Privacy Policy

Yarcone ("we", "us") is operated by Netanel Peretz, a sole proprietor registered in Israel. We run www.yarcone.com, a dispatch and delivery management service used by delivery businesses ("organizations"), their dispatchers and drivers, and, through tracking links and messages, the people they deliver to ("recipients").

This policy explains what information we collect, why, who receives it, how long we keep it, and what you can do about it. It is written under the Protection of Privacy Law, 5741-1981, and the regulations under it. Our Terms of Service govern use of the service.

Two roles matter. For your account, our website, and your dealings with us, we are the owner of the information. For the content an organization puts into the service, including recipients' details, the organization is the owner and decides why it is collected; we hold and process it on the organization's instructions. If your details are in an organization's orders, that organization is your first point of contact, and we help it respond.

You have no legal duty to give us information. Whether you do is your choice. Without some of it we cannot provide the service: an account needs a name and an email address, a delivery needs an address and usually a phone number, and route messages to a driver need their phone number. Where information is entered by an organization rather than by you, that organization decides what it enters.

• Account information. Your name, email address, phone number, language, and profile picture, plus a password (stored only as a secure hash) or your Google sign-in profile if you use "Continue with Google". If you turn on two-factor authentication, the secret it depends on. We also record when you accepted our terms.
• Organization content. Orders and delivery information your organization enters or imports from a file or a connected Google Sheet: recipients' names, phone numbers, addresses, optional email addresses, notes, order and tracking numbers, delivery zones, priority flags, cash-on-delivery amounts, payment marks, doorstep sales, product catalogs, and files the office attaches to an order for the driver.
• Proof of delivery. When an organization uses these features, a driver can take a photo at the door, collect the recipient's signature on the screen, and scan a pickup label. Each is saved with the time and, when the device shares it, the location where it was captured. A photo can show people or property at the delivery address.
• Driver location and shifts. While a driver is on shift in the app and has allowed location access, the app sends us the device's position. We keep the latest position, the order of the driver's remaining stops, the approximate distance driven each day, and when the shift started and ended. See "Addresses and location" below.
• Messages. A record of each notification and reply sent on an organization's behalf: the phone number, the text, any attachment sent, the channel (WhatsApp or SMS), and whether the provider accepted and delivered it. When a recipient replies on WhatsApp: the text, any photo or document they send, a location they choose to share, their WhatsApp profile name, and the time. Route messages sent to drivers are recorded the same way.
• In-app notifications. Events shown in the app's notification bell, such as a failed delivery, a finished route, a plan limit, or a new customer message.
• What you send us. Demo requests from our website (name, business name, email, phone, plan of interest, message), feedback submitted inside the app (with your name, email, and the page you were on), and support emails.
• Technical information. Standard server logs, IP address, device and browser details, error reports, and product analytics about how the app is used. When you are signed in, analytics and error reports are linked to your account (your id, name, and email). We do not run advertising trackers, and tracking-link tokens are removed before anything reaches an analytics provider.
• Support access records. When an authorized Yarcone administrator acts inside an organization to help with a support request, the action is logged with who did it and when.

From you, when you create an account, use the app, or write to us. From your organization's owners and dispatchers, when they enter or import orders and invite members. From recipients, when they reply to a message or share a location on WhatsApp. From your device, when a driver allows location access. From Google, when you sign in with Google (name, email, profile picture) or connect a spreadsheet. From our providers, in the form of delivery statuses and error reports.

To operate the service: turning orders into routes, dispatching them to drivers, showing live progress and estimated arrival times, notifying recipients and drivers, running the WhatsApp inbox, recording deliveries, payments and sales, and producing reports and scheduled report emails.

To run accounts and communicate with you: verification codes, password resets, email changes, invitations, approval of a new organization, account deletion confirmation, scheduled reports, and important notices about the service or these terms.

To keep the service secure: sessions, optional two-factor authentication, rate limiting, signature checks on incoming webhooks, access checks on files and attachments, and investigating abuse.

To support you, find and fix errors, and understand and improve how the service performs. To keep business records, comply with the law, and establish or defend legal claims.

We do not sell personal information, use it for advertising, profile people for marketing, or use organization content to train artificial intelligence models. If we ever wanted to use information for a purpose this policy does not cover, we would tell you first and ask for consent where the law requires it.

Organizations enter or import recipients' details in order to run their deliveries. We process that information on the organization's behalf and under its control. If your details appear in a delivery and you have questions, or want your details corrected or removed, contact the business that delivers to you; we act on its instructions. You can also reach us at nati@yarcone.com and we will help.

