Privacy Policy

Who we are

Furball Outdoor (outdoor.furball.fit) is a free, bilingual trail-route database for Israel, covering trail running, hiking and mountain biking. The site is owned and operated by Oren Rosenzweig, who is the data controller. You can reach us at orenr@getcobalt.ai.

The short version

You can use the whole site anonymously. We do not run analytics, advertising or third-party trackers, we do not build user profiles, and we do not sell or share your data for marketing. We store personal data only if you choose to turn on cross-device favourites, and only the minimum needed to make that work.

What we store on your device

By default everything stays in your browser using localStorage. We keep:

• Your language choice (Hebrew or English).
• A location you type in, or your device location if you allow it, used only to sort routes by distance from you.
• Your list of favourite routes, and a sync code if you create one.

This data stays on your device and is not sent to us unless you turn on sync (below). You can clear it any time by clearing your browser storage for this site.

Optional cross-device sync

If you want your favourites on more than one device, you can turn on sync in one of two ways:

• Sync code: we generate a random 26-character code. It contains no personal data. Anyone who has the code can read and edit that favourites list, so keep it private.
• Google Sign-In: if you sign in with Google, Google shares your name, email address, profile picture and a Google account identifier with us. We convert that identifier into a one-way hashed key on our server and use only that hashed key to store your favourites: the raw identifier is never used as your key, never written to our favourites storage, and never shared with anyone. The raw identifier is included, in signed form, only inside the session cookie stored on your own device.

Your synced favourites are held in a private storage bucket (Vercel Blob), keyed by your sync code or your hashed key. Only someone with your code, or signed into your Google account, can reach them.

Cookies

We use two cookies, both strictly for the sign-in feature. We do not use any advertising, analytics or tracking cookies.

• fb_session: set only after you sign in. It keeps you signed in and holds a signed (not encrypted) record of your name, email, profile picture, a Google account identifier and your favourites key, together with the time you signed in. It is HttpOnly and Secure, limited to our site (SameSite=Lax), and lasts up to 30 days.
• fb_nonce: a short-lived, one-time security value used to protect the sign-in step against forgery. Because Google posts the sign-in back to us across sites, this cookie is set with SameSite=None and Secure. It lasts about 30 minutes and is used once.

If you use Google Sign-In, Google may also set its own cookies on its own domains, under its own privacy policy.

Why we process this data and our legal basis

We process data to provide the features you ask for and for no other purpose.

• Anonymous on-device storage (language, location, favourites) supports basic functionality. Where this is personal data under the GDPR, our basis is your consent (for example, when you allow location access) and our legitimate interest in making the site work.
• Google Sign-In and the profile data it provides are processed on the basis of your consent, given when you choose to sign in. You can withdraw it at any time by signing out and disconnecting sync.
• The session and nonce cookies are necessary to deliver the sign-in feature you requested and to keep it secure.

We do not use your data for profiling or automated decision-making, and we do not build advertising or analytics profiles.

Under the Israeli Privacy Protection Law, you provide this information voluntarily, you are not legally required to, and you may ask to review, correct or delete it.

Data sources and external services

The site loads some resources from other providers. When your browser fetches them it necessarily reveals your IP address and standard request details to those providers, as with any website. We do not use these requests to profile or track you.

• Vercel: hosting and the private storage used for synced favourites.
• Google: the Sign-In service and profile pictures, only if you choose to sign in. Google processes your data under its own privacy policy.
• Google Fonts: fonts used across the site load from Google servers.
• Map library and map tiles: on route pages the map uses the Leaflet library (from unpkg) and map tiles from the Israel Hiking Map (israelhiking.osm.org.il).
• Underlying data: route geometry comes from OpenStreetMap (ODbL licence) and elevation comes from the Israel Hiking digital elevation model, pre-computed into static files with no live calls. Sources are credited in the site footer.
• Our own server: when you use sign-in or cross-device sync, our API briefly processes your IP address in memory only, to rate-limit abuse. We do not store it. Vercel, as our hosting provider, may log standard request metadata including your IP address on our behalf.

Retention

• On-device data (localStorage) stays until you clear your browser data for this site.
• Synced favourites stay in our private storage until you delete them or ask us to remove them. There is no automatic expiry, so they remain available across your devices. We keep only the few most recent versions of each list.
• The session cookie lasts up to 30 days or until you sign out. The nonce cookie expires within about 30 minutes.

How to stop or delete your data

• Turn off sync or disconnect Google: your favourites stay on your current device but stop syncing.
• Sign out: this clears your session cookie.
• Delete favourites: removing favourites while connected removes them from the synced store.
• Clear browser storage: this removes all on-device data for the site.
• If you want us to help remove synced data tied to a sync code or a Google sign-in, email us at orenr@getcobalt.ai.

Your rights

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to processing, withdraw consent, and receive a copy of your favourites. To exercise any of these, email orenr@getcobalt.ai. If you are in the EU or EEA you may also complain to your local data protection authority. In Israel you may contact the Privacy Protection Authority.

International users

The site is operated from Israel and hosted on Vercel infrastructure, which may store and process data in other countries, including outside Israel and the EU or EEA. Israel holds an EU adequacy decision, and where data is processed elsewhere (for example by Vercel) it is done to provide the service you asked for or with your consent. We only process the limited data described here.

Children

The site is intended for a general audience and is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided personal data through sign-in, contact us and we will remove it.

Changes to this policy

If we change how we handle data, we will update this page and the date above. Continued use after a change means you accept the updated policy.

Contact

Questions or requests about privacy: Oren Rosenzweig, orenr@getcobalt.ai.