Privacy Policy: Siddur Or Zarua

Siddur Or Zarua (“the app”, “we”, “us”) is a Traditional-Egalitarian siddur (prayer book) app. This policy explains what information the app handles, why, and what choices you have.

The short version: the app works fully offline, with no account, for reading and reciting prayers, checking the Hebrew calendar, and working out prayer times for your location. Nothing about your location, your reading preferences, or your use of the siddur is sent anywhere unless you choose to create an account to sync your yahrzeits (memorial dates) and settings across your devices, or to receive yahrzeit reminder notifications, or to join a congregation, or you open the Torah trope features, which check your subscription with the App Store or Google Play and with RevenueCat, the service we use to keep track of subscriptions.

Using the app without an account

You do not need an account to use the app. Without signing in:

The prayer texts, calendar data, and Hebrew-date calculations are built into the app and worked out entirely on your own device. No network request is made to read or recite anything, look up a Hebrew date, or check today’s calendar.
Your location, used only to calculate prayer and candle-lighting times (zmanim) and your Torah-reading schedule, is read from your device’s GPS (or entered manually) and stored only on your device. It is never transmitted to us or to any server.
Your reading preferences (translation/transliteration display, text size, colour theme, parshah schedule) are stored only on your device.
Your yahrzeits (memorial dates you add for loved ones — a name, a Hebrew date, and optional notes) are stored only on your device.
On native (iOS/Android) builds, reminder notifications are scheduled entirely on your device, using your phone’s own reminder system. That covers all five kinds the app can send: yahrzeits, the nightly Omer count, Shabbat candle lighting, the eve of a festival, and the Shabbat on which the new month is blessed. No data leaves your device for any of them.

Creating an account

If you choose to sign in (to sync your yahrzeits and preferences across devices, to join a congregation, or to receive reminder notifications on the web version), the app asks for your email address and sends you a sign-in link. We use your email address to send that link and, if you create shared booklets, to email you a week before one is removed. We do not use it for marketing, and we share it only with a congregation you join or ask to join (see “Communities” below).

The sign-in link can only be used once, and it expires after 15 minutes.
Once you follow it, you’ll stay signed in on that device for about 90 days, after which you’ll need to sign in again.
The first time you sign in, an account is created for you automatically, linked to your email address.

We do not use passwords, and we do not offer or require sign-in via Google, Apple, Facebook, or any other third-party identity provider — there is nothing to connect to an external account.

What syncs to our server once you’re signed in

Once signed in, five kinds of information are copied from your device to our server (and back, when you use a second device) so they stay in sync:

Your yahrzeits — the name, Hebrew date, and any notes you’ve entered for each one, plus the halachic observance choices you’ve set for it.
Your reading preferences — the same settings listed above.
Permission to send you reminder notifications — if you turn this on in the web version of the app, your browser gives us what it needs to deliver a notification to you. This is not needed, and is not collected, on native builds, which schedule reminders directly on your device instead.
Your Omer count: which days you have marked as counted, so the count follows you between your own devices.
Your device’s timezone: if, and only if, you turn on reminder notifications in the web version, your browser’s timezone name (for example Australia/Brisbane) is stored next to the notification permission in point 3. We need it because a reminder about a Hebrew date is only meaningful in your own day: without it, a notice timed to suit one part of the world arrives in the small hours, or after the day it is about has already ended, somewhere else. A timezone name is not your location and is far coarser than it, but it does narrow down the part of the world you are in, so we store it only for devices you have switched web notifications on for, we use it for nothing but choosing the hour to send at, and it is deleted with everything else when you delete your account. It is not needed, and is not collected, on native builds, which schedule reminders on your device using your device’s own clock.

Your location is never part of this sync. It has no counterpart on our server anywhere — it is worked out and stored purely on your device, whether or not you’re signed in.

Shared booklets

A booklet you create stores what you type for it (the person’s names, the dates, your choices and notes) and, if you add one, a photo. We use them only to show the booklet, make its PDFs and name it in the reminder we email you.

Anyone with the booklet’s link can see it, without signing in. The link cannot be guessed, but it can be passed on.

A booklet is removed 60 days after the funeral or azkarah, unless you extend it. We email you a week before.

You can delete a booklet at any time, and deleting your account deletes all of them. Either way its record, photo and PDFs are deleted. We collect no analytics on what booklets contain.

