Privacy Policy

Who is responsible

The site and the platform are run by the team behind isshabat.info, who decide how the information described here is used. For any question about privacy, or to use any of the rights below, write to rafael@isshabat.info.

Reading the site without an account

• The countdown, the candle-lighting and havdalah times and the holiday dates need no account, name or email address.
• Your city is either the one you pick or a guess from the time zone your browser reports. We do not ask for your location and do not look up your IP address to find it. The city is remembered in your browser’s local storage; when a page asks our server for a city’s details, the request is not linked to you.
• Your language, colour scheme, clock format and calendar view are remembered in your browser only.
• Every page sets one short-lived security cookie, described in the Cookie Policy.

Advertising

The public pages carry Google AdSense, which shows ads and sets its own cookies under Google’s advertising policies, not ours. It runs independently of the platform: signing in, your game and the account data described below are never used for advertising.

Where the law asks for your consent first, AdSense does not load until you allow advertising in the cookie banner. You can see and limit how Google personalises ads to you at adssettings.google.com; the Cookie Policy lists the cookies AdSense sets.

Visitor statistics

We use Google Analytics to see how the site is read: which pages are opened, in which language, for which cities and holidays, and how visitors found the site. It records the pages you open and the choices you make on them (the language, the colour scheme, the city you pick), together with what your browser reports by itself: the device, browser and screen size, its language, the page that sent you here, and an approximate location, down to the city, that Google works out from your IP address.

It never receives your name, email address, account or game data, or anything you type into a search field. Google Analytics does not store IP addresses. It tells visits apart with first-party cookies listed in the Cookie Policy, and Google keeps the detailed records for no longer than 14 months.

Where the law asks for consent first — in the European Union and the rest of the EEA, the United Kingdom and Switzerland — a banner asks before Google Analytics or AdSense loads, and neither does until you agree. The site tells where you are from your device’s time zone, the way it finds your city; a device that reports none is asked too. Elsewhere both run unless you turn them off. Whatever your answer, you can change it at any time under “Cookie settings” at the bottom of every page, and the site works the same either way.

If you are signed in to Google and allow ad personalisation, Google may add anonymous, aggregate estimates such as age range and interests. You can opt out of Google Analytics on every site with Google’s browser add-on at tools.google.com/dlpage/gaoptout, or by blocking cookies for this site.

Signing in with Google

The platform — your character, the minigames and virtual shekels — needs an account, and the only way to create one is to sign in with Google. We ask Google only for the “openid”, “email” and “profile” permissions, and from them we keep: your Google account identifier (a number that does not change), your email address and your name. Google also confirms that the address is verified.

We never see your Google password. We do not keep Google’s access, refresh or ID tokens: once your identity is checked, we issue a session of our own and discard them. We do not access your Gmail, contacts, Drive, calendar, photos or any other Google data.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What your account holds

• Your Google account identifier, email address, name and role on the platform.
• Your game: the virtual shekel balance, your character’s face and outfit, the items you own, achievements, levels and minigame records.
• An activity calendar by date (UTC): the level of each day’s visit, how many minigame rounds you played and how many shekels they paid, and the last Shabbat you were rewarded for.

Why we use it

• To sign you in and keep you signed in, and to run the game you chose to play. This is needed to provide the service you asked for.
• To keep the site secure and working: rate limits, stopping abuse and cheating, and fixing errors. This is our legitimate interest in running a safe service.
• To reply when you write to us, at your request.
• To understand which pages, languages and cities people come for, and to make the site better for them, from the visitor statistics described above. This is our legitimate interest in running a useful service and, where the law requires consent, your consent.

We do not use your account or game data for advertising or profiling, we make no automated decisions about you with legal or similar effects, and we do not send marketing email.

Who else can see it

• Google, as the sign-in provider, under Google’s own privacy policy.
• Google AdSense, which shows ads on the public pages and sets its own cookies, described in the Cookie Policy.
• Google Analytics, which collects the visitor statistics described above under Google’s own privacy policy.
• The hosting provider that runs our servers, which processes data only on our behalf.
• Platform moderators, who can see the list of accounts, including names and email addresses, in order to moderate the platform.
• Public authorities, only where the law requires us to disclose it.

Other players do not see your email address. We never sell, rent or trade personal data.

Server logs

Like almost every web server, ours records each request: IP address, the address requested, the time, status and size of the response, the referring page and the browser’s user agent. These logs are used to keep the site running and to stop abuse. They are rotated automatically and capped in size, so they are kept only for a short time.

How long we keep it

• Account and game data: until you delete the account. If the account was blocked for breaking the rules, after deletion we keep only a one-way hash of its Google identifier, so the block is not lifted by signing in again; the hash identifies nobody on its own.
• Your session: 7 days, or until you sign out.
• The sign-in check with Google: 10 minutes.
• The page security token: 12 hours.
• Server logs: a short time, until they rotate out.
• Visitor statistics in Google Analytics: up to 14 months.
• Messages you send us: as long as needed to deal with them.

Your rights

Depending on where you live (for example under the EU and UK GDPR), you have the right to access the data we hold about you, to have it corrected or deleted, to receive a copy in a portable format, to object to or restrict its use, and to complain to your data protection authority. Write to rafael@isshabat.info; we answer within 30 days.

You can delete your account yourself: Settings → “Delete my account”, confirmed by typing the account name. If you cannot sign in, write to rafael@isshabat.info from the address your account uses. The account is deleted together with its game data; the balance, items and progress cannot be restored afterwards. You can also remove the site’s access at any time in your Google Account, under third-party connections.

Children

The platform is not meant for children under 13, or under the age at which your country allows a child to consent to online services on their own, if that is higher. If you believe a child has created an account, write to us and we will delete it.

Security and transfers

The site is served only over HTTPS. Session cookies cannot be read by scripts, sign-in uses Google’s OAuth with PKCE, and we store no passwords. No system is perfectly secure, but we take reasonable care to protect what we hold.

Our servers and providers, Google included, may process data outside your country. Where they do, we rely on the safeguards those providers offer for international transfers.

Changes to this policy

When this policy changes, the date at the top changes with it. If a change matters for how your data is used, we will say so on the site before it applies.