Privacy policy

Last updated October 16, 2026

This Privacy Policy explains how Jewgo Card (“Jewgo Card,” “we,” “us,” or “our”), operated by Jewgo LLC, collects, uses, shares, and protects personal information when you use our website, mobile applications, and related services (the “Service”). By using the Service, you agree to the practices described here. If you do not agree, please do not use the Service.

1. Information we collect

Information you provide. When you create an account and build your profile, we collect:

Account information: your name and email address, used to create and secure your account. You may sign in with email and password or through Apple or Google sign-in (handled by our authentication provider).
Profile content: the information you choose to enter, which may include your display name, age, height, location, gender, marital status, community, religious background and outlook, languages, family information, education, occupation, current status and future plans, a personal description, interests, what you are looking for, and contact preferences. You may provide a birth year or a full birth date. If you provide a full birth date, we store it encrypted at rest and use it to display your age and, if you choose, birthday details, according to your profile and sharing settings.
Photos: images you upload to your profile. When you crop a photo in the app we also keep the uncropped original, privately and visible only to you, so you can re-crop it later. It is never part of a share link, PDF or public view, and it is deleted with the photo.
References and contacts: details you add about people you list as references, which may include their name, relationship to you, phone number, email address, and notes. You are responsible for having an appropriate basis to provide this information (see our Terms of Use).
Sharing details: information about the access links you create, such as a recipient label, a private note, the visibility setting, an optional expiration, and an optional PIN (which is stored only as a secure hash, never in readable form).
Support and communications: messages you send us through our contact form or by email.
Shadchan workspace content (historical). The shadchan workspace has been removed and no new records can be created in it. For accounts that used it before removal we still hold the working records written there: introductions tracked, dates scheduled, follow-up reminders, and private notes and labels about the people being worked with. These were, and remain, that author’s working records — never part of anyone’s card. See Section 7.

Information collected automatically. When someone opens one of your access links, we record limited activity so we can show you how your links are being used and protect the Service: a timestamp, a hashed (not raw) IP address, browser/user-agent type, and referrer. We also keep short-lived security and rate-limiting records, which are keyed the same way. In our own application records for link activity, rate limiting, and diagnostic reports, we store a hash of the IP address, not the raw address. This describes our application; it does not cover our hosting, content delivery, or network providers, who may separately log or process IP addresses under their own policies as an ordinary part of operating the infrastructure we run on. That hash is pseudonymous rather than anonymous: it is not reversible by an outsider, but we could match it against a known address. When someone opens your link, the app also records the kind of device they used (for example iPhone or Mac) and the general area their network is in (a city or region, such as “Brooklyn, NY”, or only the country), which our content delivery provider reports for the connection. It is never a street address or an exact location. You see these opens, with that area, in the app, and repeat opens from the same network show as reopens. The card page tells the person opening it that you can see this.

People who request access to a link. If someone opens one of your links after it has expired or been revoked and asks for access, we collect the name they give, an optional email address and message, and a hashed IP address. You see the name and message (stored encrypted). If they gave an email address, we email them your decision and, if you approve, a new link. These records are kept until you delete the link, your card, or your account.

Diagnostic reports. If the Service experiences an unexpected error, our apps may send a minimal diagnostic report to our error-reporting provider (PostHog): an error type, message, stack trace, the route or a short developer-written context tag, and the device model, operating system, and app version, not your profile, photos, or share links. PostHog sees the IP address the report is sent from, and our PostHog project is set to discard it rather than store it. Before a report leaves the device or server, we redact anything that looks like an email address, a run of phone-number digits, or a share-link token or URL from the message and stack trace. This reduces, but does not guarantee against, the message or stack trace itself containing something personal — for example if a future bug were to interpolate unexpected data into an error string. We do not use PostHog for advertising, behavioral analytics, session replay, or user identification.

We do not use advertising trackers or behavioral analytics (no session replay, no cross-site tracking, and no product-usage analytics).

2. Cookies and similar technologies

We use only strictly necessary cookies and browser storage: our sign-in session cookie (30 days); short-lived cookies that carry a sign-in attempt through Jewgo Account (minutes to 24 hours); a link-scoped cookie that confirms a viewer entered a correct PIN (30 minutes; it stores proof of access, not the PIN itself); a link-scoped cookie that stops one visit being counted as several views (30 minutes); and session-only browser storage that remembers a view was recorded or a banner was dismissed. We do not use advertising or behavioral-analytics cookies, and we do not track you across other websites.