Communities

If you are signed in, you can join a congregation that uses Or Zarua, or ask to join it. The app sends the congregations service the first and last name you give and, if you write one, your note for the congregation's office, and the congregation receives your account's email address. If its records already hold that email, your account is linked to that record straight away; otherwise your request waits for the office to approve it. An invitation from the congregation links your account to the record it already keeps for you. The congregation's staff see your record, and your request, on the congregations platform, each only as far as their role allows.

In My details you can keep your Hebrew name, email, phone and postal address on the congregation's record, and choose the ways it may reach you. The app also sends your RSVPs to its events, and the yahrzeits you choose to share: each one's name, Hebrew date and how it is kept, never your notes. The yahrzeits the congregation keeps for you are shown to you in the app, and you can add them to your own.

A congregation's messages to its members reach you in the app's inbox. If the congregation uses them, and you have not turned them off in My details, it can also send them by email or text message to the details on your record, and by WhatsApp only once you have agreed to it. The congregations service keeps a record of each delivery (sent, delivered or bounced) for 180 days.

If you turn on a congregation's notices, the app registers this phone's notification token (the address Apple's or Google's push service gives the app on this phone), its platform and language with the congregations service, which keeps them to send you notices. Apple (on iPhone) or Google (on Android) delivers each notice to the phone, and receives its title and first line. Signing out removes this phone's token from the service.

If you buy tickets for a congregation's event in the app, Stripe processes the payment on behalf of the congregation, which is the seller: the payment goes to the congregation's own Stripe account, connected to Or Zarua through Stripe Connect. Your card details, or your Apple Pay or Google Pay details, go to Stripe through its own payment sheet and never reach Or Zarua. Stripe receives them with the amount and what it is for, may process them outside Australia, including in the United States, and handles them under its own privacy policy, at stripe.com/privacy. The congregations service keeps the order (the event, the tickets, how much you paid and when) against your account, where the congregation's staff can see it, for five years after the event, as Australian tax law requires. The app keeps your tickets on this phone, so their QR codes show without a connection, until you sign out.

These are held on Amazon Web Services in Sydney, Australia, for the congregation, which is responsible for its members' records. The platform's own policy, at orzarua.net/privacy, explains how long each is kept. On this phone, the app keeps a copy of what it last showed you from a congregation (your details, its calendar, your tickets) until you sign out.

Stop sharing a yahrzeit and the congregation's copy is deleted. Leave a congregation and every yahrzeit you shared with it is deleted, and a request still waiting is withdrawn; your record stays with the congregation, marked as resigned and no longer linked to your account (ask the congregation if you want it removed). Deleting your account does both for every congregation and removes your notification tokens. You can download what the congregations service holds about you, as a file, with Download my data in My details.

The Torah Trope subscription

Torah Trope is an optional subscription that unlocks the trope trainer in the Torah reader. It is bought and managed through the App Store or Google Play, which take the payment: neither the app nor we ever see your card or payment details.

Nothing about it leaves your phone until you open a trope feature, the subscription screen, or Restore Purchases or Manage subscription in Settings. Reading the Torah and using the siddur never contact RevenueCat or the store for it, with one exception: if you have subscribed and the period the app last checked has ended, the app checks with the store each time you open the Torah reading or Settings, until it confirms a current period.

From then on, the app checks your subscription with the store and with RevenueCat, the service we use to keep track of subscriptions. RevenueCat receives an anonymous subscriber number it creates (not your name or your email address); the store's record of your subscription (the product, the transaction or purchase number, the dates, the price and currency, and the store's country); and the app's version, your phone's model, platform and system version, its language and region and, as with any internet request, its IP address.

On iPhone, RevenueCat also receives the identifier Apple gives each app maker for your phone (the "identifier for vendor": it is not an advertising identifier, and apps from other developers see a different one), and the App Store's record of your purchase of the app itself. It also receives a setting that says the app has not asked to track you (Apple's tracking permission, which reads "denied" because the app never asks): RevenueCat's SDK sends it on its own, and it is not an identifier. On Android, RevenueCat receives no device identifier.

RevenueCat, Inc. is in the United States and acts as our service provider; its privacy policy is at revenuecat.com/privacy. Your subscription record is therefore processed outside Australia. It is not linked to the app's optional account.

On your phone, the app keeps only the subscription's status and end date, so the trope trainer works offline.

RevenueCat keeps the record while the subscription's history is needed for billing and tax. To have it deleted, email us the Subscription ID shown in Settings under Torah Trope, and we will delete it from RevenueCat.

We look at RevenueCat's totals of subscriptions and revenue. That is the only analysis of purchases we do, and it is never used for advertising.

