Privacy Policy — DishPool

Last updated:

2026-10-10

Data controller:

Shay Pinhassi

Privacy contact:

hello@pinhassisolutions.com

DishPool is a web app for organising potluck (shared-meal) events: guests join an event, RSVP, and choose which dishes to bring so the meal has balanced category and quantity coverage. Event owners and managers run the event. The service is aimed primarily at residents of Israel, and this policy governs its use. The operator is the data controller of the personal data described here, within the meaning of Israel's Protection of Privacy Law, 5741-1981 (as amended by Amendment 13, in force 14 August 2025).

(a) Data you give us:

• Account details: you sign in using a one-time SMS code to your phone, or a Google account — these are the only sign-in options; there is no email-and-password login. Accordingly we collect your phone number (if you sign in by SMS code) or your email address and name from Google (if you sign in with Google). We also store a display name and language preference.
• Event-participation data: RSVP status (coming / maybe / not coming), number of adults and children in your household, household name, and a contact note. Anyone with the event link can join after signing in; participation details and dishes are shared with event participants and managers to coordinate the meal.
• Providing information is voluntary, not a legal obligation. Sign-in and participation details are needed to join and coordinate; recipes, photos and AI imports are optional.
• Contributions (dishes): dish name, notes, serving count, and the dietary and allergen tags you declare (e.g. vegetarian, vegan, kosher, nuts, sesame). Allergen information is a participant declaration only and is not a safety certification.
• Recipe data (optional feature): title, ingredients, instructions, source link and photo. Event participants can save shared recipes to their private cookbooks; author updates appear for everyone who saved the recipe. Saved recipes can remain available after the event is deleted. Bookmarks and personal shopping lists, including need / already have / bought states, are private to the account.
• Recipe imports: when you choose to import an image, PDF, audio or video recording, transcript or webpage, content needed for processing is sent to OpenAI. You review the result before adding it to your dish. Attaching a display photo alone does not trigger text extraction. The app does not retain original import files after processing; display photos are kept in private storage. See section 4.
• Admin notes: event managers may enter management-related notes.

(b) Data collected automatically:

• IP address and basic server data, collected by our hosting and security infrastructure for operations and security. Under Amendment 13, an IP address is personal data.
• Error data: for fault and stability monitoring we use Sentry, which may collect the technical context of an error (including IP address). This is operational error/security monitoring — not marketing analytics. See section 9 (Cookies).
• We run no analytics, advertising, or marketing-tracking tools.

(c) Data from third-party sign-in:

• If you sign in with Google, we receive your email address and name from Google to create your account.
• If you sign in with a one-time code, your phone number is processed through Supabase Auth, and the SMS is delivered via Twilio.

We use third-party service providers that act on our behalf. Most are located outside Israel (mainly in the US) — see section 5 on international transfers.

We do not sell personal data and do not share it with third parties for marketing.

The service uses providers outside Israel. The database and storage project is in Ireland; hosting, authentication, email, monitoring and AI providers may process information in additional countries, including the US, under their service and privacy terms. AI import is optional: you can enter a recipe manually. Please leave unnecessary personal information out of import files. Contact us using the details below with questions about processing.

We apply reasonable technical and organisational measures to protect your data, consistent with the Protection of Privacy (Data Security) Regulations, 5777-2017: database access is restricted by row-level security, service secrets are kept server-side only, and connections are encrypted. No security method is perfect, but we work continuously to protect your data.

Under the Protection of Privacy Law you have the right to:

• Access the personal data we hold about you (provided in Hebrew, English, or Arabic).
• Correct inaccurate or outdated data.
• Delete data that is no longer needed for the purpose it was collected for.

To exercise a right, contact hello@pinhassisolutions.com. We will verify your identity before acting and handle the request under applicable law. Requests are currently handled manually by the administrator.

The site uses only essential / functional cookies and local storage:

• Sign-in tokens (Supabase) in local storage — to keep you signed in.
• A PKCE verifier — to secure the Google sign-in flow.
• A NEXT_LOCALE cookie — to remember your chosen interface language.

We use no analytics, advertising, or marketing-tracking cookies. Our error-monitoring service (Sentry) is an operational/security tool; it does not continuously record sessions and does not set consent-gated third-party cookies. We do not display a marketing-cookie banner.

The service is intended for adults organising private events and is not directed at children. If we learn that we have collected a minor's data without an appropriate basis, we will delete it.

We may update this policy from time to time. Material changes will be posted on this page with an updated date. Continued use after an update constitutes acceptance of the revised version.

For any privacy question or to exercise your rights: Shay Pinhassi — hello@pinhassisolutions.com.