Privacy Policy

2. For children

Grown-ups: this part is written for children. You may like to read it together.

• OrQuest keeps what you learn on this phone or tablet. It never sends us your name, your picture, your answers or how you are doing.
• You can't make an account. Accounts are only for grown-ups.
• The other names you see in your league are pretend players. They are not real people, and nobody else can see you there.
• Anyone who uses this phone or tablet, like people in your family, can see each person's name and picture, and how much they learned this week.
• A grown-up can share a card about what you learned. It never shows your name or your picture.
• OrQuest never asks you to pay money. In the shop you can spend only the gems you earn in the app. Some parts are for grown-ups, so the app asks a grown-up question before they open.
• While you learn, the app checks in the background that your family's subscription is working and, if a grown-up has signed in, keeps their account up to date. To do this, it sends a code for this phone or tablet, its internet address and a few facts about it, like its model and language. It never sends your name, your picture or what you learn.
• If anything in the app worries you or feels wrong, tell a grown-up you trust.

3. Who we are, and what this policy covers

OrQuest (אור־קווסט) is run by one person: Yaniv Cohen, an individual resident in Israel, registered with the Israel Tax Authority as an exempt dealer (עוסק פטור) and trading as OrQuest ("we", "us", "our").

• Postal address, including for registered mail: 12 HaShoftim St, Tel Aviv, Israel
• Email, for support, privacy and cancellations: support@orquestapp.com
• Phone: +972 52 386 4584 (Sat, 1:00-1:00)

We decide why and how OrQuest's personal information is used. That makes us the controller (בעל שליטה) of OrQuest's databases under Israel's Protection of Privacy Law, 5741-1981, the "operator" under the US Children's Online Privacy Protection Act (COPPA), and the "controller" under Switzerland's Federal Act on Data Protection. At OrQuest's present size and activities, Israel's Protection of Privacy Law does not require us to appoint a data protection officer, and we have not; if that changes, we will appoint one. Yaniv Cohen is personally responsible for privacy and is also our privacy officer, including under New Zealand's Privacy Act 2020.

OrQuest is offered in the App Store and Google Play in Israel, Switzerland, Australia and New Zealand. If you use it from elsewhere, you keep any rights your local law gives you.

This policy covers the OrQuest app for iPhone, iPad and Android, the website orquestapp.com and its waitlist, and emails, calls and letters between you and us. Services that others run, even when you reach them through OrQuest (the App Store, Google Play, Apple and Google sign-in, device backups, your device's voice, and the websites and apps you open or share to), follow their own privacy policies, for example Apple's and Google's.

This policy is a notice, and you are not asked to agree to it; the agreement between us is the Terms of Use. Where we need your consent for something specific, we ask for it separately, when it matters (sections 4, 9 and 15). Nothing in this policy takes away a right the law gives you. It is also published in Hebrew, at מדיניות הפרטיות. Both versions are official; if they differ, the version more favourable to you applies.

4. Information that can suggest religion or origin

OrQuest is an app for learning Torah and Hebrew. We never ask what you believe. Some opening questions do touch on Jewish life: why you are learning (the choices include family heritage, a bar or bat mitzvah and prayer) and where Hebrew is already part of your week (the choices include services and the siddur, the Shabbat table and the festivals; the Hebrew app asks where Torah and prayer already are). These answers can say something about religion or origin, so they stay on your device and never reach us.

Still, using the app, and the progress saved to an account, can suggest that you study Jewish texts. Israel's Protection of Privacy Law may treat this as "information of special sensitivity" (מידע בעל רגישות מיוחדת), which includes information about a person's religious beliefs, worldview and origin, and some US state laws, Connecticut's among them, also treat information revealing religious beliefs as sensitive data. So we treat it as sensitive. We use it only to run OrQuest and, where we must, to meet a legal duty or deal with a legal claim, never for advertising or profiling. We share it with no one except the service providers in section 17; the league details in section 9, if you choose the live league or friends; and, only as section 17 describes, our lawyer or accountant under confidentiality, a court or authority where the law requires it or for a legal claim, and someone who takes over OrQuest together with all our duties under this policy.

• Explicit consent at sign-in. Beside the sign-in buttons the app says: "Signing in saves your learning progress, including Torah study, to your account, and that can show that you study Jewish texts. You can delete it at any time. By signing in, you consent to this." Pressing a sign-in button next to those words is your explicit consent to saving your progress to an account, and you can withdraw it at any time with Delete account.
• Less leaves the device. An account keeps achievements without their dates, and a day-by-day record of the last 90 days only. Some dates still travel with the account: the day each lesson or story was last finished, when each review is due, and the streak's day records (section 8). The opening answers, every profile's goals and track, the prayer rite (nusach) and pronunciation settings, and everything in a child profile never leave the device.
• Rules the same for everyone. Streaks pause on Saturdays and on the festivals as kept in Israel, the live league does not count XP earned on Saturday (Israel time), and the one-time offer's end moves off Shabbat and Yom Tov. These rules record nothing about you.
• The waitlist can suggest an interest in Jewish learning, so we treat it as sensitive too, and use it only as section 15 says.

5. Your choices, and what happens if you say no

You have no legal duty to give us any information. It is your choice, with these consequences:

• No account: your progress stays on this device only, and you cannot join the live league or add friends. Everything else works the same. If you never sign in, nothing is sent to Supabase.
• No purchase details: OrQuest needs a subscription after the free week, and without the purchase details Apple or Google send, we cannot unlock it.
• No email address: you cannot join the waitlist or sign in with an email code. Sign in with Apple lets you hide your address.
• No notifications: you get no reminder notifications, though the notice in the app before a yearly renewal, and once a year on the monthly plan, still shows, on the Learn screen of an adult profile and in Settings. The lessons work the same.
• No photo: the profile shows a letter mark instead.
• No live league or friends: nothing about you reaches other learners.
• No way to reach you: we cannot reply to your message.

One thing is not optional while you use the app: the subscription check in section 10, because OrQuest cannot otherwise tell whether a subscription is active. To stop it, stop using the app on that device or remove it.

6. What stays on your device

Most of OrQuest works on your device, in the app's own storage. Apart from the copy an account or the live league keeps (sections 8 and 9), and what RevenueCat keeps for us with a purchase (section 10), we never receive the following, and we cannot see, restore or delete it for you.