If the organization has switched on customer notifications, we send you operational messages about your delivery in the organization's name: a tracking link when the order is created, the outcome of the delivery or pickup, and a payment confirmation. Messages go over WhatsApp where possible and otherwise by SMS to Israeli mobile numbers. They are never marketing.

You can reply to those messages on WhatsApp. Your reply, any photo or document you attach, a location you choose to share, and your WhatsApp profile name are stored and, if the organization uses its WhatsApp inbox, shown to its owners and admins, who answer from the inbox. Drivers do not see the inbox. Nothing replies to you automatically. Attachments you send are fetched from WhatsApp only for the organization your message belongs to. To stop messages, tell the business, or reply and ask.

A tracking link opens a page that anyone holding the link can view. It shows the organization's name and logo, the order number, your first name, the delivery address, and the delivery's status. While the driver is on the way it also shows the driver's first name, their live position on a map, an estimated arrival window, and how many stops are ahead of yours. The page never shows phone numbers, other customers' details, or proof of delivery. Tracking links are not indexed by search engines.

If you drive for an organization, the organization's owners and admins can see your live position while you are on shift, your route and progress, the approximate distance you drove each day, your delivery statistics, and the photos, signatures and scans you capture. A recipient can see your first name and live position on their tracking page while you are on the way to them. Your organization is responsible for telling you about this and for how it uses it.

If your organization turns on driver messages, you receive your route summary and route changes by WhatsApp or SMS at the phone number on your account.

To place stops on a map and put them in an efficient driving order, delivery addresses are sent to Google Maps Platform, which returns map coordinates. We store those coordinates so the same address doesn't need to be looked up again. When a dispatcher types an address, Google also suggests matching addresses as they type.

A driver's device location is used only with their permission, and only while they are on shift in the app. It is sent to us so that we can order their remaining stops from where they stand, estimate arrival times, and measure the approximate distance driven each day. Going off shift in the app, or withdrawing the location permission on the device, stops it. A shift also ends by itself after three hours without any activity in the app.

To calculate travel times and road routes, the position is also sent to Google Maps Platform together with the stops' coordinates. We keep a driver's most recent position, the approximate distance driven each day, the position where a delivery photo or signature was captured, and the position used for an order's latest arrival estimate. We do not keep a continuous history of a driver's movements.

A location a recipient shares in a WhatsApp reply is stored with that message and shown to the organization.

This section applies only to the Yarcone driver app for iPhone and Android, installed from the App Store or Google Play. It does not apply to our website or to using Yarcone in a browser.

If you allow the app location access "Always" (on Android, "Allow all the time"), it collects your device's location in the background while you are online, including when the app is not on screen, for example while you use a navigation app or your phone is locked. Before your phone asks for this permission, the app explains what it is for, and you can decline and keep using the app. While the app collects location in the background, iPhone shows the location indicator at the top of the screen and Android shows a notification that you are online. Each report sends us your position, how accurate it is, the distance counted since you went online, and which stops remain on your route. We keep only your latest position and each day's distance, as described in "Addresses and location", and no history of your movements.

The location is used so that your organization's office can see where you are on its live dispatch map, so that the recipients you are on your way to can follow you and see an estimated arrival time on their tracking link, and so that the distance you drive during your shift is recorded in full.

It is received by your organization's owners and admins, and by the recipients of deliveries on your route, on their tracking page while you are on the way to them. To calculate travel times and routes it is also sent to Google Maps Platform, as described above. It is not sold or used for advertising.

Collection in the background stops when you go offline in the app, when your shift ends, including when it ends by itself after three hours without activity, or when you withdraw the permission. It also stops if the app is closed completely, until you open it again. If you do not allow "Always" access, the app collects your location only while it is open on your screen, and while you are offline it collects none.

To stop it for the day, go offline in the app with "Slide to go offline". To turn off location in the background for good, change Yarcone's location permission in your phone's settings: on iPhone, under Settings, Yarcone, Location, choose "While Using the App" or "Never"; on Android, under the app's permissions (the path varies by phone), choose "Allow only while using the app" or "Don't allow". Without any location access, your office and recipients cannot see where you are.

Within your organization. Owners and admins see the organization's content, messages and inbox, drivers' positions on shift, and reports. Drivers see the stops assigned to them and their own statistics.

Recipients. A tracking page shows a recipient the assigned driver's first name and live position while on the way, and messages carry the organization's name.

