Privacy Policy

Effective: August 15, 2026 · Last updated: October 23, 2026 · v2.0

Back to Sh'elah

Your Privacy Matters: Sh'elah does not sell your personal data. We collect only what we need to provide the Service and improve it. You may request access to, correction of, or deletion of your data at any time.

1. Information We Collect

Account Information

When you create an account, we collect your name and email address via our authentication provider (Clerk). We do not store your password directly. Clerk manages it securely.

Age Requirement

Every page displays a footer notice that using the Service requires you to be at least 13 years old (16+ if located in the EU/UK), per our Terms of Service. We do not verify age or collect your date of birth. Continued use of the Service is treated as your confirmation that you meet this requirement.

Usage Data

We collect information about how you use the Service:

Preferences

We store your user preferences to personalize your experience, including: language (English/Hebrew), theme (light/dark), community/tradition settings, and calendar display preferences.

Device & Technical Information

We automatically collect certain technical information when you use the Service:

Cookies & Local Storage

We use cookies and similar technologies:

Today the Service uses no non-essential, consent-gated cookies. If we add any in the future, we will gate them behind a consent prompt for EU/UK/California users before they load. You can disable non-essential cookies in your browser settings; necessary cookies cannot be disabled without breaking core sign-in functionality.

2. Purposes & Legal Bases (GDPR Art. 6)

For users in the EU/UK, we rely on the following legal bases for each processing purpose:

Purpose Legal Basis
Providing the Service (account, AI answers, bookmarks) Performance of a contract (Art. 6(1)(b))
Security, fraud/abuse prevention, rate limiting Legitimate interest (Art. 6(1)(f))
Aggregated, cookieless analytics Legitimate interest (Art. 6(1)(f))
Any future non-essential cookie/marketing use Consent (Art. 6(1)(a)), opt-in only
Legal compliance (e.g., responding to lawful requests) Legal obligation (Art. 6(1)(c))

We do not use your questions or answers to train AI models without your explicit consent.

3. Data Retention

Data Type Retention Period
Account information (name, email) Until account deletion or 1 year of inactivity
Answer history (questions + AI answers, including answers asked without signing in) 90 days, then automatically deleted
Cached AI responses 24 hours (shared across users, not linked to you)
Saved AI conversations (signed-in users) Until you delete your account. Deleting a single conversation hides it from your list; the stored copy is removed when your account is deleted.
Short summaries of earlier questions (signed-in users) Until account deletion
User preferences & bookmarks Until deleted by user or account deletion
Device cookie (shelah_device, signed-out answers) Up to 1 year in your browser; the answer it unlocks is deleted after 90 days
Session cookies Deleted on logout
Security logs (IP, access logs) 30 days
AI usage/cost logs 90 days, then automatically deleted

An automated daily job enforces the answer-history and AI usage/cost log retention windows above in production (docs/PRIVACY_OPERATIONS.md §5). Account deletion is available on request at any time. See "Your Rights" below for the self-serve download/delete tools in your account settings.

4. Data Sharing & Sub-Processors

We do not sell or share (as defined by CCPA/CPRA) your personal data to third parties for cross-context behavioral advertising.

We share data with the following service providers ('sub-processors') who help us operate the Service, each under its own data-processing terms:

We may share anonymized, aggregated data (no personal information) for academic or halachic research purposes.

We will disclose your data if required by law (e.g., subpoena, court order), or if we believe disclosure is necessary to protect the safety of any person or to prevent illegal activity.

