Privacy.

Your account and choices

Sign in with Apple provides a stable account identifier and, when shared, an email address or an Apple private-relay email address. We use this information to connect you to your pushka. A name you choose to share is donor-provided and is not independently verified.

Your receipt email is a separate preference. It may differ from your sign-in address. For Apple Pay, the app requests the donor name and email for receipt purposes; it does not request a postal address or phone number.

Pledges, payments and records

We keep the account-linked pledged balance, donation amounts and payment results, transaction references, saved payment-profile identifiers and masked payment labels. We also keep your collection settings, authorization and consent records, and information needed to prevent duplicate payments and investigate uncertain results.

Authorize.Net processes payments and securely hosts regular-card entry. Its card form collects a billing address and may also collect optional billing contact information, including phone or fax, in the payment-provider profile. These billing details are separate from the name and email requested by the app for Apple Pay. Apple handles Apple Pay authorization and payment-token creation. We use saved payment-profile references rather than storing your full card number or card security code in the pushka account.

When The Donors’ Fund manual option is available in checkout, its separate Giving Card form sends the number and CVV for one individually confirmed grant over an encrypted connection directly to a dedicated service in Torah Shelaima’s own Cloudflare account, then to The Donors’ Fund. Our website and account-management service receive only checkout and result metadata, not those card details. The dedicated service handles the details transiently and does not log or retain the number or CVV. Server records retain grant amounts, approval references, consent, an optional confirmation-email preference and duplicate-payment safety metadata.

In the updated iPhone app, you may separately choose to save a Giving Card number on that iPhone. Saved numbers, optional labels and masked last-four information are kept in an account-scoped, device-only Apple Keychain vault requiring a device passcode and device authentication to unlock. They do not sync through iCloud and are not shared with the website, app widgets or our account database. You can select, add, replace or remove entries in Donors’ Fund cards. The CVV is never saved: enter it again for each grant. Saving or unlocking a number does not validate the card, make a grant or authorize automatic giving.

Coins in the digital pushka are pledges until a donation is approved. Changing a receipt email or saving a payment method does not itself authorize a donation.

Receipts and administration

Resend is used for app-generated receipt emails and internal administrative notices. Depending on your request and the payment pathway, payment-provider receipt services may also be used. Email delivery is not guaranteed.

Authorized staff may receive the actual donor-provided name, sign-in or receipt email addresses, donation amount, transaction reference and masked payment label to administer giving and respond to support requests. These messages do not include full card numbers, security codes or payment API secrets.

For The Donors’ Fund, the app-generated email and PDF are grant confirmations, not additional tax receipts. Internal grant notices omit your name and email; no identity is inferred from Giving Card details. The Donors’ Fund may send its own notices and share information according to its account settings and policies.

Reminders and notifications

Location-based reminder calculations use coordinates on your device, including calculations for sunset and Hebrew-calendar reminder timing. Those reminder coordinates are not sent to the pushka server.

If you enable push alerts, an Apple push-notification token and an installation identifier are linked to your account on the server, with registration information used to keep alerts assigned to the right account and device. Apple delivers push notifications. You can turn alerts off in the app or iPhone Settings; turning alerts off does not stop an authorized giving schedule.

For the optional Rosh Chodesh manual-emptying reminder, the app sends your selected time zone, Israel or diaspora calendar choice, optional Donors’ Fund reminder preference and a bounded set of safe reminder times calculated on your device. It does not send your reminder coordinates, Giving Card number or CVV. The service checks your current giving mode and pledged balance before sending, so this reminder is for manual emptying with a positive balance; opening it does not authorize a payment. A Donors’ Fund reminder asks you to enter the CVV and confirm each grant; it never charges automatically. You can change its time or turn it off in Tzedakah reminders. Open the app after travelling to refresh your calendar and reminder times.

Service providers and protection

Services used to operate the app include Apple for sign-in, Apple Pay and push delivery; Authorize.Net for payments; The Donors’ Fund for its manual grants when enabled; Resend for email; and our hosting providers, including Cloudflare-backed infrastructure, for the website, account service and scheduled operations. Hosting providers receive the network information needed to serve requests.

We use account ownership checks, masked payment information and access controls to protect records. No system or delivery channel can be guaranteed to be completely secure. Do not send passwords, card numbers, security codes or verification codes in a support email.

We do not use advertising tracking or sell your personal information.

Retention and your requests

We retain information needed to administer donations, maintain accounting records, prevent fraud and duplicate payments, address disputes, support security and meet legal obligations. Closing an account does not necessarily erase financial records that must be retained for those purposes.

In the updated iPhone app, open Your Pushka, then Account → Delete account. Confirm with the same Apple account. Once the service accepts deletion, future automatic giving is stopped, sessions and notification connections are retired, and unneeded account names and email addresses are removed. Deletion does not donate your remaining pledged balance or refund a completed donation.

An already-processing or unconfirmed payment may still finish. Final deletion can wait for its result and payment-provider cleanup; check the saved deletion status in the app rather than starting another payment. Necessary donation amounts, dates, transaction references, consent and duplicate-payment safety records remain under a pseudonymous account reference. Apple sign-in access is revoked when possible; if automatic revocation cannot be completed, the app explains how to remove that access in your Apple Account settings.

Device-only reminder and sound preferences remain on the iPhone; you can change or remove them separately. Server-linked manual-emptying calendar settings and reminder records are removed when account deletion is accepted. Copies of receipts or notices already delivered to you, authorized staff or service providers cannot be recalled by account deletion and remain subject to applicable retention duties. For access, correction, help with an older test build or a deletion that needs review, contact admin@torahshelaima.org. You do not need to email us to initiate deletion in the updated app.

Optional saved Giving Card numbers stay protected on the iPhone when you sign out; another app session must match that pushka and unlock them again. Remove entries in Donors’ Fund cards whenever you no longer need them. Completing verified account deletion in the updated app removes that account’s local vault on that iPhone. Each device keeps an independent local vault, so remove any saved copies separately on other iPhones.

Contact