Privacy Policy

This Privacy Policy explains how Cuanto Labs LLC, a Florida limited liability company ("Cuanto Labs LLC", "we", "us" or "our") collects, uses, shares and protects personal information when you visit https://zmanym.com, use Zmanim (the "Service") or otherwise interact with us. It also explains the rights and choices you have.

For personal information we collect to run our own business, such as account, billing and website data, we are the "controller" (or "business") responsible for it. When a business customer uses the Service to process information about its own users, customers or contacts, that customer is the controller and we process the information on its behalf, as explained in the section on customer data below.

This policy does not cover third-party websites or services that you reach through links in the Service. Their own privacy policies apply.

Zmanim is a Shabbat and daily zmanim utility for the web, iPhone and Android. The mobile apps have no accounts, no advertising and no third-party analytics or advertising SDKs. They call our own API to look up Times for a location and send a small, anonymous usage count to our own analytics server. The website works without an account too. Accounts exist for shuls that run a Zmanim page and for people who want saved preferences, and paid shul plans are billed through Stripe.

• We do not sell your personal information, and we do not share it for targeted advertising.
• We do not keep a history of your location, and we never attach your coordinates to analytics.
• We do not require a phone number for anything.
• We do not show ads or use ad-network trackers in the apps, on the website or in the API.
• We do not use your information to train artificial intelligence models.

We built Zmanim after watching other zmanim apps demand a phone number to show a candle lighting time or fill the screen with ads. This policy describes what the product actually does. If that changes, we will update this policy first, and for material changes we will also say so in the app's release notes.

We collect personal information in three ways: you give it to us, it is collected automatically when you use the Service, and we receive it from third parties. The table below lists the categories we collect, where they come from and why we use them.

You do not have to give us personal information, but some of it is needed to create an account and provide the Service. If you choose not to provide it, some features may not be available to you.

Times depend on where you are, so Zmanim needs a location. You can always type a city or ZIP code instead of sharing your device's location.

• Permission. The iPhone app asks for location access "While Using the App" only, and the Android app asks for approximate or precise location while you use it, whichever you allow. Neither app uses your location in the background, and you can withdraw permission at any time in your device settings.
• What we do with it. When the app or website uses your device's location, it sends the coordinates to our API once to find your city, its Times and nearby shuls. We use them in memory to answer that request. We do not save them to a database, link them to an account or device identifier, or attach them to analytics events. Like any web request, a lookup may appear briefly in our hosting provider's operational logs, which are kept for a short period for security and troubleshooting.
• On your device. The location the app uses for Times, your reminder settings and any family dates you add (such as a yahrzeit, Hebrew birthday or anniversary, with the names you enter) are stored on your device and are never sent to us.
• Reminder emails. If you sign up for reminder emails, we store the city you chose with your email address so we can send the right Times.

We use personal information to:

• create and manage your account, and provide the features you ask for;
• process payments, send receipts and manage subscriptions;
• send service messages, such as security alerts, account notices and changes to our terms, which you cannot opt out of while you have an account;
• respond to your requests and provide customer support;
• keep the Service secure, including detecting, investigating and preventing fraud, abuse, spam and security incidents;
• understand how the Service is used, fix problems and improve and develop features;
• send product updates and marketing, where the law allows and subject to your choices; and
• comply with legal obligations, enforce our terms and protect our rights and the rights of others.

Legal bases (EEA and UK)

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases under the GDPR and UK GDPR:

• Contract: to provide the Service you signed up for and manage your account.
• Legitimate interests: to secure, support, understand and improve the Service, and to send business-to-business marketing. We balance these interests against your rights, and you can object at any time.
• Consent: for non-essential cookies, marketing emails where consent is required. You can withdraw consent at any time without affecting processing that already took place.
• Legal obligation: to keep tax and accounting records and respond to lawful requests.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you.

Our business customers use the Service to store and process information about their own employees, customers and contacts ("Customer Data"). For Customer Data, the business customer is the controller and we are its processor or service provider. We process Customer Data only on the customer's instructions, as set out in our agreement with them and our Data Processing Addendum, and not for our own purposes.

The customer's own privacy policy governs how it uses Customer Data. If your information has been added to the Service by one of our customers and you want to exercise your privacy rights, please contact that customer directly. If you contact us, we will forward your request to the customer and help them respond.

When you subscribe to reminders on a shul's page, or a shul adds you to its list, we store your email address, the city and language you chose and, for browser notifications, your push subscription, on behalf of that shul. The shul's administrators can see and manage the subscribers of their own shul and no other. If you receive a member code from your shul, the shul decides who receives one.