• Each profile: its name (up to 40 characters, often a child's first name), letter mark and optional photo; whether it is a child profile; its goals (travel, family heritage, a bar or bat mitzvah, prayer or study); its track (Hebrew, Shabbat or Torah), starting level, and any trip destination and date.
• Progress: lessons, stories, scores, XP, gems, hearts and streaks; a day-by-day record of minutes, lessons and XP; the review schedule; achievements with their dates; saved phrases, places and verses; places marked as visited (a tap, never your location); a log of up to 120 recent learning sittings with their times; and the day each lesson or story was first finished on this device or first arrived from the account.
• The opening answers, which shape the plan during setup; only the choices that become profile settings are kept.
• Device settings: language, theme, sound, pronunciation (modern, Sephardi or Ashkenazi), explanation level (child, teen or adult), prayer rite (Ashkenaz, Sefard or Edot HaMizrach), reminder time, and display and practice choices such as vowel marks, transliteration, vibration, reduced motion, the daily goal and the size of the prayer text.
• Other records: the age group (never the year); the version of the Terms of Use you accepted and the version of this policy shown to you, with when, where, in which language and in which version of the app; this week's board; when you joined the live league on this device; friends' league names and your nicknames for them; your subscription status and the Purchase summary; the one-time offer's timing; the reminders set; and the last share card you made.
• If you sign in: the account's email address, account ID and sign-in method, in the app's ordinary storage, and the session (which holds the email address too), stored encrypted, with the key that opens it in the device's secure storage (the Keychain on iPhone and iPad, the Keystore on Android), made for this device only and never synced or moved to another device. A one-time key used to complete a sign-in is kept with the session, encrypted the same way: it goes as soon as a browser sign-in completes; otherwise, as after you ask for an email code, it can stay until you sign out, delete the account or use Delete everything. After you sign out, the adult profile keeps the account ID so that it can link back.

Anyone who uses the device can see it. The Family screen shows every profile's name, photo or letter mark, level, streak and current unit, and this week's days, minutes, lessons and XP. Profiles have no passcode, so use your screen lock and your store's family controls if that matters to your family. The app's storage is protected by the device's own security; OrQuest adds encryption of its own only to the sign-in session (above).

Backups. On iPhone and iPad, the app's main storage and sign-in session are left out of iCloud and computer backups, and the session's key is never synced or moved to another device, but profile photos and RevenueCat's storage (section 10) can be included in your own backups. On Android, OrQuest turns off app backup and tells Android to leave all of the app's data, including the sign-in session, out of cloud backups and out of a transfer to a new phone; RevenueCat's Google Block Store item, where there is one (section 10), is kept by Google separately. We do not back up what is kept only on your device: if the device is lost or reset, or the app is removed, it is gone. Restoring a device backup does not bring back profiles or progress; only the progress saved to an account comes back, when you sign in again. Cookies and device storage lists every stored item.

Never used: your location, microphone, camera or contacts; your device's advertising identifier; advertising, crash-reporting or push notification tools; and analytics tools that record how you use the app (RevenueCat's subscription statistics are in section 10). The app itself contacts no artificial intelligence service (RevenueCat's own sub-processors are listed in section 10).

7. The age question

Before a profile becomes an adult's, OrQuest asks for a year and a month of birth, with nothing filled in and no hint at which answer opens more: during setup, when you answer "I am" to "Who is learning?", and in Family, when an adult profile is added or a profile is changed into an adult's. An adult profile that has no answer yet is asked before Family saves it again as an adult's and before any way to sign in, and is never shown the one-time offer.

• We use the answer only to decide whether the profile is an adult's or a child's, and so whether it may have an account, the live league, friends and the one-time offer.
• Anyone under 18 is treated as a child: the profile is a child profile, with no sign-in, account, live league or friends.
• The app keeps only an age group, only on the device, until the profile is removed, Delete everything or you remove the app. The year and month are not saved, and neither they nor the age group are ever sent to us or anyone else.
• If a year was entered by mistake, an adult can change the profile to an adult's in Family, after the parent question, and give the year and month again there.

Age signals from Apple and Google. Some app store laws ask the stores to share a user's age range, or a parent's approval, with apps. OrQuest does not ask for these signals at present. If a version does, it will use them only to apply age protections and to comply with those laws, keep them only on the device and delete them once the check is done, and this policy will say so first.

8. If you sign in (adults only)

Only an adult (18 or over) can sign in, on an adult profile; on a device with a child profile, the parent question comes first. Each device links one adult profile to the account, never a child profile.

• Sign in with Apple on iPhone and iPad. Apple's own sheet opens, and OrQuest asks Apple only for your email address. If you hide it, we receive a private relay address that forwards to you.
• An 8-digit code by email, from Settings. Typing an address creates a sign-up that waits for its code; if the code is never used, the sign-up is deleted after 7 days.
• In a browser window, if we offer it: Sign in with Apple on Android, and Google sign-in. A provider may send your name or picture, and Google also sends your language setting. Our server deletes any name and picture as it saves the account, and keeps the language setting. A name can appear in technical logs, which expire within 7 days.

Apple and Google run their sign-in services under their own privacy policies. The sign-in screen links to the Terms of Use and this policy, and shows the consent sentence in section 4.

What Supabase keeps for us:

• your email address (or relay address) and whether it is confirmed;
• how you signed in, and the identifier Apple or Google gives OrQuest for you;
• your account ID (a random code), and when the account was created and last signed in;
• a session record for each signed-in device, with its IP address and device type;
• a scrambled (hashed) copy of a one-time code, until it is used or expires;
• technical logs of requests and sign-ins (email address, IP address, device type and time), for 7 days.

Progress saved to the account, only for the one adult profile linked to it, so that it comes back on your other devices:

• lifetime XP;
• the streak: its length, best, last day counted, freezes and the days they covered;
• a day-by-day record of XP, minutes and lessons for the last 90 days;
• lesson and Torah story progress: stars, best score, times completed and the last day finished;
• the review schedule;
• the achievements you earned, without their dates;
• counts of perfect lessons, speaking cards, reviews, letters, phrases and top-three league finishes;
• a revision number, a reset counter and an update time, which the app uses to combine devices.

Never saved to the account:

• any child profile;
• any profile's name, letter mark or photo;
• goals, track, trip and starting level;
• the opening and age answers;
• settings;
• saved and visited items;
• gems and hearts;
• the log of sittings;
• friends' nicknames.

Other learners never see your saved progress.

Acceptance records. When you accept the Terms of Use at sign-in or on the subscription screen, the app records the versions of the Terms of Use and of this policy shown, the time, the screen, the language and the version of the app: on the device; at Supabase with the account, for a record made while you are signed in; and at RevenueCat with the purchase, for a free trial or a subscription you start, signed in or not (section 10). This lets us show what was agreed.

Signing out:

• saves your latest progress to the account;
• takes you out of the live league if you joined it on this device (signing out of a device where you never joined does not take you off a board you joined on another device);
• ends the session (Supabase deletes its session record);
• removes the email address and friends list from the device;
• gives RevenueCat's code a new random ID.

If the app cannot reach our server at that moment, you are still signed out on this device, but your latest progress may not reach the account, and your league name stays on this week's board until the week ends. The session record then stays at Supabase until the account is deleted, or until 90 days pass without the session being renewed (section 19), unless the session had already expired. In that case the sign-in details, with the email address, also stay in the app's storage on the device, and they and the session record go the next time the app opens with a connection.