Where this data is stored and processed

Your account details, yahrzeits, preferences, notification permissions, the timezone stored with those permissions, and your shared booklets with their photos and PDFs are held in a database and file storage that we operate on Amazon Web Services (AWS). AWS is our infrastructure provider — it does not use your data for its own purposes.
Sign-in emails, and the reminder sent before a shared booklet is removed, are sent using an email-sending service, also run on Amazon Web Services, addressed only to the email you provided.
If you enable reminder notifications on the web version, the notification is passed to you through the notification service run by your browser or phone maker (for example Apple, Google, or Mozilla) — this is a standard part of how web notifications work, and is provided by your browser/OS maker, not chosen by us. The notification’s contents are encrypted so that only your device can read them; the service in between only sees enough to route it to your browser.
If you join a congregation, what the app sends it is held on Amazon Web Services in Sydney, Australia, for that congregation. Its notices reach your phone through Apple or Google, its emails and text messages are sent from Amazon Web Services, its WhatsApp messages are delivered by Meta, and Stripe processes ticket payments: see “Communities” above.
If you open the Torah trope features, your subscription record is held by RevenueCat in the United States, as described under “The Torah Trope subscription” above.

We do not use advertising or tracking of any kind. The only analytics are the subscription totals described above, and the figures Stripe's payment sheet keeps about itself when you buy tickets. We do not embed third-party trackers, and there are no advertising identifiers or tracking tools in the app. We do not sell, rent, or otherwise share your data with third parties for marketing or advertising purposes.

Retention and deletion

Deleting your account, available from within the app, permanently removes your account, all synced yahrzeits, your synced preferences, your synced Omer count, your shared booklets with their photos and PDFs, and any reminder-notification permissions (including the timezone stored with them) from our server, as well as the record linking your email address to your account. This cannot be undone.
Our database keeps automatic backups for 35 days. Anything deleted from it, from your account or from a booklet, can stay in those backups for up to 35 days before it is gone for good. A booklet’s photo and PDFs are not part of these backups.
Deleting local data: because most of the app’s data lives only on your device, you can remove it at any time by uninstalling the app (on iOS/Android) or clearing this site’s data in your browser (on the web version/PWA).
If you sign out without deleting your account, your synced data remains on our server so it’s there if you sign in again; deleting the account is how you ask us to remove it for good.
Stopping sharing a yahrzeit, leaving a congregation and deleting your account each delete what you shared, as “Communities” above describes. A ticket order is kept for five years after the event, as Australian tax law requires; the platform's own policy at orzarua.net/privacy says how long a congregation's other records are kept.
A sign-in link is deleted the moment it’s used, or after 15 minutes.
Deleting your account or the app does not delete RevenueCat's subscription record, because it is not linked to either: email us the Subscription ID shown in Settings under Torah Trope, and we will delete it from RevenueCat.

Children’s privacy

The app is not directed at children and we do not knowingly collect personal information from children.

Security

The connection between the app and our server is always encrypted.
Sign-in links are single-use and expire quickly, and once you’re signed in, that sign-in itself is time-limited too.
Reminder notifications sent to the web version are encrypted so that only your device can read them.
A congregation's staff see only what their role allows, and only for their own congregation.

Your choices

You can use the entire prayer, calendar, and zmanim experience without an account.
You can grant or deny location access at any OS level at any time; denying it simply means zmanim aren’t calculated.
You can turn reminder notifications on or off at any time from the app. Turning them off in the web version is also how you stop us holding your timezone.
You can delete your account at any time from within the app.
Joining a congregation is optional. In My details you can turn off each way a congregation reaches you, and you can stop sharing a yahrzeit, turn off its notices or leave the congregation at any time.
Torah Trope is optional: if you never open a trope feature, nothing about it is sent to RevenueCat or checked with the store.

The contact form on our website

If you write to us through the contact form on our website, your name, email address and message are sent to us by email and are not stored. To limit repeated sending, a one-way hash of your IP address is kept for one hour, then deleted.

This website

The site remembers whether you chose the light or the dark look: one cookie, oz-theme, on orzarua.net and its subdomains, holding only “light” or “dark”, kept for a year, and the same choice in your browser's storage. It identifies no one and is not used for anything else.

Changes to this policy

If we change what the app collects or how we handle it, we’ll update this page and its “last updated” date. If a change is significant, we’ll make a reasonable effort to bring it to your attention within the app.

Contact

Questions about this policy, or about your data, can be sent to or-zarua@danielpedroso.com.