Privacy

Your phone number and any email address you provide, so you can verify your identity, sign in, and receive account messages. You can use a one-time code, an email link, or Google sign-in.

Whatever your family chooses to put in: stories, names and dates of relatives, photographs, audio recordings, recipes, gatherings, and interview answers.

When enabled for a gathering, a guest may optionally provide dietary, allergy, or accessibility details. Those fields are envelope-encrypted and kept separate from ordinary family archive exports.

Operational records we need to run the service safely: audit entries of who did what in a family space, delivery outcomes for the emails we send you, and error logs.

A public contact message is delivered to our operator mailbox through our transactional email provider. Pinkas does not add it to a family archive or save it as an in-app support record, but the email provider and operator mailbox retain the correspondence under their ordinary retention settings.

When you choose Google sign-in, Pinkas uses your Google account identifier, verified email address, and name to sign you in or connect Google to your existing Pinkas account. Signing in does not give Pinkas access to your Google Calendar or Drive files.

Connecting Google Calendar is a separate choice. Pinkas creates a dedicated Pinkas Family Calendar and reads your calendar list to find that destination. It sends only the Pinkas family events you can access and the event types you select. Google and anyone with access to that Google calendar can see those copies.

Pinkas keeps the connected account address, destination calendar identifier, event mappings, and limited synchronization information. It reads Google event identifiers, status, and version information to keep exported events up to date; it does not import your unrelated personal events or use Google edits to change your family's Pinkas records. Credentials for background updates are encrypted on Pinkas servers and are never sent to your browser.

You can disconnect in Calendar settings. This stops updates and removes the saved connection credentials without disabling Google sign-in. You can also choose to remove the exported Pinkas events; unrelated Google events are left alone. Copies you keep in Google remain subject to Google's retention and sharing settings. You can separately remove Pinkas access in your Google account settings.

When you choose a photograph through the Google Drive picker, Pinkas accesses only the files you select for the requested import. It does not browse or copy the rest of your Drive. Google data is used only for the feature you request, not for advertising, sale, or training models.

To provide the service you asked for, and for the legitimate interest of keeping it secure and working. Where the law requires consent, we ask for it.

We do not sell your data, we do not use it for advertising, and we do not use your family's content to train models.

Only the members and guests your family invited. A guest link is scoped to one gathering or one collection and expires.

Dietary, allergy, and accessibility details are visible only to family editors and administrators. An organizer can make a separate audited CSV export when it is needed to plan the gathering.

Our staff do not read your family's content in the normal course of running the service. Where an operator has to act on an account, the action is written to an audit record with a stated reason.

Your family's record is kept for as long as your family space exists. Data exports are held for seven days and then deleted automatically. Sign-in links expire in minutes. Guest links expire on the schedule the family sets.

Guest contact information, RSVP messages, and encrypted dietary, allergy, and accessibility details are irreversibly removed no later than 90 days after the gathering ends (or after the link expires when no end date was set). Aggregate attendance may remain.

Backups are kept on a rotating schedule for disaster recovery, so a deletion works through them as they cycle rather than instantly.

You can export your family archive, at any time, for free, from your account or family settings. To protect guests, the general archive excludes guest email addresses, RSVP messages, and encrypted dietary, allergy, and accessibility details. Family organizers can make a separate audited guest-needs CSV while those details are retained.

You can delete your account or an entire family space from within the app. Before deleting an account, you must transfer or delete any family spaces you own, and you choose whether files you contributed remain in each family archive or are permanently removed. A family-space deletion removes its records and stored files; it is not a hide.

You can ask us to correct anything wrong, and you can object to processing. Depending on where you live you may also have a right to complain to a data protection authority.

Pinkas is meant to be used by families, and families include children. An adult member who invites a child is responsible for that consent.

Please do not record or photograph a person, of any age, who has not agreed to it. Interview and documentary features carry an explicit consent state for exactly this reason.

Running the service means a small number of providers process data on our behalf. Each is used for one job:

• Database and application hosting. Stores your family's records and account data.
• Private object storage. Stores photographs, audio, and documents as private objects. Access requires an authorized account or a scoped, expiring sharing link.
• Transactional email provider. Sends sign-in links, invitations, calendar reminders, RSVP invitations, and public contact messages. Receives delivery and bounce notices back.
• Payment provider. Takes payment and holds card details. We receive only the result of a payment, never the card itself.
• Phone verification and SMS provider. Verifies phone numbers during sign-in and sends SMS reminders when a recipient has opted in. The provider receives the destination phone number and message.
• Error tracking. Receives privacy-minimized operational errors without request data, user details, family content, or uploaded files.
• Malware scanning. Scans every uploaded file for malware before anyone can open it.
• Jewish calendar data. Supplies Jewish holiday dates and local religious times. Requests can include the configured location, year, and calendar conventions. We do not send names or family content.

Pinkas's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.