A session not renewed for 90 days ends. OrQuest renews the sign-in on each device, with a connection, at least once an hour while it runs. A session it has not renewed for 90 days ends, and Supabase deletes its record; that device signs itself out the next time the app opens with a connection, and you can sign in again.

The account, its progress, your friend code and friendships stay until you delete the account: friends still see your league name, and anyone with your code can still add you.

9. The live league and friends

The live league is only for signed-in adults, and it is off until you choose it. The League screen shows a "Join the live board" button with a short notice of who will see what, and nothing is shared until you tap it. Once you join, you take part each week, in a group of up to 30 signed-in learners, until you leave or sign out on every device where you joined, or delete the account. You choose on each device: another device signed in to the same account also shows the button, and adds nothing to the live league until you tap it there. Everyone else sees the practice league.

• Your group sees your league name, weekly XP, tier and, when the week ends, whether you moved up or down. Never your name, photo, email address, account ID or progress.
• Your league name is made by our code from your account ID (two words and a number) and stays the same every week, so people in later groups may recognise it. There is no chat and no free text.
• Supabase keeps for us, for each week: your account ID, the week, your group, league name, tier, weekly XP, the day and XP of your latest learning day, your result and final place, whether you left the board that week, and the time of the last update.
• Leaving: on the League screen, choose Use simulated board, which switches this device to the practice league, and you leave this week's board at once: your league name and XP are taken off it, and nobody sees that row. The row stays, without XP, for the times below, so that leaving does not change who moves up or down: if you were among the bottom five of a group of 11 or more when you left, the week moves you down a tier, as it would have if you had stayed; otherwise your tier stays. Signing out of a device where you joined also leaves. Leaving and signing out work device by device: another device where you joined puts you back on the board, in the same group at 0 XP for the week, the next time its League screen opens, until you leave or sign out there too.
• How long: the current week and the 12 closed weeks before it in full; after that, only your latest week stays, with just your league name, tier and that week's result (no XP, days, place or group), until you delete the account. Delete account removes every week at once.

Friends are only for signed-in adults.

• The first time you open Friends on the League screen while signed in, your account gets an 8-character friend code. Anyone who has it can add you, with no step for you to approve, and you then see each other. Share it only with people you want as friends.
• A friend sees your league name, your XP this week (0 if you are not on a live board), whether you are on a live board this week and, while you are, your tier, and you see the same about them. Never your name, photo, email address, account ID or progress.
• Supabase keeps for us your code, league name, when the code was made, and each friendship (up to 50 friends), and, for an hour, when you tried a code that matched nobody, so that nobody can guess codes: after 20 such tries in an hour, adding a friend waits until the hour has passed.
• Remove friend ends a friendship for both of you, and New code stops the old code working. Nicknames you give friends stay on your device until you sign out or the friendship ends. Nobody can send you a message, a name or a picture through OrQuest.

A pause. If we pause your access to the live league or friends under section 13 of the Terms of Use, Supabase keeps for us a record of it: your account ID, when the pause ends, when we first set it and the reason we wrote. Nobody else using OrQuest sees this record. A daily check deletes it once the pause has ended, and it is deleted at once if we lift the pause early or you delete the account.

10. Subscriptions and purchases

OrQuest needs a subscription after the free week. Only an adult buys. OrQuest does not sell to children and shows children no purchase offers: prices, plans, the free trial and the one-time offer appear only in the adult area, behind the parent question on a device with a child profile. The one exception is the device's own reminders before a free trial ends or a yearly plan renews, and once a year on the monthly plan, which can appear on the lock screen: on a device with a child profile they say when the plan renews and how to cancel, never a price (section 11). Messages that Apple or Google show inside the app about a subscription, such as a payment problem to fix or a price rise to accept, appear only while an adult profile is open, or in Settings after the parent question.

Apple and Google take the payment under their own terms and privacy policies. We never receive your card details. Apple gives us purchase and subscription records and receipts (through RevenueCat) and statistics that do not name you, never your name or Apple Account email address. For each Google Play order, Google's tools show us the buyer's email address, country, state and postal code, with the order number, product, date and amount. Both stores give us crash information only from people who chose to share it. Google Play's notices of subscription changes may pass through our Google Cloud account on their way to RevenueCat. We use store order details only for support, cancellations, refunds, fraud prevention and the records tax law requires.

RevenueCat, Inc., in the United States, runs the subscription checks for us as our service provider: it confirms with Apple or Google whether a subscription or free trial is active, restores purchases and provides the plans on offer, including the one-time offer. Its code contacts RevenueCat each time the app starts, when you return to the app (at most once every five minutes), and when you sign in or out, view plans, buy, restore or manage a subscription, whichever profile is open (section 22). RevenueCat receives:

• an app user ID: a random code made on the device or, once you sign in, your account ID;
• the store's receipts or purchase tokens, the products, free-trial eligibility and subscription status;
• when you start a free trial or a subscription, the versions of the Terms of Use and of this policy shown, with the time, the screen, the language and the version of the app, so that we can show what you agreed to, and later the time this device first showed that purchase's Purchase summary, so that we can show when you received it;
• on iPhone and iPad, the identifier for vendor (a code Apple gives OrQuest on your device, not the advertising identifier), the device model, system and app versions, the app's bundle name, your preferred languages, your store country and the state of Apple's tracking permission for OrQuest (App Tracking Transparency), which OrQuest never asks for; on Android, the device model and brand, the Android and app versions, your languages and your store country (no Android ID and no advertising ID);
• your IP address, which RevenueCat says it uses to work out your country and then drops;
• when you open Manage subscription (in Settings, on the banner before a yearly renewal or with the monthly plan's yearly reminder, or on the free-trial check-in page), a record that its subscription screen was shown (we keep its survey switched off).

It never receives your email address or name, anything you learn, or anything a child enters or creates. It keeps for us the app user ID and earlier IDs linked to it, purchase history and receipts, the acceptance records of purchases and when their Purchase summary was first shown, subscription status, country, and when the app was first and last seen; if you sign in, it links your purchases to your account ID, so that a subscription can follow the account. Its dashboard turns the records into subscription statistics, which we use only to run subscriptions and to see how the business is doing as a whole, never to build a picture of one person or to advertise. RevenueCat may use information in combined form that no longer identifies anyone (de-identified) to improve its own service, as its terms with us allow. Its sub-processors, which provide hosting, error monitoring, data warehousing and artificial intelligence services, are listed in RevenueCat's data processing agreement. On Android, if you have a purchase or free trial and are not signed in, its code saves this random app user ID in your Google account's backup (Google Block Store), so that the purchase can be found after a reinstall.

