Privacy Policy
Last updated: 2026-10-04
The Hebrew version of this policy is the binding version. This English translation is provided for convenience.
Kadurim (the "Operator", "we") operates Kadurim, a website and web app for managing firearms, ammunition and training and for comparing range and store prices (the "Service"). Your privacy matters — especially for information about firearms and licensing. This policy explains what we collect, how we use it, who we share it with, and how to exercise your rights.
Who we are
The owner of the database and the party responsible for processing is Kadurim. For any privacy question, or to exercise your rights, email [email protected].
This policy is part of the Terms of Use and follows the Israeli Protection of Privacy Law, 5741-1981 (including Amendment 13), and the Protection of Privacy (Data Security) Regulations, 5777-2017. You are not legally required to give us any information, but some features need certain details.
1. Information we collect
1.1 Registration and account. Name, email and password (stored only as a hash — we can't see it). With Google sign-in we receive your name, email and profile picture from Google, as you authorized there.
1.2 Profile (optional). Phone, firearm license number and expiry date, preferred range.
1.3 Vault and training log. Your firearms (make, model, nickname, round count, cleaning interval and, optionally, serial number), ammunition stock and its location (safe or range bag), and sessions (date, place, rounds, costs, notes).
Tip: serial number and license number are optional. If you don't need them in your log, leave them empty.
1.4 Content you submit. Price reports, page-claim requests (full name, phone, message), catalog items you add, and photos of places and items uploaded as a place manager.
1.5 Contacting us. The content of your message and the contact details in it, including accessibility or privacy requests.
1.6 Collected automatically. IP address, device and browser type, operating system, language, pages visited, visit times, referrer and server logs — partly through cookies and analytics tools (see sections 2.3 and 7).
1.7 Buying a subscription. If you buy a paid plan (when offered), payment takes place on the checkout page of Dodo Payments, acting as Merchant of Record. Dodo Payments itself collects your payment details, cardholder name, billing address, email, IP address and device details, to process the payment, issue a receipt, collect tax, prevent fraud and comply with law, as an independent controller under its privacy policy. Your card details never reach us. From Dodo Payments we receive only what we need to manage the subscription: customer and subscription IDs, plan, amount, currency, dates, payment status, card brand and last four digits (if provided) and billing country.
1.8 Photos. Uploaded photos are resized and compressed, and all embedded data (EXIF), including GPS location, is removed before storage.
2. How we use it
2.1 Providing the Service — your account, vault, round counts, training log, cleaning reminders and license-expiry warnings, plus support.
2.2 Prices and places — reviewing and publishing prices and place details. Price reports are published without your name; it is shown only to administrators and the place's managers who review the report. Page-claim requests are reviewed by administrators only.
2.3 Analytics and improvement. We use the Shony Labs analytics service to understand how the Service is used and improve it — which pages are viewed, where users get stuck, which devices they use. It includes session recording (mouse movement, scrolling and taps on a page) and heatmaps. To protect your information:
- all form fields are masked in recordings;
- the personal app areas (vault, sessions, profile and management screens) are excluded from recordings and heatmaps, and their content is not sent to the analytics service;
- full recording happens only on public pages (home, articles, ranges and prices);
- when you are signed in, your visits are linked to your account (account ID, display name and profile picture, if you have one), so that using the Service from several devices counts as one user. Your email, phone, license details, vault and training log are never sent.
2.4 Security and abuse prevention — detecting and preventing fraud, intrusion, false reports and breaches of the Terms.
2.5 Messages. Service messages (account verification, password reset, material changes) are sent as part of the Service. Marketing messages are sent only with your explicit consent (section 30A of the Communications (Telecommunications and Broadcasting) Law, 5742-1982); you can withdraw it at any time.
2.6 Subscriptions — managing your plan, enabling paid features, renewal reminders, cancellations and refunds.
2.7 Legal obligations.
2.8 Legal basis. We process information based on your consent (e.g. marketing under section 30A of the Communications Law, and cookies as in section 7), our agreement with you to provide the Service you asked for, our legitimate interest in running and securing the Service and preventing abuse, and legal obligations.
We do not sell your information or use it for third-party targeted advertising.
