Cookies and device storage
1. The short version
- The website sets no cookies of its own. The app uses no web cookies.
- The website saves your colour theme, only if you choose one. While a tab is open, it also remembers your place on the home page.
- Cloudflare, our website host, sets a security cookie only if it needs to check a visit.
- The app keeps your family's learning, settings and any sign-in on your device, and RevenueCat's code keeps a purchase identifier to check whether you have a subscription.
- Nothing here is used for advertising, social media, analytics tools that record what you do, or tracking across other sites or apps.
- Every item is strictly necessary for something you asked for, or saves your choice, so there is no cookie banner. If that changes, we will ask you first wherever the law requires it.
- You can remove every item and object at any time, free of charge (section 7).
This page lists everything the OrQuest website (orquestapp.com) and the OrQuest app save on your device or read from it, why, for how long, and how to remove it. OrQuest is run by Yaniv Cohen, an individual in Israel registered as an עוסק פטור (exempt dealer) ("we", "us", "our"). The Privacy Policy explains what we do with personal information.
2. Cookies
The website's own code sets and reads no cookies, and it loads nothing from other websites. Only Cloudflare's security cookies in section 3 can appear. The app has no web browser of its own and uses no web cookies. The web pages it opens are shown by your phone's browser (section 8).
3. On the website
| Name | Type | When it is set | Purpose | How long it stays | Whose |
|---|---|---|---|---|---|
| oq.theme | Local storage in your browser | Only when you press the colour theme button | Remembers "light" or "dark", so every page uses your choice | Until you clear this site's data | OrQuest. Never sent anywhere. |
| oq.y | Session storage in one browser tab | When you leave or reload the home page | Remembers your place on the home page for a reload or Back. It holds one number. | Until the home page reads it again in that tab, or the tab closes | OrQuest. Never sent anywhere. |
| cf_clearance | Cookie, set by Cloudflare | Only if Cloudflare checks a visit and the check is passed | Shows the check was passed, so it is not repeated on every page | Short-lived. Cloudflare's default is 30 minutes. | Cloudflare, Inc., our website host |
| cf_chl_rc_i, cf_chl_rc_ni, cf_chl_rc_m | Cookies, set by Cloudflare | Only during a Cloudflare security check | Let Cloudflare find faults in the check | Set by Cloudflare for the check, as Cloudflare's cookie list describes | Cloudflare, Inc. |
| __cf_bm | Cookie, set by Cloudflare | Only if Cloudflare's bot protection is on. We keep it off, so this cookie is not set. | Tells people apart from automated bots | Ends after 30 minutes without activity | Cloudflare, Inc. |
| Name | Why no separate consent is needed | How to remove it |
|---|---|---|
| oq.theme | It saves a choice you made and is used for nothing else. You can remove it or object at any time, free of charge (section 7). | Clear this site's data in your browser's settings. If you never press the theme button, it is never set. |
| oq.y | Strictly necessary for the home page you asked for to work as designed | Close the tab, or clear this site's data |
| Cloudflare cookies | Strictly necessary to keep the website secure and available | Delete orquestapp.com's cookies in your browser. They also end on their own. |
The waitlist form needs JavaScript and sends your email address from this page to this site, which sets no cookie in reply. The form keeps nothing in your browser.