5. International Data Transfers

Several of our sub-processors process data in the United States. If you are located in the European Economic Area, United Kingdom, or Switzerland, your data may be transferred to and processed in the US or other countries outside your jurisdiction. As confirmed 2026-09-04 from each provider's own public DPF/DPA documentation: Clerk and Vercel are self-certified under the EU-U.S. Data Privacy Framework (DPF), including its UK and Swiss extensions, with Standard Contractual Clauses (SCCs) incorporated as a fallback where DPF does not apply; Google participates in the DPF and additionally relies on SCCs for transfers outside DPF's coverage; Anthropic documents SCCs (EU Module 2/3, plus UK and Swiss transfer addenda) as its primary transfer mechanism and separately participates in the DPF as a secondary basis. As confirmed 2026-09-05 from their own current public documentation, Supabase relies solely on SCCs (Module 2/3, plus UK and Swiss transfer addenda), with no DPF self-certification found in its DPA; Sentry is self-certified under the EU-U.S. DPF, with SCCs (Module 2/3, plus a UK addendum) incorporated as a fallback where DPF does not apply. See docs/PRIVACY_OPERATIONS.md §3 for source links. These are the standard transfer safeguards recognized by the European Commission (Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework), and most services that rely on US-based providers use them for this purpose. Sh'elah relies on each vendor's own executed safeguard as confirmed above, and will review this section if a vendor's certification or DPA terms materially change.

6. Your Rights (GDPR, CCPA/CPRA & Others)

Depending on your location, you have the following rights regarding your personal data:

Access and deletion are available instantly, with no need to email us, from "Privacy & Data" in the account menu once you're signed in. For correction, objection/restriction, or any request you can't complete there, email contact@shelah.org with your account email and the specific request. We will respond within 30 days (or the timeframe required by applicable law, if shorter).

7. Security

We take reasonable measures to protect your data:

Breach notification: if a security incident results in unauthorized access to your personal data, we will notify affected users and, where legally required, the relevant supervisory authority, without undue delay and in any case within the timeframe required by applicable law (e.g., 72 hours under GDPR Art. 33 once we become aware of a reportable breach), describing what happened, the data involved, and the steps we are taking.

8. Children's Privacy

The Service is not directed to, and may not be used by, anyone under 13 years old (or under 16 in the EU/UK, absent verifiable parental consent; see our Terms of Service §3). We do not knowingly collect personal information from anyone below these thresholds. If we learn that we have collected personal information from a user below the applicable threshold, we will delete that account and its data. If you believe a minor has provided us with personal information in violation of this policy, please contact us so we can investigate and delete it.

9. AI Processing & Automated Decision-Making

Your question, the earlier turns of the same conversation and the source excerpts found for it are sent to Google Gemini, or to Anthropic Claude if Gemini is unavailable, to write the answer. If you are signed in and short summaries of your earlier questions are stored for your account, up to two of them are sent too. This is automated, but it does not produce a legal or similarly significant decision about you. It writes study material, and the answer tells you to ask your own rabbi. See our AI Disclosure page for how this works and where it goes wrong.

10. EU Representative & Data Protection Officer

Sh'elah is currently operated by Akiva Yevdayev, an individual, not a registered company, and has not formally designated an EU representative under GDPR Art. 27 or a Data Protection Officer under Art. 37. Sh'elah does not specifically market or target the Service to residents of the EU, UK, or Switzerland (no EU-specific advertising, currency, or localized marketing), does not carry out large-scale or systematic monitoring of users, and does not process special-category data as a core business activity. Any sensitive subject matter arises incidentally within a user's own question, not through systematic collection or profiling. Based on GDPR Article 27(2)'s exemption for occasional, low-risk, non-large-scale processing and Article 37's large-scale/systematic-monitoring threshold for a Data Protection Officer, Sh'elah has determined that neither an EU representative nor a DPO is currently required. This determination will be revisited if the Service's scale, EU-specific marketing, or data-processing activities materially change. Direct any EU-specific inquiry to the contact in §12.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised policy here with an updated effective date and version, and the footer notice on every page always links to the current version. For material changes (e.g., a new category of data collected, a new sub-processor with a materially different purpose, or a reduced level of protection), we will call out the change in the footer notice and, where practical, notify signed-in users directly, consistent with how we handle material changes to our Terms of Service (§18).

12. Contact Us

For privacy-related questions, data requests, or to report a concern:

This policy is provided for transparency about our data practices. It is not a substitute for independent legal advice in your jurisdiction. See also our Terms of Service and AI Disclosure.