3. Sharing
3.1 Our staff and contractors, only as needed for their role and under confidentiality obligations.
3.2 Service providers processing data on our behalf only:
| Service | Purpose | Data |
|---|---|---|
| Cloud hosting & infrastructure | Running the site and database | All Service data |
| Cloudflare R2 | Storing place and item photos | Photos (no embedded data) |
| Sign-in with Google (if you choose it) | Basic Google account details | |
| Dodo Payments | Subscription payments, as Merchant of Record (independent controller) | Payment and billing details, as in section 1.7 |
| Shony Labs | Usage analytics, session recording, heatmaps | Browsing and usage data, as in section 2.3 |
| OpenStreetMap | Maps and address lookup (place managers) | IP address; searched address |
| Email provider | Sending service messages | Name and email |
3.3 Place managers see price reports about their place, including the reporter's name.
3.4 Corporate changes. In a merger, acquisition or sale of assets, information may pass to the acquiring entity, provided it undertakes to follow this policy.
3.5 Authorities — where required by law, court order or a competent authority, or to prevent harm to people, property or the Service.
3.6 Transfer abroad. Some providers store or process data outside Israel, in accordance with the Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 5761-2001.
4. Security
We use reasonable, accepted measures — encrypted transport (HTTPS), hashed passwords, restricted role-based access and backups. No system is perfectly secure. Keeping your password confidential is your responsibility. In a serious security incident we will act as required by law, including notifying the Privacy Protection Authority and affected users where required.
5. Your rights
5.1 Access the information held about you (section 13 of the Law). 5.2 Correction or deletion of information that is inaccurate, incomplete, unclear or outdated (section 14). 5.3 Account deletion with all associated personal data. 5.4 Opt out of marketing. 5.5 Object to or ask to restrict processing based on legitimate interest. Requests about payment data should also be sent to Dodo Payments.
Most details can be edited in your profile and vault. For anything else email [email protected]. We will respond within 30 days, as set by the regulations. You may also contact the Privacy Protection Authority.
6. Retention
Main periods: account, vault and log data — while your account is active; subscription and payment records — as long as tax and accounting law requires; analytics data — per the analytics provider's settings; messages to us — as long as needed to handle them and reasonable follow-up.
We keep information while your account is active and as long as needed for the purposes in this policy, legal compliance, dispute resolution and enforcing the Terms. When you delete your account, your vault, log and profile are deleted. Aggregated statistics and price reports already published without identifying details may be kept. Backups are deleted in their normal cycle.
7. Cookies and local storage
A notice about cookies is shown when you first visit; continuing to browse means you agree to their use as described here. You can block or delete cookies in your browser, but without essential cookies you cannot sign in.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| Sign-in cookie (better-auth) | Essential | Keeps you signed in | Until sign-out or session expiry |
| NEXT_LOCALE | Functional | Your interface language | 1 year |
| shonylabs_visitor_id | Analytics | Recognizing returning visitors for statistics | 1 year |
| Session storage: shonylabs_session | Analytics | Identifying the current visit | Until the browser closes |
| kadurim-theme | Functional | Dark, light or device theme | 1 year |
| Local storage: cookie notice | Functional | Remembering the notice was accepted | Until cleared |
| Local storage: offline queue | Essential | Sessions logged without reception, until they sync | Until synced |
| Local storage: accessibility preferences | Functional | Accessibility widget settings | Until cleared |
There are no advertising cookies in the Service.
7A. Database registration and privacy officer
We review the registration, notification and privacy-officer obligations under Amendment 13 to the Protection of Privacy Law (in force since 14.8.2025) according to the scope and type of data in the database, and comply where they apply. Until an officer is appointed, privacy requests are handled at [email protected].
8. Third-party services and links
The Service links to external services such as Waze, Google Maps, Apple Maps and range websites, governed by their own privacy policies.
9. Minors
The Service is intended for users aged 18 and over; we do not knowingly collect information about minors. If you learn that a minor has given us information, contact us and we will delete it.
10. Changes
We will update this policy as needed and announce material changes in the Service or by email. The date at the top shows the latest update.
11. Contact
Kadurim · Email: [email protected]