Service providers. We rely on a small number of providers to run the service, each receiving only what it needs:

• Vercel. Hosting and delivery of the app, plus aggregate traffic and performance analytics.
• Neon. The database that stores accounts and organization content.
• Google. "Continue with Google" sign-in. Google Maps Platform, which receives delivery addresses and coordinates, and drivers' positions, to place stops on a map, suggest addresses, draw routes, and estimate travel times. The Google Sheets API, only for spreadsheets an organization chooses to share with our service account.
• Twilio. Sending and receiving SMS and WhatsApp messages. It receives the phone number and the content of each message, reports delivery status, and holds photos and documents recipients send until we fetch them. WhatsApp messages are delivered through WhatsApp, a Meta service, under Meta's rules.
• Resend. Delivery of transactional email.
• UploadThing. File storage for uploads: delivery photos, signatures, order attachments, files sent from the inbox, logos, and profile pictures.
• PostHog. Product analytics about how signed-in users and website visitors use the service, hosted in the European Union.
• Sentry. Error monitoring, hosted in the European Union. Error reports can include technical details of the request that failed.

Legal reasons. We may disclose information when the law requires it, to comply with a court order or a lawful request from an authority, to enforce our terms, or to protect the rights, property or safety of Yarcone, our users, recipients, or the public, including to investigate fraud or a security incident.

Business transfer. If Yarcone is sold, merged, or reorganized, or its assets are transferred, information may be transferred to the successor, who will be bound by this policy. We will notify account holders before that happens.

With your consent, or on an organization's instruction for its own content, in any other case.

Our providers store or process information outside Israel: in the European Union (hosting, database, analytics and error monitoring) and the United States (messaging, email, file storage, and Google services, some of which are global). We transfer information only to countries whose law protects personal information adequately, or under written commitments from the provider to protect it as Israeli law requires, and only what the service needs. By using the service you consent to these transfers.

We use cookies and browser storage that the service needs in order to work: keeping you signed in, protecting your session, remembering your language and theme, and carrying your consent through a Google sign-up. Our analytics provider stores an identifier in your browser, served through our own domain. The driver app keeps the state of the day's route on the device so it survives a reload. We do not use advertising cookies. You can clear cookies in your browser; you will then need to sign in again.

We keep information while your account or organization is active. Organization admins can cancel and delete orders inside the app. A cancelled order is deleted permanently, together with its photos, signatures, and attachments, 60 days after it was cancelled, or sooner if an admin deletes it. Notifications in the bell are deleted after 45 days. Message records, conversations and inbox attachments are kept with the organization's data while the organization exists.

Deleting an organization, from its billing page or by cancelling, deletes its orders, message records, conversations, reports, settings, and uploaded files. You can delete your own account from your profile settings; we confirm it by email first. Deleting an account removes the account, its profile picture, and any organization you alone own. Organizations with another owner continue without you. Demo requests, feedback and support emails are kept as business records, and server logs and error reports are kept for a short time by our providers.

We keep records we need for tax, accounting, or to establish or defend legal claims for as long as the law requires, and the record of when an account accepted our terms for as long as a claim could arise.

All traffic is encrypted in transit (HTTPS). Passwords are stored only as secure hashes, two-factor authentication is available on every account, sign-in attempts are rate-limited, and access inside an organization is role-based: drivers, dispatchers, and owners each see only their part. Incoming webhooks are verified by signature, and files and inbox attachments are served only after checking that the viewer belongs to the organization. Our providers hold their own security certifications.

When you ask us for help, an authorized Yarcone administrator may access your organization's account to investigate. That access is logged. We act in line with the Protection of Privacy (Data Security) Regulations, 5777-2017. No system is perfectly secure; if a security incident affects your information, we will act as the law requires, including notifying the Privacy Protection Authority and the people affected where required, and we will tell affected organizations.

Under the Protection of Privacy Law you have the right to inspect the information we hold about you (section 13) and to ask that information which is inaccurate, incomplete, or outdated be corrected or deleted (section 14). You can also ask us to delete your account, to export your information, to stop a use that relies on your consent, or to explain how your information is used.

To exercise a right, write to nati@yarcone.com. We may ask you to verify your identity first, and we answer within the time the law sets. Where the law lets us refuse, we will explain why. You can complain to the Privacy Protection Authority. If your information was entered by an organization, we will pass your request to it, or you can approach it directly; we act on its instructions for its content.

Owners and admins can see and edit most of their organization's content in the app, export orders and reports, and delete orders, members, and the organization itself.

The service is intended for business use and is not directed to anyone under 18. We do not knowingly collect information from children.

If this policy changes, we will post the updated version here with a new effective date. For a material change we will notify account holders by email or in the app before it takes effect.

Questions about this policy or your information: nati@yarcone.com. This policy is published in Hebrew and in English. If the two differ, the Hebrew version prevails.