For this information, the shul is the controller and we are its processor. We use it only to send the reminders and messages the shul's settings call for, keep it secure, and do not use it for our own marketing or sell it. You can unsubscribe at any time with the link in any email. For other requests, contact your shul or write to us at support@zmanym.com and we will pass your request on and help the shul respond.

Our mobile apps ask for your permission before accessing device features. You can change permissions at any time in your device settings.

• Precise location: if you allow it, we use your device's precise location only to provide the features that need it, while you are using them. Precise geolocation is sensitive personal information under several U.S. state laws, and we do not sell or share it.
• Device information: we collect your device model, operating system version, app version and crash reports to support and improve the apps.

Mobile apps

• No account or identifier. The apps do not create an account, a user ID or a device identifier, and they do not access your device's advertising identifier.
• Anonymous usage events. The apps send events to OnyxMetric, an analytics service run by Cuanto Labs LLC itself, not by a third party. An app launch reports the app version, operating system version and device model. Finishing first-launch setup reports your setup answers (how you read Hebrew, what you use the app for, your prayer language and whether you turned reminders on). Other events record, for example, that you opened or shared the weekly Shabbat card (its style and the app you shared it to, never the city or Times on it), started a Lock Screen countdown, asked Siri or Google Assistant one of the app's questions (which question, never the answer, city or Times), or added a family date (its type only). When the app asks our API for Times, our server records a similar event describing the kind of request, with your IP address and browser-style user agent so that OnyxMetric can estimate your approximate region. These events contain no name, account, device identifier, advertising identifier or coordinates, are not linked to you, are never used to track you across apps or websites, and are never shared.
• Crash reports. If an app crashes or hangs, it sends an anonymous technical report (the app version, device model and the code location of the failure) to OnyxMetric the next time it opens. If you have chosen to share analytics with Apple or Google, they may also share crash data with us under their own policies.
• Reminders. Reminders in the apps are scheduled by the app on your device using its operating system's local notifications. We do not collect a push notification token from the apps.
• Calendar. If you ask the app to add Times to your calendar, it writes those events to the calendar you choose on your device. Your calendar is not sent to us.

Website

• Rate limiting. We use your IP address briefly, for a window of minutes, to limit how many requests each address can make to our public API. This protects the service from abuse.
• Anonymous counters. We count which ZIP codes and cities are searched and measure API speed and cache performance, grouped by day, with no IP address or account attached. We use this to decide which places to add data for and to catch slowdowns.
• Website analytics. Our website loads the OnyxMetric script, run by Cuanto Labs LLC, to count page views. We do not use Google Analytics, advertising pixels or social media trackers.
• Error monitoring. We use Sentry to find and fix errors on the website. When an error occurs, and for about 1 in 100 visits, Sentry records a replay of the page interaction to help us reproduce the problem. Replays are set to mask the text on the page and anything you type, and to block images.
• Web push. If you turn on browser notifications, your browser gives us a push subscription (an address at your browser maker's push service, such as Apple, Google or Mozilla, and encryption keys). We store it to send the reminders you asked for, and the notification passes through that push service. Turn notifications off in your browser at any time and we stop.

We use cookies and similar technologies, such as local storage, to keep you signed in, remember your preferences, secure the Service and, where permitted, understand how it is used. Our Cookie Policy lists each one and explains how to control them.

We treat a Global Privacy Control (GPC) signal from your browser as a valid request to opt out of the sale or sharing of your personal information for that browser and, if you are signed in, for your account. Because we do not sell or share personal information, the signal has no further effect, but we honor it all the same. There is no common standard for "Do Not Track" browser signals, so we do not respond to them.

We share personal information only as follows:

• Service providers (sub-processors). Companies that host, secure, support and operate the Service for us, under contracts that limit their use of the information to providing services to us. The current list, with each provider's purpose and location, is on our Sub-processors page. They currently include Vercel, Neon, Upstash, Amazon Web Services (Amazon SES), Sentry and Stripe.
• Your organization. If you use the Service through a workspace managed by your employer or another organization, its administrators can access information about your use of that workspace.
• At your direction. When you connect an integration, share content or ask us to share information with someone.
• Legal and safety. When we believe in good faith that disclosure is needed to comply with law, a court order or a valid legal process, to enforce our terms, or to protect the rights, property or safety of our users, the public or us. Where permitted, we tell affected users about government requests before disclosing.
• Business transfers. As part of a merger, acquisition, financing or sale of assets, subject to this policy. We will notify you before your information becomes subject to a different privacy policy.
• Professional advisers. Lawyers, auditors and insurers, under duties of confidentiality.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we have not done so in the past 12 months.

We are based in the United States, and we and our service providers process personal information there and in other countries whose data protection laws may differ from yours. When we transfer personal information out of the European Economic Area, the United Kingdom or Switzerland, we rely on an adequacy decision (including the EU-U.S. Data Privacy Framework where the recipient is certified) or on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with additional safeguards where appropriate. You can ask for a copy of the relevant safeguards by contacting support@zmanym.com.