On your device, the app remembers when the one-time offer was first shown and when it ends, so that the offer is made once on each installation. That memory is used for nothing else, stays after Delete everything and is never sent to us. The one-time offer is never shown on a child profile, or on an adult profile that has not yet answered the age question (section 7).

Money we pay you directly. If we pay you ourselves, for a refund our Terms of Use promise that the store does not give, we ask only for the order number, your name and your bank account or chosen payment service. We use them only for that payment, give them only to our bank or payment service, delete the bank details from our working records once paid, apart from the payment confirmation our bookkeeping must keep, and keep the payment record as a tax record.

11. Reminders and notifications

OrQuest's reminder notifications are scheduled on your device, and only after you allow notifications. Our servers send no notifications, and the app asks for no push token.

• Daily learning reminder, if you turn it on (on a device with a child profile, turning it on in Settings comes after the parent question): it may show your streak, though never on a device with a child profile, names a profile only on a device with a single adult profile, and never names a child.
• Free-trial reminder: one, before the first charge, on each device where the free trial started or was restored, or where you signed in during it, with the price, the store and the last day to cancel free. On a device with a child profile it shows no price and no buttons.
• Yearly renewal reminder: about 30 days before each yearly renewal, in three places:
  • a banner on the Learn screen of an adult profile (never on a child profile);
  • Settings, under Subscription (on a device with a child profile, under For parents, then Account and subscription, after the parent question), on the same days, so a device with only child profiles shows the notice there;
  • if you allow notifications, a notification on the device. It names the last day to cancel to avoid that charge. It skips Shabbat and the festivals as kept in Israel, including Chol HaMoed and the day before each festival, so it may come earlier, or not at all if no day fits, and on a device with a child profile it shows no price. Tapping it opens Settings, where the subscription shows the price, when the app knows it, and the ways to cancel (on a device with a child profile, after the parent question). The app sets it from the renewal date it last saw, and also sets one a year ahead, for the renewal after that (during a free trial of the yearly plan, for the first renewal), so a notification still comes if OrQuest is not opened on that device for up to a year; if it is not opened there for longer, a later notification may not come. The one set ahead names the price, as it was when it was set, only on a device without a child profile; it says it applies only if the plan is still set to renew, and may come even after you cancel in your store, if OrQuest was not opened on that device since. A device where the subscription was restored less than 30 days before the renewal gets none for that renewal.
• Monthly plan's yearly reminder: once a year, on each anniversary of the day the subscription began, a reminder that the monthly plan renews every month until you cancel, with its price when the app knows it and how to cancel, in the same three places as the yearly one: the banner and Settings, for 14 days, and, if you allow notifications, a notification at 10:00. The notification skips the same days, so it may come a few days before the anniversary, or not at all if no day fits; on a device with a child profile it shows no price and no buttons, and tapping it opens Settings. The app sets the next one each time OrQuest is opened, so it still comes if OrQuest is not opened on that device for up to a year. It names the price, as it was when it was set, only on a device without a child profile, says it applies only if the plan is still set to renew, and may come even after you cancel in your store, if OrQuest was not opened on that device since.

The text of a scheduled reminder stays in your device's notification system until it appears or is cancelled, and reminders can show on your lock screen. They never contain an offer or an advertisement.

12. Emails we send

• Sign-in codes, sent for us by Amazon Web Services EMEA SARL through Amazon SES, from Frankfurt, Germany, with open and click tracking off.
• Replies to your messages, and confirmations of cancellation notices, deletion requests and other requests, from our mailbox.
• Notices about your account, a security incident, a change to our documents or the end of the service. We may email these to account holders as well as telling you in the app or on the website.
• The launch email, once, from our mailbox, only to waitlist members who agreed to receive it (section 15).

We never send advertising without your express prior consent, as section 30A of Israel's Communications (Telecommunications and Broadcasting) Law, 5742-1982, requires. Every advertising message starts with the Hebrew word "פרסומת" (advertisement), in an email also at the start of the subject line; names us with our address and contact details; and lets you refuse further messages easily and free, including by replying to it. After you refuse, we send you no more advertising, and we remove you from the mailing list within 30 days at the latest. OrQuest sends no newsletters.

13. When you contact us

Contacting us is your choice, but without a way to reach you we cannot reply.

• Email to support@orquestapp.com: your address, your message and anything attached, kept in our Google Workspace mailbox.
• Feedback from the app. On the free-trial check-in page, "Open in email" opens your own email app with a draft to us: the reasons you chose, anything you write, and one line with the app version, your device's system and version, the app language, your plan's billing period and whether you are in a free trial, paying, or neither. Nothing is sent until you send it. The notice beside the form says where the email goes and who runs the mailbox, and links to this policy.
• Phone or post: your number, the time and what you tell us, or your letter. Our phone service provider carries calls and voicemail.
• Cancellation notices (Cancel a subscription): your name and, for a notice under Israel's Consumer Protection Law, 5741-1981, your ID number; and, if you choose, your store account's email address or the order number, which help us find the subscription. Once the notice is handled, we delete the ID number wherever we hold it, including the message that carried it (Google then removes deleted mail within 180 days).
• Privacy requests and complaints: only what we need to find your information and confirm who you are.
• Store reviews: we see the review and the name the store shows, and may reply there in public.

We use what you send only to answer you, act on your request, fix mistakes you report, improve OrQuest from what you tell us, and keep a record of what was agreed. Please send no child's personal details or photos. If a child under 13 writes to us, we use the message only to reply once, if needed, and then delete it.

14. Sharing, photos, voice and links

• Share cards are drawn on your device and never carry a profile's name or profile picture. On an adult's own card, the adult may add a photo from the device as the background: choose only a photo you have the right to share, and think carefully before sharing a picture of a child. The app's copy of that photo is deleted when the card's preview closes. A card goes, through your device's share sheet, only to the apps and people you choose. On Android, the caption is also copied to your clipboard, where other apps that read the clipboard can see it. The last card stays in the app's temporary storage until your next share or Delete everything. A card about a child's learning can be shared only after the parent question, and it never carries the child's name or any photo.
• Photos. On Android 12 and earlier, your device may first ask whether OrQuest may open your photos; iPhone, iPad and later Android versions ask nothing, because their own picker hands OrQuest only the photo you choose. OrQuest reads only the photo you pick and saves a 256 by 256 pixel copy, which normally leaves out hidden details such as where the photo was taken, though we cannot promise this on every device. OrQuest deletes every working copy the pick makes, including one that keeps the original's hidden details, as soon as the pick is over, whether or not the photo was saved. OrQuest never uploads a photo. Removing the photo or the profile deletes the saved copy at once.
• Voice. Verses from the Torah passages are recordings built into the app, read by an AI-generated voice made in advance. All other speech, including the prayers, is your device's own voice; on Android, some voice engines use the internet to read the lesson text, under their provider's terms. OrQuest never uses your microphone and records nothing you say.
• Links out. The Terms of Use, this policy, Cookies and device storage and Cancel a subscription open in a browser view inside the app and are served by Cloudflare (section 15); the Accessibility statement, Credits and licences, Contact and business details and the Purchase summary are screens of the app itself. The siddur sources page links to the websites of the editions we quote (daat.ac.il, nli.org.il, toratemetfreeware.com and sefaria.org); links in the app's own screens open other pages of orquestapp.com and, from Credits and licences and the Purchase summary, sites such as wikisource.org, sefaria.org, creativecommons.org, hebcal.com, gsap.com, higgsfield.ai, openfontlicense.org and apple.com; a phone number or an email address opens your phone or email app; and store pages open in the App Store or Google Play. On a device with a child profile, links out of the app open only after the parent question; the Accessibility statement is a screen of the app, so the question never keeps anyone from it. The sites you open see your IP address and browser details, under their own policies.

