Privacy and your choices

The Kosher operates this website, its iPhone and iPad app, and its WhatsApp assistant. Contact hello@thekosher.app about privacy, access, correction or deletion.

You can explore the public directory without an account. You can enter a city manually, decline device location, and browse without sending a question to an AI service. Account, notification and WhatsApp features are optional.

Information used to provide the service

• Account and preferences. Login identifiers, an optional name, saved places or trips, and the requirements you choose. Kashrus preferences can reveal religious observance; we treat them as personal information.
• Questions, documents and contributions. Questions and selected context are processed to answer you. Reviews, corrections, venue submissions and uploaded materials may be associated with your account. Material submitted for review stays subject to moderation; submission does not establish a verified fact.
• WhatsApp. When you message the assistant, WhatsApp provides your sender number, message identifier and content, including any voice message, image or location you choose to send. This occurs whether or not you linked a website account. We use this information to reply, maintain short conversation context and recover interrupted delivery.
• Location and travel. A permitted device location or a city, origin and destination you enter can be used for nearby search, maps or route planning. Requests and locally saved results can contain those places. We do not describe these records as anonymous location data.
• Device and service records. Authentication sessions, notification installations, delivery outcomes and request counters support sign-in, opt-outs, abuse prevention and reliability. Hashed phone or network identifiers are pseudonymous: they can remain linkable and are handled as personal information.

Travel documents and certificate photos

In the iPhone and iPad app, pasted travel-confirmation text and supported photo text recognition run on your device. Sending a PDF requires your consent for that file. On the website, pasted text, text files and supported PDF text layers are sent to our server. Vercel hosts that processing; Supabase verifies your account and records request limits. The travel reader does not send the document to an AI provider or save its raw contents in our database or application logs. Server-side parsing uses temporary memory, and only limited trip details are returned. Review dates, places and airport interpretations before using them. If you later save a trip, the details you choose become saved account content.

Certificate contributions use a separate workflow. A photo you submit, its source and validity details, and your account are stored privately for human review. Crop or permanently cover unnecessary names, signatures and other personal details before choosing a photo. Removing location metadata does not hide text visible in an image. Optional suggestions require separate consent to send that photo to OpenAI. Suggestions do not submit a contribution or establish certification. We request that the generated response not be stored for later retrieval; this does not establish zero provider retention. OpenAI may retain data under its security and abuse-monitoring rules. You can submit manually without using these suggestions.

Who processes it

Other visitors can see content you publish, such as a public review or shared list. Your account email, linked number and personal requirements are not published as part of a venue listing. Authorized administrators can access information needed for moderation, support and operating the service.

Service providers process the information needed for their functions: Supabase for database, account and file services; Vercel for web hosting; Meta/WhatsApp for messaging; Anthropic and OpenAI for supported AI search, planning, text or document extraction, with OpenAI also supporting voice transcription; Google for applicable places, geocoding and routing requests; OpenStreetMap and Nominatim for map tiles and place searches; Resend for applicable email delivery; and Expo, Apple or Google for notification delivery. Opening a map, directions or a booking site also shares the destination and ordinary connection information with that service.

AI and mapping requests may include personal information you put in your question or selected context. Our own cleanup windows do not establish a provider’s retention period or mean that a provider never receives identifying information. Providers may process data in other countries and retain records under their applicable terms and configuration.

When comparing walking routes for a plan change, we send the selected stops’ coordinates to Google Maps, including coordinates you entered for personal stops. This walking request does not include your account ID, private plan notes or venue labels. Google processes this information under the Google Privacy Policy. The comparison is temporary and is not saved as a new reservation or plan change.

Provider details: WhatsApp processing terms, Anthropic commercial retention, and OpenAI API data controls.

Retention and device storage

Optional product analytics records a random journey identifier and closed discovery stages after consent. A journey lasts up to two hours. Private journey receipts expire after 24 hours and are removed on the next successful hourly cleanup; an interrupted job can delay removal. Daily aggregate counts have a 90-day window. Collection pauses if retention cleanup is more than two hours overdue. An action count does not mean that you visited a venue or found a meal, and an unanswered feedback prompt is not recorded as success or failure.

With analytics consent, browser performance measurements record a short-lived document identifier, a metric value and a broad screen-size category. They exclude your question, page query, account identity and document contents. Individual measurement records have a 24-hour window and daily totals a 90-day window, followed by scheduled cleanup. Turning off analytics prevents new measurements; it does not itself erase records already sent.

Our scheduled cleanup policy retains structured assistant conversation context for 1 day, WhatsApp operational interaction records for 90 days, search records for 90 days, authenticated request counters for 30 days, and anonymous request counters for 7 days. Expired records are removed on the next successful daily cleanup; an interrupted job can delay removal.

Message content needed to retry an interrupted delivery is held separately from routine operational logs and cleared when delivery processing reaches a terminal state. Pending retries and provider records are not a promise of zero message retention.

Saved account content stays until you remove it or request account deletion, subject to necessary moderation history, security records and recovery backups. Our automatic database backups currently have a seven-day provider retention window. Separate encrypted recovery archives can remain longer. Protected deletion records remain available for every restorable copy so accepted deletions can be reapplied before a restored service reopens. Deleting an active record does not instantly erase every backup or a recipient’s copy of a shared item.

Native login tokens are held in the device’s secure storage. Private offline search and plan caches are scoped to the current account or guest session. Account changes revoke access to the previous cache; failed physical deletion is retried. If secure device storage cannot establish that boundary, private caching stays unavailable and the app offers a retry. Cached plans have a seven-day restore limit and are labeled as snapshots.

Access, correction and deletion

Use your profile to change your preferences. Signed-in users can download the available account export and request account deletion from account settings in the website or app. A failed or incomplete deletion requires retry or support; it is not reported as a completed deletion.

For records outside the self-service export, WhatsApp-only use, or an inaccessible account, contact hello@thekosher.app. We may need to verify control of the account or number before providing or deleting personal information. Linkable operational identifiers are included in this process; a hash alone does not remove your privacy rights.

Notifications, cookies and changes

Saved-place updates use your explicit saved-place category choice, device notification permission, saved places and the underlying change record. A notification can report that a public listing changed or was withdrawn; it does not establish certification or that a business closed. Private change details require the current account, device proof and saved-place category consent. Lock-screen messages omit venue names, religious requirements and travel details. Research-request updates and trip reminders require their own explicit choices; saved-place consent does not enroll you in those categories.

Enable notifications only if you want them. You can change preferences in the app and device settings, unlink WhatsApp, or stop using a channel. Lock-screen notification delivery also involves your device’s notification provider.

We use authentication cookies and local storage for requested features. We do not sell your personal preferences or use an advertising identifier to target ads in the app. Commercial destination links are labeled and any configured commercial relationship is disclosed alongside the action.

This page records the current policy and its update date. Material changes will be identified here and in relevant product notices.