Privacy Policy

Account information. Your name, email address, and timezone. If you sign in with Google we receive your name, email, and profile picture from Google — never your Google password.

Circle activity. What you and your Circle create in the product: Circles and memberships, Occasions and their dates (including Hebrew calendar dates you add), contribution requests and your responses, chat messages, polls, reimbursement requests and receipt photos, and every ledger entry.

Payment information — the part we deliberately never hold. Bank logins and full card numbers are collected directly by our payment processor and never touch our servers. What we store is what the ledger needs: the amount, the status, which payment method was used (for example, a card’s brand and last four digits), and the processor’s reference for the transaction.

Technical basics. Standard server logs (IP address, browser type, timestamps) kept for security and debugging. We do not use advertising trackers or sell analytics about you.

• Running the product: moving contributions, maintaining the ledger, delivering chat, sending the emails and reminders your Circle triggers.
• Keeping Surprise Mode airtight: exclusion lists exist precisely so our servers know what to withhold from whom.
• Dates and reminders: birthdays, anniversaries, and yahrzeits you enter are used to offer to open an Occasion at the right time, in your timezone.
• Security and fraud prevention: spotting stolen accounts and abuse before money moves.
• Legal obligations: our payment processor and partner bank require records of money movement, and we keep what the law requires.

We do not use your data to advertise to you, and we do not sell or rent it to anyone. Ever.

Most of what you do on Mishtatef is deliberately visible to your Circle — a shared ledger only works if it is shared. The boundaries:

• Your Circle sees the ledger, Occasions, chat, and — depending on the Circle’s visibility setting — your contribution amounts, percentages only, or no individual amounts at all. You can give anonymously to any single Occasion.
• Organizers of a collection additionally see the response board: who has accepted, declined, or not yet answered. That list is never shown to the whole Circle.
• An excluded honoree sees nothing. When an Occasion excludes someone, our servers refuse to send that person the Occasion’s existence, chat, ledger lines, or emails. The filtering happens server-side, before anything reaches their device, and our release tests verify it.
• People outside your Circle see nothing about it. Circles are not public and are not indexed.

Only the service providers required to run the product, each bound to use your data solely to provide their service to us:

• Our payment processor and partner bank, to move and hold money and to meet their legal obligations (such as sanctions screening).
• Our email delivery provider, to send the transactional email the product generates.
• Our hosting and infrastructure providers, which store the data described above.

Beyond that, we disclose data only if the law compels it, to prevent fraud or imminent harm, or as part of a merger or acquisition — in which case this policy continues to apply to your data and we will notify you before any change takes effect.

Mishtatef sends transactional email: invitations, contribution requests, advance notice before any recurring charge, payout approvals, and statements. Every batch is filtered through Occasion exclusion lists before sending, so an honoree never receives mail about their own gift. Reminders are deliberately restrained — one gentle nudge, sent by a person, not an automated chase. We do not send marketing email unless you opt in, and everything optional has an unsubscribe link.

The ledger is append-only and kept for as long as the Circle exists — it is the Circle’s shared financial record, and money-movement records are also retained as long as our payment processor and applicable law require (typically seven years).

If you close your account, we delete or anonymize your personal data within 30 days, with two exceptions: ledger entries remain (attributed to a de-identified former member, because your family’s record of who gave what must stay intact), and records we are legally required to keep are retained for the required period, then deleted.

All traffic is encrypted in transit and data is encrypted at rest. Sign-in uses one-time email links or Google — there are no passwords for us to lose. Access to production data is restricted to the small number of people who operate the Service, and the most sensitive material — bank credentials and card numbers — is kept out of our systems entirely by design. If a breach ever affects your data, we will tell you promptly and plainly.

• See and export your data: your ledger history is always visible in the product, and you can ask us for a full export of your personal data.
• Correct it: your name, email, and timezone are editable in settings.
• Delete it: close your account in settings or by emailing us, subject only to the retention rules in section 6.
• Object or complain: email us first — we will actually respond — and you may also complain to your local data protection authority.

We honor these rights for everyone, not only where a statute (such as the GDPR or the CCPA) requires it. We never discriminate against you for exercising them.

Mishtatef is for adults; you must be 18 to hold an account. We do not knowingly collect data from children. Occasions may of course be about children — a new baby, a bar mitzvah — and that information is provided by, visible to, and controlled by the adult members of your Circle.

If we change this policy in any material way, we will email every account holder at least 14 days before the change takes effect. We will never quietly weaken the promises on this page — in particular, “no ads, no selling data” is permanent.

Privacy questions or requests: support@mishtatef.app. For how the Service itself works, see our Terms of Service.