Privacy Policy
Or Zarua is published by Yanshuf Studio, which is the controller of the personal data described here, meaning the one responsible for it. Contact: hello@yanshufstudio.com, or by post: PO box 1214, Rehovot 7611102. This page lists what the app stores, what it sends, to whom, and why.
No law requires you to give us any personal data. The calendar, zmanim, remembrances and notifications all work without an account. Giving your email address is your choice. Without it, you cannot buy Premium or use sync and display mode.
Data We Collect
- Email address — only if you sign in. We use it to sign you in, to link a Premium purchase to your account, and to reply if you write to us. We do not send marketing email. Supabase stores the address; Resend delivers the sign-in email.
- Remembrance data (names, dates) — stored locally on your device. If you enable sync, data is AES-GCM encrypted in your browser before upload. The server never sees plaintext.
- Location — the place you choose. It is saved in this browser. To show Shabbat times, the app sends the place's coordinates and time zone, or its GeoNames ID, to Hebcal.com. City search runs on your device, over a list of places built into the app (GeoNames data): what you type is not sent anywhere. The app never uses your device's GPS. Zmanim are calculated on your device.
- Sign-in security check — when you ask for a sign-in code, Cloudflare Turnstile checks that the request comes from a person. Cloudflare receives your IP address and information about your browser. Cloudflare also uses this data, under its own policy, to improve its bot detection.
- Purchases — if you buy Premium on the web, RevenueCat records the purchase under your account ID, and Paddle runs the checkout and takes the payment. Your card details go to Paddle, not to us.
- In the Android app — each time the app opens, it asks RevenueCat whether Premium was bought. RevenueCat receives an anonymous app ID, your IP address and basic device information (such as the phone model, Android version and language), and your account ID once you sign in. Purchases there go through Google Play.
Data We Do Not Collect
- No analytics of our own: we do not measure how you use the app. RevenueCat's library, which runs on the web once you are signed in, logs its own technical events — when it starts and during a purchase — with your account ID and information about your browser.
- No cross-app tracking or advertising identifiers.
- No advertising SDKs.
- No data brokers. The only third-party code in the web app is for sign-in and purchases: Cloudflare Turnstile, a security check that runs when you ask for a sign-in code; RevenueCat's library, which checks Premium after you sign in; and Paddle's checkout, which loads when you buy (with a font from Google Fonts).
Encryption
Sync data is encrypted with AES-GCM before leaving your device. A 256-bit key is derived from your passphrase using PBKDF2-SHA256 (600,000 iterations). The passphrase is never transmitted or stored on the server.
What runs on your device
Date conversion, the calendar, holidays, zmanim and remembrance dates are calculated on your device with @hebcal/core, and work without a connection. Shabbat candle-lighting and Havdalah times, and the daily learning (Daf Yomi, Mishna Yomi), come from Hebcal.com, so they need a connection. The last times fetched are kept for when you are offline. For a place in Israel set to the Diaspora schedule, Shabbat times are calculated on your device.
Storage on your device
Or Zarua does not use cookies of its own. To work offline and remember your choices, the app keeps your settings, remembrances, the last Shabbat times and daily learning it fetched and its own files in your browser's storage (local storage, a browser database and an app cache). This storage stays on your device, we do not use it to track you, and you can clear it in your browser. Cloudflare Turnstile (when you ask for a sign-in code) and Paddle's checkout (when you buy) also run in your browser, and they may use their own cookies or browser storage under their own policies.
Hebcal.com
For Shabbat times the app sends Hebcal.com the place (coordinates and time zone, or a GeoNames ID), the dates it needs and the app's language. For the daily learning it sends only the date and the language. Remembrances — names and dates — are never sent to Hebcal; they are calculated on your device. Hebcal.com also sees your IP address, like any website, and keeps it in its logs under its own policy.
Services we use
- Vercel hosts the app. Like any web host, it receives your IP address and browser details when the app loads, and keeps technical logs for a limited time under its own terms.
- Hebcal.com: Shabbat times and the daily learning (see above).
- Supabase: sign-in, your email address, your Premium status, and encrypted sync data.
- Resend: delivers the sign-in email.
- Cloudflare Turnstile: the security check when you ask for a sign-in code.
- RevenueCat: records and checks Premium purchases.
- Paddle: the web checkout and payment.
- Google Play: purchases in the Android app.
- Google Fonts: a font used by the checkout page. Google receives your IP address when that page opens.
Supabase, Resend, Vercel and RevenueCat provide their services to us and handle data on our behalf. Paddle (web purchases), Google Play (Android purchases) and Hebcal.com handle data under their own privacy policies. Cloudflare runs the Turnstile check for us and, under its own policy, also uses the data to improve its bot detection. We do not sell personal data.
Where data is kept
Supabase keeps account data and encrypted sync data in the European Union (Ireland). Resend, Vercel, RevenueCat and Cloudflare process data mainly in the United States; for them we rely on the data-processing terms they offer, which include the EU Standard Contractual Clauses. We operate from Israel, and the EU and the UK recognise Israel as providing an adequate level of data protection. You can ask us for a copy of the safeguards we rely on by writing to hello@yanshufstudio.com.
Legal bases (EU and UK): we use your email, account and purchase data to provide the service you asked for (contract). Turnstile checks, hosting logs, Premium checks by RevenueCat and requests to Hebcal.com rely on our legitimate interest in running a secure, working app.
How long we keep data
We keep your account data (email, account ID, Premium status) and encrypted synced data until you delete your account. After a deletion request we delete it within 30 days; our database provider's backups may hold a copy for a short time after that, until they expire. Card and billing details stay with Paddle or Google, not with us.
Your rights, deleting your data, and complaints
Under Israel's Privacy Protection Law, you have the right to see the personal data we hold about you (section 13) and to ask us to correct or delete data that is wrong, incomplete, unclear or out of date (section 14). If you are in the EU or UK, you can also ask us to erase your data, to restrict or object to its use, and to receive a portable copy. If we ever rely on your consent, you can withdraw it at any time. To do any of this, email hello@yanshufstudio.com, ideally from the address you signed in with. We reply within 30 days. Remembrances are encrypted before they leave your device, so a copy from us contains the encrypted data, not its contents. We do not make automated decisions about you that have legal or similarly significant effects, and we do not profile you.
Deleting your account: email us from the address you signed in with. We delete your account and synced data within 30 days and confirm by email. You can use Or Zarua without an account; remembrances saved in this browser can be deleted in the app, or by clearing this site's data in your browser.
If you are unhappy with how we handle your data, please tell us first at hello@yanshufstudio.com. We will confirm within 30 days that we received your complaint, and tell you the outcome as soon as we can. You can also complain to Israel's Privacy Protection Authority or, in the EU or UK, to your local data protection authority.
Notifications
Notifications are scheduled locally by your device's operating system. No push server is used. Notification data never leaves your device.
Or Zarua is not aimed at children. You need to be at least 16 to create an account or buy Premium. If we learn that an account belongs to someone under 16, we will delete it. We will update this page when the way the app handles data changes, and change the date below.
Last updated: 21 October 2026