We keep personal information for as long as we need it for the purposes described in this policy, then delete or anonymize it. How long that is depends on the type of information and why we have it:

Deleted information may remain in encrypted backups for a short time until those backups are overwritten. We may keep information longer when the law requires it or to resolve a dispute, and only for as long as needed.

We protect personal information with administrative, technical and physical safeguards appropriate to its sensitivity, including encryption in transit (TLS) and at rest, least-privilege access controls, multi-factor authentication for staff, logging and monitoring, and vendor security reviews. No system is perfectly secure, and we cannot guarantee absolute security.

If a data breach affects your personal information, we will notify you and the relevant authorities as the law requires. To report a vulnerability, contact support@zmanym.com.

Wherever you live, you can:

• access and update most account information in your account settings;
• ask for a copy of your personal information in a portable format;
• ask us to correct inaccurate information;
• ask us to delete your personal information, subject to legal exceptions; and
• unsubscribe from marketing emails using the link in any of them. We will still send service messages.

To make a request, email support@zmanym.com from the address on your account, or use the tools in your account settings. We will verify your identity before acting, usually by confirming control of your account email, and may ask for more information if needed. We respond within 30 days and will tell you if we need more time, as the law allows. Requests are free unless they are manifestly unfounded or excessive. We will not discriminate against you for exercising your rights.

If the GDPR, UK GDPR or Swiss data protection law applies to you, you also have the right to object to processing based on our legitimate interests (and an absolute right to object to direct marketing), to ask us to restrict processing, to data portability, and to withdraw consent at any time.

You can lodge a complaint with your local data protection authority. In the UK, that is the Information Commissioner's Office. We would appreciate the chance to address your concern first, so please contact us at support@zmanym.com.

Privacy laws in California (CCPA, as amended by the CPRA), Florida (the Florida Digital Bill of Rights), Colorado, Connecticut, Virginia, Texas, Oregon and other states give their residents specific rights. We extend these rights to all of our users in the United States, whether or not their state's law applies to us.

Notice at collection

In the past 12 months we have collected these categories of personal information: Account information, Shul page content, Reminder subscriptions, Location, Billing information, Usage and device data and Communications. We collect them from the sources and for the business purposes described in the "Information we collect" section, keep them for the periods in the "How long we keep information" section, and disclose them for business purposes to the service providers described in "How we share information".

We do not sell or share personal information, including that of consumers under 16. We use sensitive personal information (such as account login credentials and, with your permission, precise location) only for purposes permitted by law, such as providing the Service you asked for, and not to infer characteristics about you.

Your rights

• Know and access: the categories and specific pieces of personal information we hold about you, the sources, our purposes, and the categories of third parties we disclose it to.
• Delete and correct your personal information.
• Portability: receive your information in a portable, readily usable format.
• Opt out of the sale of personal information, of sharing for targeted advertising, and of profiling in furtherance of decisions with legal or similarly significant effects. Use Global Privacy Control or email support@zmanym.com.
• Limit the use of sensitive personal information to permitted purposes.
• Non-discrimination: we will not deny you service, charge you a different price or give you a lower quality of service for exercising your rights.

How to make a request

Email support@zmanym.com with the subject line "Privacy request". You can also have an authorized agent make a request for you; we will ask the agent for proof of your signed permission and may ask you to verify your identity directly. We respond within 30 days, as required by law.

Appeals

If we decline your request, you can appeal by replying to our decision or emailing support@zmanym.com with the subject line "Privacy appeal". We will respond in writing within 60 days, explaining our decision. If you are not satisfied, you may contact your state attorney general.

California "Shine the Light"

California residents may ask once a year whether we disclosed personal information to third parties for their direct marketing purposes. We do not do so.

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will delete it promptly. If you believe a child has given us personal information, contact support@zmanym.com.

We may send you emails about new features, events and offers. Each marketing email identifies us, includes our postal address and contains an unsubscribe link. We process unsubscribe requests within 10 business days, and you will still receive service messages about your account. Where the law requires your consent to send marketing, such as in the EEA and UK, we ask for it first.

We may update this policy from time to time. If we make a material change, we will notify you by email or in the Service before it takes effect and update the "Last updated" date above. If a change means we will use personal information we already hold in a materially different way, we will ask for your consent where the law requires it. Previous versions are listed on our legal center.

For questions about this policy or to exercise your rights, email support@zmanym.com or write to Cuanto Labs LLC, Attn: Privacy, 1314 E Las Olas Blvd, Unit #2570, Fort Lauderdale, FL 33301, USA.