15. The website and the waitlist

When you visit orquestapp.com, Cloudflare, Inc. hosts the site as our service provider and, to deliver it and protect it from attacks, processes your IP address, browser details, the page you ask for and the time. We have turned on no logs or analytics of our own, so we keep no record of your visit; Cloudflare may keep limited security records of requests it blocked or checked. The site sets no cookies of its own, uses no analytics, advertising or social-media tools, and loads no scripts or fonts from other companies' servers, and the waitlist form sends your sign-up only to this site. Your browser keeps your colour theme, only if you press the theme button, and your place on the home page while the tab is open; neither is sent to us. Cloudflare sets a short-lived security cookie only if it needs to check a visit. Cookies and device storage lists every item.

The waitlist asks only for your email address. It is for adults (18 or over): parents, please use your own address and do not enter a child's. If we learn that a sign-up is a child's, we delete it, keep no record of it, and send nothing to that address.

• What you give: your email address. The form also sends the page's language, so that the launch email is in that language. The form needs JavaScript; without it, nothing is sent.
• Who keeps it: Cloudflare, Inc., which hosts the site, as our service provider. The form sends your sign-up to this site, and Cloudflare stores it for us in its database in the European Union. Your IP address is used only to stop the form being flooded, and is not kept with your sign-up.
• Your consent: the notice under the form, under "How we use your email", says that the list is for adults (18 or over), that we send one email when OrQuest launches and that we then delete your address. It also says who runs the list and how to reach us, that the launch email is an advertisement, that joining is up to you, that Cloudflare keeps the list for us in the European Union and that we send the launch email from our Google Workspace mailbox. Sending the form after it is your consent to receive the launch email and to those uses, and your sign-up keeps the notice's words as the record of it. Being on the list can suggest an interest in Jewish learning, so we treat it as sensitive (section 4) and use it only as this section says.
• Use: only to send one email when OrQuest can be downloaded. The launch email is the same for everyone on the list, in English or in Hebrew. It says that it is an advertisement sent by direct mail, that you receive it because you joined the waitlist on orquestapp.com and when, who we are and how to reach us, and how to be removed. We send it from our Google Workspace mailbox, separately to each address. We never write to you again from the list, never add you to another list, and never sell or share the list.
• Deletion: within two days after the launch email is sent, we delete your sign-up and our sent copy of the email to you (Google then removes deleted mail within 180 days). If OrQuest has not launched 12 months after you joined, we delete your sign-up then. Only a scrambled record of your consent stays, which cannot be used to contact you (section 19).
• Withdrawing: use the unsubscribe link, reply to the launch email or write to support@orquestapp.com, and we delete your sign-up (section 19).

16. Why we use information, and on what grounds

We use personal information only for the purposes in this table, and only the information each purpose needs. We will not use it for any other purpose unless you first consent, and silence, or simply carrying on using OrQuest, is never treated as that consent.

Where the ground is our legitimate interest, we have checked that it does not override your interests and rights, and you can object (section 21). You can withdraw a consent or change a choice at any time, without affecting what was done before.

In Israel, the Protection of Privacy Law has no ground called legitimate interest. There, the uses this table marks as our legitimate interest rest on what you asked for (the app, the website, or the feedback you chose to send), or are made to meet our duties under Israel's data security regulations or to protect our rights in a legal claim, as the law allows, and we make them only as far as they are needed and proportionate. Legitimate interest is the term other countries' data protection laws use for such uses.

17. Who receives information

We do not sell personal information, and we do not share it for advertising. We share it only with the parties below, and only for the purpose next to each.

Each service provider may use the information only to provide its service to us (apart from RevenueCat's use of combined information that no longer identifies anyone, section 10), under a written agreement that requires it to protect the information and not to pass it on, except to its own sub-processors bound in the same way. Every third party with whom we share information to run OrQuest, including each service provider above, must protect that information at least as well as this policy does: the same or equal protection that Apple's rules for apps require.

Others who receive information:

• other OrQuest learners, only if you join the live league or share your friend code, and only what section 9 describes;
• Apple and Google, independent companies under their own policies, when you buy, sign in with them or use their stores, backups or voices. We pass them only what their services need to work for you and, when you delete your account in the app on an iPhone or iPad where you signed in with Apple, a request to revoke OrQuest's sign-in tokens;
• apps and people you share to, only what you choose to share;
• our phone service provider, only to carry your calls and voicemail, and our bank or payment service, only to make a payment to you;
• our lawyer or accountant, bound by confidentiality, only what they need to advise us;
• courts, authorities and regulators, only where the law requires us to or to establish, exercise or defend a legal claim, and only what is necessary. Where the law allows, we tell you first, unless that would put someone at risk;
• someone who takes over OrQuest, only together with all our duties under this policy. We tell you at least 30 days before (or as early as we can, if a law or events outside our control give us less time), so that you can delete your account first if you wish.

Nobody else receives information: no advertising company or data broker, and no analytics, crash-reporting or push notification service of our own. Expo, whose tools the app is built with, and the companies whose tools made the app's pictures, film and verse voice (ElevenLabs, Higgsfield and the model makers they use) receive nothing about you.

18. Transfers outside Israel

We are in Israel. Our service providers keep information outside Israel, and some of these countries protect personal information differently from Israel.

Under Israeli law, each transfer follows the Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 5761-2001, on these grounds:

• Supabase: for the information kept in Frankfurt, that Germany is a party to the Council of Europe's data protection convention, Convention 108 (regulation 2(8)(1)); for access from the United States and Singapore, Supabase's written contract with us to protect the information (regulation 2(4)).
• Amazon SES: that Germany is a party to Convention 108 (regulation 2(8)(1)), and Amazon's written data processing terms (regulation 2(4)).
• RevenueCat and Google: each one's written contract with us to protect the information (regulation 2(4)).
• Cloudflare: its written contract with us to protect the information (regulation 2(4)); for the waitlist, kept in the European Union, also that every member state of the European Union is a party to Convention 108 (regulation 2(8)(1)).

