Privacy policy

KosherWorld, the same guide behind mundokosher.app and kosherworld.app, is an independent guide to kosher places, synagogues, mikvaot and Jewish community life, with a Jewish calendar and guides. It is run by a small team and is not affiliated with any certifying body or community institution.

For anything about your data, write to hello@kosherworld.app. That address is the single point of contact for every request in this policy.

It applies to the website (mundokosher.app and kosherworld.app in every language), the KosherWorld Android app, and the weekly candle-lighting email. The website and the app share the same catalog and the same account, so they collect the same data unless a section says otherwise.

You can use most of KosherWorld without an account: browse places, the calendar and the guides, and save favorites on your device. The information below only reaches us when you decide to give it.

• Account: your email address, your name, an optional photo, your language, and the city and country you tell us you live in. If you sign in with Google we receive from Google your name, email and profile picture, never your Google password. Your kashrut preference (which level you observe) is stored in your account so it follows you between devices; we never use it for anything else and it never appears in analytics.
• Contributions: reviews, ratings, lists, favorites, photos and suggestions of places or corrections. Reviews and public lists are shown with your display name. When you suggest a place or correction we ask for your name and email so we can follow up; they are never displayed on the site.
• Candle-lighting email: your email address and the city you chose, so we can send you the right times each week. Every email has an unsubscribe link.
• Messages: whatever you send us by email, so we can answer.

We keep this to the minimum the product needs, and we run it ourselves rather than through advertising or analytics companies.

• Location: only if you grant the permission, and only to sort places by distance and show them around you. Approximate location is enough. Your coordinates stay in the memory of your device while you explore; they are never written to storage, never sent to our servers, and never included in analytics, links or notifications. We never read your location in the background.
• Usage: which screens are visited and for how long, and when someone signs up for candle-lighting emails. This is first-party analytics on our servers, with random visitor and session identifiers. On the website, activity can be linked to your verified account if you are signed in. We do not record searches, kashrut preferences or device coordinates. We respect the browser’s Do Not Track and Global Privacy Control signals. In the Android app you can turn analytics off in Settings.
• Website technical data: IP address, approximate location derived from it, browser, operating system, device type, language and screen size. We also record the referring domain and allowed campaign labels to understand how visitors arrived. Hosting providers also keep request logs for security and troubleshooting.
• Cookies and local storage: we store language, city, theme, session and the progress you confirm in the Android guide. First-party analytics uses random identifiers in browser storage. We do not use advertising cookies or tracking across third-party sites.
• Android test: we record invitation clicks, links opened, help options chosen and installation that you confirm yourself. A click does not prove you joined the group or installed the app. If you have a verified session, the team can consult the name, photo, email, phone and signup date already available in your account to support you; without a session, we do not know your name or Google email. This information is private to the administration team.

The app asks for each permission at the moment it is needed, explains why, and works without it.

• Location: to order places by distance. Handled as described above; approximate location is accepted.
• Calendar: only when you tap to add candle-lighting times or holidays to your calendar. The app lists your writable calendars and inserts the events you chose. It never reads your existing events.
• Notifications: reminders for candle lighting and holidays are computed on your device and sent by the device itself. Service notices from the team go through Google's Firebase Cloud Messaging with a token tied to your session; no other Firebase products (no Analytics, no Crashlytics) are used.

Only for KosherWorld itself:

• To provide the service: show the catalog, keep your account, favorites, lists and reviews, and send the emails you asked for.
• To personalize it: your language, your city, your theme and your kashrut preference, so the app shows what is relevant to you.
• To review contributions: every suggestion, review and photo is checked by a person before it is published or used to update a listing.
• To keep it safe: prevent abuse, spam and automated sign-ups.
• To improve it: understand which screens and cities are used, in aggregate.

We do not sell your data and we do not share it with advertisers. Some providers process it on our behalf so the service can run:

• Supabase: database, authentication and file storage for accounts, contributions and the catalog.
• Vercel: hosting of the website and of the endpoints the app talks to.
• Cloudflare: protection against automated sign-ups (Turnstile) and storage of the photos you upload.
• Mapbox: the map and address search. When you use the map, your interactions and the addresses you type reach Mapbox to render tiles and find places.
• Hebcal: candle-lighting times, holidays and zmanim. We send the city you chose, never your exact position.
• Google: Sign in with Google if you choose it, Firebase Cloud Messaging for service notices, and Google reviews shown on some listings.
• Resend: delivery of account emails and the weekly candle-lighting email.

These are commitments, not defaults we might change quietly:

• No advertising, no ad networks, no advertising identifier.
• No sale or rental of personal data, to anyone.
• Your kashrut preference never leaves your account: not in analytics, logs, links or notifications.
• Your device’s GPS coordinates are never stored on our servers or on your device. This does not include the approximate location estimated from your IP address, described above.

Account data stays while your account exists. Candle-lighting subscriptions stay until you unsubscribe. Suggestions are kept as the catalog’s audit trail. Website and Android test activity history is kept for analysis and support; it currently has no automatic deletion based on age. You can ask about or request deletion of your data through the contact channel in this policy.

Deleting your account removes the data listed below and unlinks any retained activity history from that account.

Wherever you live, you can ask us to see the data we hold about you, correct it, delete it, receive a copy, or stop a specific use. Write to hello@kosherworld.app from the address of your account and we will answer within 30 days. If you are in the European Union or the United Kingdom, you also have the right to complain to your data protection authority.

Some things you can do yourself: change your name, photo, city and language from your account; turn analytics off in the Android app's Settings; manage notifications from the app or the system; unsubscribe from the candle-lighting email with the link in every message.

You can ask for your account and its data to be deleted at any time. Send an email to hello@kosherworld.app from the address of your account with the subject "Delete my account". We will confirm with you and delete it within 30 days.

Deletion removes your profile, sign-in credentials, favorites, lists, reviews, photos you uploaded, candle-lighting subscriptions, notification tokens and any pending claims. Corrections you suggested that were already merged into the catalog remain, without any link to you. Activity history may remain without a link to the deleted account; it may still contain technical identifiers and IP addresses. If you also want those records deleted, include that in your request.

If you only want to stop the weekly email, use the unsubscribe link instead: your account stays.

KosherWorld is for a general audience and is not directed at children under 13. We do not knowingly collect data from children; if you believe a child has created an account, tell us and we will delete it.

All traffic is encrypted (HTTPS). Every account can only read and write its own data, enforced in the database itself. The Android app carries no private keys: anything that needs a privileged credential runs on our servers.

Our providers run their infrastructure in the United States and the European Union. By using KosherWorld, your data may be processed in those regions under the providers' standard safeguards.

When we change it we update the date at the top of this page. If a change matters to how we use your data, we will also tell you in the app or by email.