PINKAS
Privacy
A family archive only works if the family trusts it. This page says plainly what we hold and what you can do about it.
Draft pending legal review. This document states our intended policy in plain language and has not yet been reviewed by counsel. It is not the final notice.
What we collect
Your email address, so you can sign in and be reached about your account. There is no password to store because sign-in uses a one-time link.
Whatever your family chooses to put in: stories, names and dates of relatives, photographs, audio recordings, recipes, gatherings, and interview answers.
When enabled for a gathering, a guest may optionally provide dietary, allergy, or accessibility details. Those fields are envelope-encrypted and kept separate from ordinary family archive exports.
Operational records we need to run the service safely: audit entries of who did what in a family space, delivery outcomes for the emails we send you, and error logs.
Why we are allowed to hold it
To provide the service you asked for, and for the legitimate interest of keeping it secure and working. Where the law requires consent, we ask for it.
We do not sell your data, we do not use it for advertising, and we do not use your family's content to train models.
Who can see it
Only the members and guests your family invited. A guest link is scoped to one gathering or one collection and expires.
Dietary, allergy, and accessibility details are visible only to family editors and administrators. An organizer can make a separate audited CSV export when it is needed to plan the gathering.
Our staff do not read your family's content in the normal course of running the service. Where an operator has to act on an account, the action is written to an audit record with a stated reason.
How long we keep it
Your family's record is kept for as long as your family space exists. Data exports are held for seven days and then deleted automatically. Sign-in links expire in minutes. Guest links expire on the schedule the family sets.
Guest contact information, RSVP messages, and encrypted dietary, allergy, and accessibility details are irreversibly removed no later than 90 days after the gathering ends (or after the link expires when no end date was set). Aggregate attendance may remain.
Backups are kept on a rotating schedule for disaster recovery, so a deletion works through them as they cycle rather than instantly.
Your rights over it
You can export your family archive, at any time, for free, from your account or family settings. To protect guests, the general archive excludes guest email addresses, RSVP messages, and encrypted dietary, allergy, and accessibility details. Family organizers can make a separate audited guest-needs CSV while those details are retained.
You can delete your account or an entire family space from within the app. Before deleting an account, you must transfer or delete any family spaces you own, and you choose whether files you contributed remain in each family archive or are permanently removed. A family-space deletion removes its records and stored files; it is not a hide.
You can ask us to correct anything wrong, and you can object to processing. Depending on where you live you may also have a right to complain to a data protection authority.
Children and consent
PINKAS is meant to be used by families, and families include children. An adult member who invites a child is responsible for that consent.
Please do not record or photograph a person, of any age, who has not agreed to it. Interview and documentary features carry an explicit consent state for exactly this reason.
Who else handles it
Running the service means a small number of providers process data on our behalf. Each is used for one job:
- Database and application hosting. Stores your family's records and account data.
- Private object storage. Stores photographs, audio, and documents as private objects. Files are never publicly readable; the app hands out short-lived links only to members.
- Transactional email provider. Sends sign-in links, invitations, calendar reminders, and RSVP invitations. Receives delivery and bounce notices back.
- Payment provider. Takes payment and holds card details. We receive only the result of a payment, never the card itself.
- Malware scanning. Scans every uploaded file for malware before anyone can open it.
- Jewish calendar data. Supplies Jewish holiday dates for the calendar. We send it a year and a schedule choice, never anything about you or your family.