4. In the app
| Name | What it holds | When it is set | Purpose | How long it stays | Whose |
|---|---|---|---|---|---|
| orquest.native.v1 | Everything the app remembers on this device: profiles, settings, progress, saved items, this week's board (the live board or the simulated board), friends' league names and your nicknames for them, when you joined the live board on this device, your age group, the versions of the Terms of Use you accepted and of the Privacy Policy shown to you, with when, where, in which language and in which version of the app, your subscription status, the Purchase summary (plan, the price the store showed, dates and document versions), a purchase you started that the store has not confirmed yet, the one-time offer's timing, reminder ids, whether you closed the renewal banner, small notes such as when the app last showed a subscription screen or asked for a store rating, whether its tour is done and whether the parent question is paused after wrong answers, and, if you sign in, the account's email address and user id | When you first open the app, then as you use it | Runs the app | Until Delete everything (except the items below) or uninstall | OrQuest. Stays on the device; the Privacy Policy explains what an account copies. |
| orquest.auth | Your sign-in session from Supabase, which runs OrQuest accounts: the account's email address and the tokens that keep you signed in. When a sign-in starts, further keys whose names begin with orquest.auth (such as orquest.auth-code-verifier) also hold a one-time verification value (a code verifier), which lets only this device complete a sign-in in the browser. These values are stored encrypted. The key that opens them, orquest.auth.key, is kept in the phone's secure storage (the Keychain on iPhone and iPad; on Android, protected by the Keystore) and is made for this device only: it is never synced or moved to another device. | Only when you sign in, or ask for an email code to sign in (accounts are for adults) | Keeps you signed in, and lets only this device complete a browser sign-in it started | Until you sign out, use Delete account or Delete everything, or uninstall. Each verification value goes as soon as its browser sign-in completes; otherwise, as after you ask for an email code, it can stay until one of those steps. If you sign out with no connection after the session has expired, the session goes the next time the app opens with a connection. If the account is deleted other than from this device (for example on another device), we end its sessions, or the session ends after 90 days without being renewed, the app signs itself out and the session goes the next time it renews the sign-in, which it does with a connection at least once an hour while it runs. The key goes at the same steps. On iPhone and iPad, the Keychain keeps it after you uninstall; it holds nothing about you, and the app deletes it the next time it is installed and opened. | OrQuest, through Supabase's code in the app, with the key in the phone's Keychain or Keystore. |
| avatars folder | A 256 by 256 pixel copy of each profile photo you choose | When you choose a profile photo | Shows the picture | Until you remove the photo or profile, use Delete everything, or uninstall | OrQuest. Never uploaded. |
| Temporary files | The last share card you made, the image cache, and working copies the photo picker and image tools make while you use a photo | When you share or choose a photo, and when the app shows pictures | Sharing, preparing and showing pictures | The card until your next share or Delete everything. A photo's working copies are deleted when you are done with it: for a profile photo, when the pick ends; for a card's background photo, when the preview closes or you choose another. The image cache, and any working copy left behind, until Delete everything, the phone clears its cache, or you uninstall. | OrQuest. Never uploaded. |
| RevenueCat storage | A purchase identifier (a random code RevenueCat creates, or your account's user id once you sign in), your subscription status and the plans on offer. After a free trial or a subscription starts, it also holds that purchase's acceptance record (the versions of the Terms of Use and the Privacy Policy shown, the time, the screen, the language and the app's version) and, later, when its Purchase summary was first shown. On iPhone and iPad, it also reads Apple's identifier for vendor (a code Apple gives OrQuest on your device) and sends it with each check. | Each time the app starts | Checks your subscription, free trial and the one-time offer with Apple or Google, and restores purchases | Until you sign out or delete the account, or the app signs itself out as the orquest.auth row explains (a new random code then starts), or uninstall | RevenueCat, Inc., which runs subscriptions for us |
| Google Block Store (Android) | RevenueCat's random code | Only if you have a purchase, including a free trial, while not signed in | Finds your purchase again after a reinstall, or on a new phone restored from your backup | Until you sign in to an account. While Google backup is on, it stays after you uninstall. | RevenueCat's code; kept by Google Play services and your Google backup |
| Scheduled reminders | The time and text of each reminder: daily learning, before a free trial ends, before a yearly subscription renews, and once a year on a monthly subscription | Only after you allow notifications: when you turn daily reminders on, when a free trial starts or is restored or you sign in during one, and while you have a subscription that renews | Shows reminders on time. OrQuest sends no push messages. | Until the reminder shows or is cancelled | Your phone's system (on Android, the app's notification code keeps a copy so reminders survive a restart) |
| Name | Why no separate consent is needed | How to remove it |
|---|---|---|
| orquest.native.v1 | Strictly necessary for the app you asked for | Delete everything in Settings; remove one profile in Family; or uninstall |
| orquest.auth | Strictly necessary for the account you asked for | Sign out, Delete account or Delete everything in Settings; or uninstall (on iPhone and iPad, the key then stays in the Keychain until the app is next installed and opened) |
| avatars folder | Requested by you | Remove the photo or the profile; Delete everything; or uninstall. On iPhone and iPad, also delete older backups that hold it. |
| Temporary files | Strictly necessary for showing pictures in the app, and for the sharing and photos you asked for | Delete everything in Settings; or uninstall. On Android, you can also clear the app's cache in the phone's settings. |
| RevenueCat storage | Strictly necessary for the app you asked for, which needs a subscription after the free week: it lets OrQuest know whether you have one | Uninstall. Signing out replaces the code with a new one. |
| Google Block Store (Android) | Strictly necessary to keep a purchase you made working | Sign in to an account, or turn off Google backup on your phone and uninstall |
| Scheduled reminders | Requested by you, and your phone asks your permission first | Turn off OrQuest's notifications in your phone's settings; turn daily reminders off in OrQuest's Settings; or uninstall |
What Delete everything keeps
Delete everything clears this device's profiles, progress and settings, signs you out on this device and cancels the daily reminders. By design, it keeps three small items in orquest.native.v1:
- The one-time offer's timing, if it was shown to you: its start, its end, whether the end moved off Shabbat or Yom Tov, and whether the app has already recorded that it ended. The offer is made once on each installation of the app; this stops deleting data from starting it again. It is used for nothing else.
