מדיניות פרטיות — מסע

Privacy Policy — Masa (מסע)

Last updated: 6 October 2026

Masa is a trip-planning app. This page states exactly what is stored, what never leaves your device, and which third parties receive data.

No account, no sign-up

There is no registration, password, email address or username. On first launch the app creates a random device identifier, stored on your device, used only to associate your trips with your requests. We do not know who you are and have no way to find out.

What is stored on our server

• That random identifier and the date it was created.
• The trip content you enter: destination, cities, dates, budget, number of travellers and children, kosher preference, trip types, free-text notes, each day's stops, the times you set, the places you chose to stay, and flight details you entered (flight number, airports and times).
• What you marked yourself as "I already booked" — a stay, a flight, tickets or an eSIM — and when. Partner sites do not report this to us; it is only your own mark.
• Settings: language, kosher default, Shabbat timing.
• Daily usage counters — how many itineraries were generated and how many searches run — to enforce limits and control cost. These are counts, not a history of what you searched for.

What never leaves your device

• Your trip journal — the text, the places you marked and the photos. All of it is stored locally. Photos are never uploaded to us or to anyone else.

Location

Location is requested only while you are using the app, and only to answer two questions: what is near you now, and what the Shabbat times are where you are. When you use one of those features the coordinates are sent with the request to run the search and are not stored. We do not build or keep any location history.

Photos

Photo access is requested only when you choose to attach a picture to your journal, or ask the journal to find the photos you took on a day of your trip. That search runs on your device and looks only at when each photo was taken; the photos you pick are copied into the app, on your device. We do not upload, view or back them up.

Notifications

Reminders are scheduled locally on your device. The app does not use remote push notifications and never creates a push token, so no server can send you a message.

Who receives data

• Google Places — to find places and fetch their details and photos. Search terms and the relevant coordinates are sent.
• Google Routes— a day's road route, when you open it. The coordinates of that day's stops are sent.
• Viator— to find tickets for places on your days. Only the place's English name is sent — not your identifier and not your trip.
• Kiwi.com— when you tap "Find flights", the app asks Kiwi.com what it calls your trip's city, and on a flight day which airport is the city's. The city's coordinates are sent (not yours).
• Frankfurter — exchange rates. Only currency codes are sent.
• Anthropic (Claude) — to build the itinerary. The trip details you entered are sent: destination, dates, budget, who is travelling, preferences and free-text notes. Your identifier is not sent, and neither is your journal.
• Hebcal — Shabbat times for a location.
• Vercel (server hosting) and Supabase(database) — they hold the data listed under "What is stored on our server" on our behalf.

Booking links and commission

The app has buttons that open partner sites to book a hotel, a flight, attraction tickets, a ride to or from the airport, or an eSIM. Masa does not make the booking or take the payment — the partner site does. The partners:

• Stay22— hotels (it hands off to Booking.com and other hotel sites). The link carries the hotel's name, its location, the dates and the number of travellers.
• Travelpayouts — flights on Kiwi.com (departure and destination cities, dates, number of travellers), eSIMs on Airalo (the destination country) and airport rides on Kiwitaxi(the airport's code and the other end of the ride — the hotel or stop's name, or the city).
• Viator— attraction tickets (the ticket's page).

Nothing is sent to a partner until you tap the button. The link also carries our partner code and which button you came from — they identify Masa, not you; your identifier is never sent. Once the site opens, its own privacy policy applies. If you book through it, Masa may earn a commission from the partner — your price stays the same. The reports we receive show that a booking happened and the commission, with no name, contact or payment details.

The "Get an Uber for this leg" button opens Uberwith the leg's two ends — their names and coordinates. Uber is not our partner, the link carries no partner code, and Masa earns nothing from it.

What we do not do

• No advertising and no advertising identifiers.
• No analytics, measurement or tracking tools of any kind.
• We do not sell data or share it for marketing.
• We do not track you across other apps or websites.

Deleting your data

Deleting the app removes everything stored on the device, including the journal and its photos. To also delete what is on the server, email erez.shay9@gmail.comand we will delete the trips and settings tied to your device. Because there is no account, please send the request from the device via "Contact" in Settings, so we can tell which identifier to delete.

Children

The app is not directed to children under 13 and does not knowingly collect information from them. The question about how many children are travelling is used only to pace the itinerary; it is not information about the children themselves.

Changes

If this policy changes, the date at the top will change with it. Any material change will be described here explicitly.

Contact

erez.shay9@gmail.com