications or answer a location lookup, and AHLAN gives them only what the table lists. The map services receive only what a browser sends to any website. A business or council you contact is responsible for what it does with what you sent it.

MET Norway, which provides the weather, receives nothing about you: only the coordinates of a town's centre, from AHLAN's server.

We do not sell your data, and we do not share it with advertisers or data brokers.

Data stored outside Israel

AHLAN's database is hosted in Paris, France (European Union), and several of the providers above (Expo, Sentry, Twilio, Resend, Vercel, Apple and Google) process data in the United States or the European Union. We transfer data abroad only as Israel's Privacy Protection (Transfer of Data to Databases Abroad) Regulations permit: to countries whose law protects it, or to providers that have undertaken in writing to protect it, to use it only for AHLAN, and not to pass it on except to their own sub-processors under the same terms.

How long we keep things

Deleting your account

Profile → Account → Delete my account, inside the app. You type the confirmation word the app shows. For a resident it is immediate and it is not reversible.

It removes your sign-in, your profile, your contact details, your favourites, your follows, your recently viewed places, your reviews, your messages and booking requests, your deal redemptions, your saved plans, your notify-me requests, your notification preferences and notifications, your blocks, your device tokens, your member passes, your group plan memberships, comments, suggestions, votes, reactions and preference answers, and any suggestion or listing request AHLAN has not yet decided on. If you signed in with Apple, AHLAN asks Apple to revoke the sign-in.

A group plan you own is not deleted for everybody. It passes to another member — the editor who joined it first, otherwise the participant who joined first, otherwise a viewer — so the others keep their plan. A plan with no other members is deleted with your account.

You can also ask without the app: see https://ahlan.auraforge-ltd.com/delete-account.html, or write to privacy@auraforge-ltd.com.

Deleting your account does not cancel AHLAN+. Apple or Google keeps charging until you cancel with them, and the app says so before you delete.

What stays after deletion, and why:

• A safety report you filed stays, with your identity removed. Otherwise somebody could file a report about a dangerous listing, delete their account, and the report would vanish before anybody read it.
• A copy of a reported conversation you took part in stays with the report — the recent messages, which side sent each and when, and the id your account had, which no longer leads to anybody — so a moderator can still act on it. It is deleted once the report is closed and a year has passed since it was made.
• A report to your council stays with the council, with your name and your telephone number removed, so the street light still gets fixed. The description, address and pin you gave stay with it, and so do the messages in its conversation, yours included.
• A trail condition report keeps only the open, caution or closed status you reported, without your identity. The text of your note is deleted.
• A suggestion, correction or request to list a business that AHLAN has already decided on stays as the record of what was decided, without your identity and without your contact details, address, map pin or note. One that was still waiting is deleted.
• Usage statistics and the planner log, which never had your identity in them.
• An AHLAN+ subscription record, because the store may still be billing it. It is no longer linked to any AHLAN account and holds no account reference: only the store's transaction id or purchase token, the plan, its state and its dates. It lets a refund or a cancellation be matched, and lets whoever pays for the subscription restore it to a new account with Restore purchases. It is deleted 90 days after the subscription ends.
• Records we must keep by law, for the period the law requires.

If you manage a business or council page, the same button sends us a deletion request rather than deleting at once, because the page must be handed to somebody else first. We complete it within 30 days and confirm by email.

If your business or trade is listed and you never signed up

Some listings were imported from OpenStreetMap, a map made by volunteers and published under the Open Database Licence, or were suggested by residents. For a sole trader, a listing can include details about a person. What such a listing can show: the business or trade name, its category, its location and street address, a telephone number, a website and opening hours. It is marked unverified until somebody who runs the business confirms it. We keep these listings because residents have a legitimate interest in finding local businesses, and we keep only what the source published.

You can have it corrected, taken over or removed:

• in the app, on the listing: Is this yours? Tell us to take it over and correct it, or Report → This is my business and I did not add it to object to it;
• or by writing to privacy@auraforge-ltd.com with the listing's name and town.

We reply within 7 days. If you ask, we remove a private telephone number or the whole listing.

Businesses, councils and newsrooms

People who manage a business, council or newsroom page use AHLAN's business and council websites. There we also store their sign-in email, their role on the team, what they publish, a record of changes they make, and the support requests and messages they send us (support_tickets, support_ticket_messages). Paid business plans and placements are billed through HYP, a payment processor; AHLAN stores the plan, the invoices and the card's last four digits and expiry, never the full card number.

Children and teenagers

AHLAN is not directed at children under 13, you must be 13 or older to use it, and we do not knowingly collect information from children under 13. If you believe a child under 13 has given us information, write to us and we will delete it. If you are under 18, talk to a parent before you subscribe to AHLAN+ or share your telephone number with a business.

Your rights

Under Israel's Protection of Privacy Law you may ask to see the information we hold about you, to correct it, and to have it deleted. Most of it you can see and change in the app directly; for anything else, write to privacy@auraforge-ltd.com and we will respond within 30 days. If you are not satisfied, you can complain to Israel's Privacy Protection Authority.

Withdrawing consent and objecting. You can change your mind at any time:

• Location: turn location access off for AHLAN in iOS Settings → AHLAN → Location, or in Android Settings → Apps → AHLAN → Permissions. The app keeps working without it.
• Notifications: switch any channel off in Profile → Notification settings, or turn all notifications off for AHLAN in your phone's settings.
• Usage statistics and crash reports: switch them off in Profile → About AHLAN.
• Anything else: write to privacy@auraforge-ltd.com.

Withdrawing consent does not make earlier use unlawful; it stops further use.

AHLAN is made for, and offered in, Israel. If you use it from the European Economic Area or the United Kingdom, the GDPR gives you rights of access, rectification, erasure, restriction, portability and objection, and a right to complain to your supervisory authority. Our lawful bases are consent (for notifications and location), contract (for providing the service you asked for, including an AHLAN+ membership you bought), legitimate interest (for keeping the platform working and safe, usage statistics, crash reports and listings of businesses that did not sign up — you can object to any of these) and legal obligation (for records the law requires).

Security

Access to data is enforced in the database itself by row-level security rather than by the app asking nicely. A business can read its own listing and not another's; a council can post for its own town and not the next one; a resident can read their own inbox and nobody else's. These rules are tested by an automated suite against a test database before each release. Everything between the app and AHLAN's servers is encrypted in transit.

No system is perfect. If you find a vulnerability, write to privacy@auraforge-ltd.com and we will work with you.

Changes

If we change this policy we will update the date at the top. Before a significant change takes effect, we will tell you in the app. If we want to use your information for a purpose this policy does not describe, we will ask for your consent first, unless the law allows it without consent. Earlier versions are available on request.

Contact

[OPERATOR] Company number [COMPANY NUMBER] [ADDRESS] privacy@auraforge-ltd.com