In every case, the recipient has undertaken in writing, as regulation 3 requires, to take adequate measures to protect the information, to use it only to provide its service to us (apart from RevenueCat's use of combined information that no longer identifies anyone, section 10), and not to pass it to anyone else except sub-processors bound in the same way.

For users in Switzerland, Germany, and the other member states of the European Union, where Cloudflare keeps the waitlist, are on the Swiss Federal Council's list of countries with adequate protection. For the United States, Singapore and other countries, we rely on our providers' written agreements, which include standard contractual clauses with the Swiss adjustments, and, for Cloudflare, Google and Amazon, also on their Swiss-US Data Privacy Framework certification.

A copy of the safeguards. Ask at support@orquestapp.com and we will send you the parts of our agreements that protect your information, with commercial terms removed. The main ones are public: Supabase's data processing addendum, RevenueCat's data processing agreement and Cloudflare's list of sub-processors.

19. How long we keep information

We keep personal information only as long as this table says, and then delete it or make it anonymous. The table is also our written retention policy for any information that relates to children (section 22).

We keep information longer only where a law requires it, or for a legal claim or a regulator's request that has been made or is reasonably expected, and then only what is needed, for as long as it is needed.

20. Deleting information, and what remains

On your device:

• Remove a profile (Family) deletes that profile and its photo copy at once. The last profile can be removed only with Delete everything.
• Reset lesson progress (Settings) resets the open profile's progress, and its copy in the account if it has one.
• Delete everything (Settings, then Data) deletes this device's profiles, progress and settings, signs the device out, takes you out of the live league if you joined it on this device, and cancels the daily reminders. If the app cannot reach us at that moment, your league name stays on this week's board until the week ends, and the session record stays at Supabase until the account is deleted, or until 90 days pass without the session being renewed (section 19). By design it keeps three small things: the one-time offer's timing, the reminders already set before a free trial ends or a yearly plan renews (including the one set a year ahead) and the monthly plan's yearly reminder (section 11), and, if you were signed in with an active subscription, a note that it is still active. It deletes at once every profile photo, the last share card, the image tools' working copies, the image cache and every sign-in key the app stored. It leaves RevenueCat's storage (if you were signed in, its code is replaced with a new random one, as at sign-out), and your own backups. It does not delete an account or cancel a subscription.
• Removing the app deletes what the app keeps on the device, except RevenueCat's Google Block Store item on Android while Google backup is on, and your own backups.

On a device with a child profile, removing a profile, Reset lesson progress and Delete everything ask the parent question first.

Your account: in the app, Settings, then Account, then Delete account (on a device with a child profile, Account and subscription under For parents, after the parent question); on an iPhone or iPad where you signed in with Apple, Apple asks you to confirm. Without the app, see Delete your OrQuest account or email support@orquestapp.com with the subject "Delete my account"; we act within 7 days of your request (or of your reply, if we ask you to confirm it is you), and confirm.

Deleted at once: the account and its email address, sign-in methods and sessions; the saved progress; every live league week; the friend code, all friendships (friends no longer see you) and any code you tried that matched nobody; any pause of the live league or friends; the acceptance records kept with the account, apart from the deletion record. We also instruct RevenueCat to delete the purchase record it keeps for the account, with the acceptance records kept with its purchases (the latest one is first copied into the deletion record). After a deletion in the app on an iPhone or iPad where you signed in with Apple, we ask Apple to revoke OrQuest's sign-in tokens. If Apple does not confirm it, the app tells you how to remove OrQuest from your Apple Account yourself.

What remains, for the times in section 19:

• copies in backups and technical logs, for up to 7 days;
• the purchase record at RevenueCat, until RevenueCat has carried out our instruction to delete it (we repeat the instruction until RevenueCat confirms it, and again a week, a month and a year after the deletion, in case another device still signed in to the account brought it back);
• on another device that was still signed in to the account, its email address and ID, until OrQuest next renews its sign-in there (with a connection, at least once an hour while it runs): it then signs itself out, and stops using the account's ID with RevenueCat;
• after a deletion in the app, the new random code RevenueCat gives that device, with the device details in section 10, kept like that of any device that is not signed in (section 19);
• an address to which a sign-in code email bounced, or whose owner marked one as spam, on Amazon SES's list that stops further sending to it, for as long as it stays on that list;
• a record of a cancellation notice you sent us (your name, the date, the channel, the store and what we did, with no ID number), for 3 years;
• a deletion record, for 3 years: the account's random ID, the date, how the request reached us, which version of the Terms of Use was accepted and which version of this policy was shown, when, on which screen and in which version of the app, and the same details of the first and of the latest free trial or subscription started on OrQuest's subscription screen, how many times and when we last asked RevenueCat to delete its record, and when it confirmed, and when Apple confirmed revoking OrQuest's sign-in tokens, with no email address and no progress;
• purchase records at Apple and Google;
• payment, refund and tax records, for 7 years;
• emails between us, for 24 months after the last one;
• what is kept only on your devices, until you use Delete everything or remove the app.

Deleting does not cancel a subscription. Apple or Google keeps billing until you cancel, as Cancel a subscription explains. A subscription you keep stays with your store account, and Restore purchases reconnects it.

21. Your rights

These rights are for everyone, wherever you live. You can ask us for:

• access: whether we hold personal information about you, and to see it and get a copy;
• correction of information that is wrong, incomplete, unclear or out of date. If we correct it, we also tell those we passed it to;
• deletion, including your account and our RevenueCat record. Delete account and the controls in section 20 let you do much of this yourself;
• a portable copy of the account details and synced progress we hold for you, in a common machine-readable format;
• objection to our using your information on the ground of our legitimate interest (section 16). We then stop, unless we show a compelling reason that overrides your interests and rights, or need it for a legal claim;
• withdrawal of consent at any time: leave the live league on the League screen of each device where you joined, withdraw the sensitivity consent with Delete account, leave the waitlist by unsubscribing or writing to us, and turn off notifications in your device's settings. Withdrawal does not affect what was done before.

We never charge you, and never treat you worse, for using these rights.

How to ask. Write to support@orquestapp.com or 12 HaShoftim St, Tel Aviv, Israel, or phone +972 52 386 4584, saying what you want and, if you have an account, its email address. If you never signed in, give us the order number on your App Store or Google Play receipt, if you have one, so that we can look for the record RevenueCat keeps for that purchase; without a purchase, the record for your device is kept under a random code, and we cannot tell which one is yours. Contact and business details has a template. You can ask for yourself, through someone you authorise in writing, as a guardian, or as a parent for your child, free, in Hebrew or English. We may ask you to reply from the account's email address to confirm it is you. We ask for no more than we need, and never for a sign-in code or password.