- The pending reminders before a free trial ends or a yearly subscription renews (including the one set a year ahead), a monthly subscription's yearly reminder, and their ids, so they still come while the subscription goes on.
- A note that a subscription is still active, only if you were signed in with one, so the app does not offer you what you already pay for. It grants no access.
It also deletes at once every profile photo, the last share card, the working copies of the photo picker and image tools, the image cache and every key whose name begins with orquest.auth. It leaves RevenueCat's storage (if you were signed in, its code is replaced with a new random one, as at sign-out), and your own backups. It does not delete an account or cancel a subscription (to cancel, see Cancel a subscription). Uninstalling removes everything the app keeps on the device, except the Block Store item while Google backup is on, on iPhone and iPad the key of orquest.auth in the Keychain (it holds nothing about you; see the table), and your own backups.
Backups
- iPhone and iPad: orquest.native.v1 and orquest.auth are left out of iCloud and computer backups, and the key of orquest.auth is never synced through iCloud Keychain or restored onto another device. Profile photos and RevenueCat's storage can be included in your own backup.
- Android: OrQuest turns off Android's app backup, and tells Android to leave all of the app's data out of cloud backups and out of a cable or wireless transfer to a new phone. The Google Block Store item above is kept by Google Play services, not by the app's backup.
5. What we do not use
- No analytics tools that record how you use the website or the app. RevenueCat's purchase records give us subscription statistics (see the Privacy Policy).
- No advertising, and no advertising identifier from your phone.
- No social-media tools.
- No tracking across other websites or apps, by us or by anyone through us.
Because there is nothing to switch off, the website and the app do not change what they do when your browser or phone sends a Do Not Track or Global Privacy Control signal.
6. Why there is no cookie banner
Israel has no law specifically on cookies or device storage. Israel's Protection of Privacy Law, 5741-1981, applies to personal information, including a code kept on your device that can be linked to you, and the Privacy Policy explains how we handle it.
Some privacy laws require consent before information is stored on a device or read from it, but not for storage strictly necessary for a service you asked for, or for storage that saves a choice you made about how the service looks, when you are told about it and can object free of charge. Every item on this page falls within those cases, and this page tells you about each one and how to remove it or object (section 7), so there is no consent banner and no "manage preferences" screen.
If we ever want storage that needs your consent, we will ask you first, before it is set, wherever the law requires it, and update this page beforehand.
7. How to remove storage or object
- Website: in your browser's settings, clear the site data and cookies for orquestapp.com. A private window keeps nothing after you close it.
- App: use the controls in section 4. If there is a child profile on the device, the parent question comes first for Delete everything and for removing a profile.
- Objecting: wherever you live, you can object to any item at any time, free of charge. Remove it as above, or write to support@orquestapp.com and we will help you remove it and answer your objection.
Your rights over personal information, including the right to see it and to ask for it to be corrected, and how to complain to Israel's Privacy Protection Authority or another privacy regulator, are in the Privacy Policy.
8. Other web pages
The app opens some web pages in your phone's browser, sometimes in a browser window shown inside the app: our legal pages (apart from the Accessibility statement, Credits and licences, Contact and business details and the Purchase summary, which are screens of the app itself), the pages those screens link to (pages of orquestapp.com, and other websites such as Wikisource, Sefaria, Creative Commons, Hebcal and Apple's support pages), a sign-in page (Sign in with Apple on Android, or Google sign-in, if we offer them), the siddur sources' websites, and the App Store or Google Play. On iPhone and iPad, the sign-in window keeps no cookies after it closes and shares none with Safari. The website also links to other websites. Other websites' cookies are their own, and OrQuest's code does not read them.
9. Changes to this page
Before we add, remove or change an item, we update this page with a new version number and effective date. Earlier versions are at Past versions.
This page is also published in Hebrew: עוגיות ואחסון במכשיר. Both versions are official. If they differ, the version more favourable to you applies.
10. Contact
Questions: support@orquestapp.com, or +972 52 386 4584 (Sat, 1:00-1:00). Full details: Contact and business details.