How quickly we respond.

• We reply within 21 days to say whether we will do what you asked, and why if not. If we agree, we give access, a copy or a correction within 30 days of receiving your request.
• We delete an account within 7 days of a confirmed request (in the app it happens at once).
• After you ask us to stop advertising email, we send you no more, and we remove you from the mailing list within 30 days at the latest.
• We reply to a complaint in substance within 10 business days (Sunday to Thursday, except Israel's official days of rest, such as the festivals and Independence Day); if looking into it takes longer, we tell you when to expect the outcome.
• Where the law gives a shorter time, we meet it.

Limits. We never receive what is kept only on your device, so we cannot show, correct or delete it; section 20 explains how you can. We refuse or limit a request only where the law allows, such as where we cannot confirm who you are, where answering would reveal another person's information, or where a law requires us to keep the information, and we tell you why.

If you disagree, you can ask us to look again by writing with the subject "Appeal"; we answer within 60 days and explain our decision. This is optional: you never have to complain to us first, and you can go to a court or a regulator at any time (section 25).

22. Children and parents

OrQuest is made for families, and children use it on child profiles on the family's device. This section is our notice to parents under the US Children's Online Privacy Protection Act (COPPA), and it applies to every family, wherever you live. Operator: Yaniv Cohen, trading as OrQuest, 12 HaShoftim St, Tel Aviv, Israel, +972 52 386 4584, support@orquestapp.com.

What we collect from children in the app: nothing a child enters or creates. A child profile never leaves the device: we never receive a child's name, photo, answers, goals or progress. While a child uses OrQuest, the only personal information collected is the technical identifiers described next, for the app's internal operations. Children cannot sign in, create an account, join the live league, add friends, or post anything that others can see. The neutral question about the year and month of birth in section 7 comes before any account, and we use its answer only to decide whether a profile is an adult's or a child's. A child profile's own screens never show prices, plans, a free trial or the one-time offer, and never its own name on a screen about buying. Without a subscription, a child profile shows a calm screen whose only way on is a "For grown-ups" button behind the parent question; the subscription screen opens from a child profile only after that question, and only adults may buy. Notifications and share cards never show a child's name, share cards never show a profile picture, and a card about a child's learning carries no photo. Anyone who uses the device can see each profile's name, picture and weekly activity.

The website's waitlist asks only for an email address. It is for adults, but it asks no age, so a child could join it. We therefore treat every address on it as one that might be a child's: we use it only to send the one launch email that the sign-up asked for, never to contact anyone again or for anything else; we give it to no one except Cloudflare and Google, which keep it and send that email for us; and we delete it within two days after the email is sent, or 12 months after the sign-up if OrQuest has not launched by then (section 19). This is the one-time response that COPPA allows without a parent's consent (16 CFR 312.5(c)(3)). If we learn that a sign-up is a child's, we delete it at once, keep no record of it, and send nothing. Of every other sign-up, only a scrambled record that consent was given stays, which cannot be used to contact anyone (section 19).

Identifiers sent from the first launch, before the age question, and while a child profile is open. From the first time the app opens, whoever is holding the device, it checks the family's subscription with RevenueCat and keeps a signed-in parent's account current with Supabase, including saving the parent's own progress. These checks send the device's IP address and technical identifiers: the RevenueCat app user ID (a random code, or the parent's account ID) with the store's receipts or purchase tokens; on iPhone and iPad, the identifier Apple gives OrQuest on that device, with the device model, system and app versions, languages and store country; on Android, the device model and brand, system and app versions, languages and store country (no Android ID and no advertising ID); and, to Supabase, the parent's session with the device type. They carry nothing a child enters or creates, and do not say which profile is open.

We collect these identifiers only to support the internal operations of the app, namely: to check and restore the subscription, to keep the sign-in working and the parent's progress in step, to carry the app's network requests, to protect the security and integrity of the service, to keep the record of what was agreed at a purchase for as long as the law requires us to be able to show it (section 19), and to see, only in totals, how subscriptions are working (section 10). To make sure they are used for nothing else:

• the app contains no advertising, tracking or analytics tools that record how it is used;
• we send RevenueCat no name, email address or advertising identifier, and we send neither RevenueCat nor Supabase any detail about a child;
• our agreements with RevenueCat and Supabase let them process these identifiers only to provide their services to us, apart from RevenueCat's use of combined information that no longer identifies anyone (section 10);
• we never use or disclose them to contact a particular person, to build a profile of anyone, for advertising or for any other purpose;
• only we can see them in our providers' dashboards, behind two-factor sign-in.

Our retention policy for these identifiers. RevenueCat drops the IP address once it has worked out the country, and keeps the app user ID with the purchase record: for a signed-in parent, until the account is deleted and RevenueCat has carried out our instruction to delete the record (section 20); for a device that is not signed in (before any sign-in, or after a sign-out or account deletion), until 24 months have passed since RevenueCat last saw that device, no subscription in the record is still active and, for a record that holds a purchase, 3 years have passed since its last subscription ended (our daily check then deletes the record), while a random code that joined an account's record when someone signed in on that device stays with that record. Supabase keeps the IP address and device type in the parent's session record until that device signs out while it can reach our server, or the account is deleted, and at most until 90 days pass without OrQuest renewing the session (our daily check then deletes the record); in technical logs, for 7 days. We keep these identifiers no longer than the internal operations above reasonably need, and never longer than section 19 says.

The parent question. On a device with a child profile, it comes before:

• buying, restoring or managing a subscription, and opening the subscription screen or the Purchase summary from a child profile;
• the page a free-trial reminder opens;
• signing in, links out of the app and sharing;
• the parent area of Settings, the deletion and reset controls in section 20, and turning on the daily reminder;
• switching from a child profile to an adult profile, and, in Family, changing a child profile into an adult one or adding an adult profile while a child profile is open.

During setup, on any device, it also comes before a year of birth already given is changed. A correct answer lasts up to five minutes, and the app forgets it when the screen closes, the app goes to the background or the profile changes. Some screens keep it during a trip out of the app that they opened themselves, such as to your store, a web page or your email for a sign-in code. It is a speed bump, not a lock, and not parental consent: a determined child can answer it. For real control, use your device's screen lock and your store's family controls, such as Screen Time and Ask to Buy on Apple devices or Family Link on Android.

Parents' rights. A parent or guardian can ask us at any time what we hold that relates to their child, ask us to delete it, and refuse any further collection or use, by writing to support@orquestapp.com or 12 HaShoftim St, Tel Aviv, Israel, or phoning +972 52 386 4584. For a child profile we normally hold nothing beyond the identifiers above. What a child profile holds stays on the device, where a parent can review it by opening that profile (the Family screen also shows its weekly activity) and delete it by removing the profile in Family or with Delete everything (section 20), after the parent question. We confirm that you are the parent or guardian before we act, asking only for what we need, and answer within the times in section 21. The subscription checks are needed for the app to work, so stopping them for good means removing the app from that device.

If we learn that we have collected personal information from a child under 13 without a parent's verifiable consent, apart from the identifiers above that COPPA allows for internal operations, we delete it. If we learn that an account belongs to someone under 18, we close the account and delete what it holds; this does not cancel a store subscription, which a parent can cancel as Cancel a subscription explains. For anyone under 18, we process personal information only as strictly necessary to provide the app. Before any version of OrQuest collects personal information from a child, for example to save a child profile to an account or to put a child on a live board, we will update this notice first and obtain verifiable parental consent where the law requires it.

23. Security, and if something goes wrong

We protect personal information with measures suited to how sensitive it may be:

• encryption in transit: the app, the website and our service providers use encrypted connections (HTTPS); emails, including sign-in codes, travel encrypted between mail servers whenever the receiving server supports it;
• access control: each account can read only its own saved progress, and league and friends details are reached only through limited server functions that show others a league name, weekly XP, tier and weekly result, never an account ID, email address or name;
• our own access: only Yaniv Cohen uses our providers' administration accounts, each protected by two-factor sign-in, and looks at a person's information only to answer them, fix a fault, investigate misuse or a security issue, or where the law requires;
• written security documents, as Israel's Protection of Privacy (Data Security) Regulations, 5777-2017, require, including a description of each database, reviewed every year, and a log of security events;
• our providers commit in writing to protect the information, and Supabase and RevenueCat each report an independent security audit (SOC 2).

No method of storing or sending information is completely secure, and we cannot promise that information will never be accessed, lost or exposed without permission. If a security incident affects your personal information and could harm you, we will tell you without undue delay, by email where we have your address and, where we cannot reach everyone affected that way, on our website and, where we can, in the app; say what happened, what information was involved, what we are doing and what you can do; act to limit the harm; and report it to Israel's Privacy Protection Authority, and to any other regulator, where the law requires.

24. No selling, no advertising, no tracking, and automated decisions

• We do not sell, rent or trade personal information, share it for cross-context behavioural advertising, or use it for targeted advertising. OrQuest has no advertising.
• We do not use sensitive information to infer characteristics about you.
• We do not collect, use or sell personal information to train large language models or other artificial intelligence models.
• Neither the website nor the app tracks your activity across other websites or apps, and no other company collects information about your activity over time and across sites through OrQuest.
• Do Not Track and Global Privacy Control: because there is no tracking to switch off, the website and the app do not change what they do when your browser or device sends these signals.

Automated decisions. We make no decision about you based only on automated processing that has legal effects on you or affects you in a similarly significant way. As part of teaching, the app schedules reviews from how well you remembered each item, suggests a starting point from the level you choose, estimates plan dates from the pace you set and, in the live league, places you in a group and moves you between tiers by weekly XP. None of these decides what you pay or what you may use.

25. Information for particular places

Israel. Under section 13 of the Protection of Privacy Law, 5741-1981, you may see the personal information about you held in our databases, yourself, through someone you authorise in writing, or through a guardian. You may see it in Hebrew, Arabic or English, as the Law provides, free of charge. Under section 14, if it is not correct, complete, clear or up to date, you may ask us to correct or delete it, by email or by registered mail to 12 HaShoftim St, Tel Aviv, Israel; if we correct or delete it, we tell those we passed it to, as the Law requires. Section 21 gives our response times. If we refuse, we tell you why, and you may appeal to the Magistrates' Court under section 15 of the Law and the Protection of Privacy (Conditions for Inspection of Data and Procedure for Appeal of Refusal of an Inspection Request) Regulations, 5741-1981, within 30 days of receiving our refusal. You may ask at any time to be removed from any mailing list; we do so within 30 days at the latest and confirm in writing. You may complain to the Privacy Protection Authority at the Ministry of Justice. Giving us information is voluntary (section 5).

United States. We do not sell personal information or use it for targeted advertising. You can also contact your state's attorney general.

• Children: section 22 is our notice under COPPA. You can also complain to the Federal Trade Commission at reportfraud.ftc.gov.
• California: sections 6 to 15 list what we collect, section 17 who receives it, section 21 how to review and change it, section 26 how we announce changes, and section 24 our response to Do Not Track signals. Children cannot post content in OrQuest.
• Connecticut and other states that protect sensitive data: we process information that could reveal religious beliefs only with the explicit consent in section 4, you have the rights and the appeal in section 21, and section 24 says that we do not use personal information to train large language models. On a device with a child profile, the daily reminder never shows a streak, and turning it on in Settings comes after the parent question (sections 11 and 22). If we deny your appeal and you live in Connecticut, you can contact the Connecticut Attorney General at portal.ct.gov/ag.
• Texas and other app store age laws: see section 7.

Switzerland. Section 18 names the countries your information goes to and the safeguards, and you have the rights in section 21 under the Federal Act on Data Protection. You can complain to the Federal Data Protection and Information Commissioner at edoeb.admin.ch.

Australia. Australia's Privacy Act 1988 exempts most small businesses, and at present that includes us, so we do not claim to follow the Australian Privacy Principles. You still have every right this policy gives. If the Act comes to apply to us, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

New Zealand. New Zealand's Privacy Act 2020 applies to what we do for users in New Zealand, and you have the rights in section 21. You can also complain to the Office of the Privacy Commissioner at privacy.org.nz.

26. Changes to this policy

We change this policy only when the app, the website or our service providers change, when a law, court, regulator or app store rule requires it, to add protections, or to make it clearer or update our contact details.

• Every version has a version number and an effective date, and is never backdated. Earlier versions are at Past versions.
• Before a material change takes effect, we tell you on the website and in the next version of the app, and may also email account holders. Where a change reduces your privacy, we tell you at least 30 days ahead, unless a law or an urgent security need requires it sooner, and then as early as we can. Before a significant change, we also tell Apple and Google, as some laws require.
• A new purpose for information we already hold needs your consent first. We never treat silence, or simply carrying on using OrQuest, as that consent.
• A new version of the app that would send new kinds of information off your device comes only after this policy says so.
• Small changes that do not affect how we handle your information, such as to wording or contact details, take effect when published with a new version number.

27. Contact

Yaniv Cohen, trading as OrQuest (אור־קווסט), exempt dealer (עוסק פטור), Israel

• Postal address, including for registered mail: 12 HaShoftim St, Tel Aviv, Israel
• Email: support@orquestapp.com
• Phone: +972 52 386 4584 (Sat, 1:00-1:00)

Related pages: Terms of Use, Cookies and device storage, Delete your OrQuest account, Cancel a subscription, Contact and business details, Accessibility statement, Credits and licences and Past versions.