3. How we use information

To provide, maintain, and operate the Service and your account.
To enable the private sharing you initiate through access links.
To send account- and service-related emails (such as a welcome message, link-expiry reminders, and access-request alerts).
To secure the Service, prevent abuse, enforce limits, and maintain audit records.
To respond to your requests and provide support.
To help you prefill your card when you choose to import from a PDF (see below).
To comply with legal obligations and enforce our Terms of Use.

Where the EU/UK General Data Protection Regulation (GDPR) applies, we rely on the following legal bases: performance of a contract (to provide the Service you sign up for); legitimate interests (to secure the Service and prevent abuse); and consent where specifically requested. We do not ask for health information in any structured profile field, and we do not engage in automated decision-making that produces legal effects. You could still choose to include health-related information yourself in a free-text field, such as About Me — if you do, we process it the same way as the rest of your profile content.

Your profile may include information that reveals religious beliefs, which is special-category personal data under the GDPR and UK GDPR. We process that information only to provide the private profile and sharing features you choose, and only where a valid Article 9 condition applies. We do not treat private sharing with selected recipients as making your information public.

4. How we share information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising or cross-app tracking. We share information only as follows:

Service providers (subprocessors) who process data on our behalf under contract and only as needed to operate the Service:
- Jewgo Account for identity and authentication (email, name, user ID; Apple and Google sign-in). It is the shared sign-in used across Jewgo products, so the same account may also be used elsewhere. If you ask Jewgo Account for a copy of your data, we send it a copy of your Jewgo Card data (profile, references, contacts, photos, and links) to include in that export.
- Resend for transactional email: welcome and account messages, link-expiry reminders, access-request alerts, and the decision we send to someone who requested access to a link.
- Kinescope for DRM-protected profile video hosting. For links that use Premium’s Privacy view, rendered images of your card pages and photos are uploaded to Kinescope as protected video, and deleted when that link’s video is removed.
- PostHog for anonymous error and crash reporting only (see “Diagnostic reports” above).
- Google Firebase Cloud Messaging to deliver push notifications to your device if you use the mobile app and allow notifications. The notification text can include a link recipient’s or access requester’s name (for example, “Someone opened your Jewgo Card”); your profile content is not sent to Firebase. You can turn push notifications off in the app, and disable individual alert types.
- Cloud backup provider (Cloudflare R2 or Backblaze B2) for off-site backups. The off-site copy is encrypted before it leaves our infrastructure when our offsite-encryption option is enabled (see Section 8).
Profile content and photos are stored on our own infrastructure, except the protected video copies held by Kinescope described above.
Payment processors if you purchase the optional Premium subscription or make a donation: Stripe (web subscription payments and card donations), PayPal (web donations), and Apple App Store / Google Play with RevenueCat (in-app purchases). They receive what is needed to process the payment. We never receive or store your card details, only your subscription status.
People you choose when you create and send an access link, limited to the fields and photos that link permits.
A shadchan you authorized to help manage your card, while that feature existed. It has been removed and no new authorization can be granted; Section 7 explains what this means for links created before the removal.
Legal and safety reasons: to comply with law, respond to lawful requests, or protect the rights, safety, and security of our users, the public, or Jewgo Card.
Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this Policy.

5. How we protect your information

Security is foundational to the Service. We encrypt sensitive profile content, references, your account email, and your photos at rest using AES-256-GCM, and we protect data in transit with TLS (HTTPS), enforced by HSTS. Our staff cannot read your personal information in our internal tools, which operate on identifiers only. Profile videos are protected with industry-standard DRM and a per-link watermark. Access links use unguessable tokens, can be PIN-protected (the PIN is hashed), and are rate-limited against guessing. Our databases and file storage are isolated from the public internet.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Our encryption uses keys we manage so we can operate the Service (for example, to render and serve your content). It is strong encryption at rest and in transit, but it is not end-to-end encryption.

PDF import. When you choose to import from a PDF, we extract text on our servers using local rule-based parsing only — no AI model is involved. We do not retain the uploaded PDF after processing.

Older app versions. App versions up to 1.1.1 also offered a ChatGPT or Claude paste import and an on-device guided interview. Both have been removed. With the paste import, your content went to the AI service you chose under its own privacy policy, and we only received what you pasted back; the guided interview ran on your phone and sent nothing to us or to any third party.

6. Sharing links: an important limitation

Revoking or expiring a link stops new visits and new photo loads. It cannot delete information a viewer has already opened, downloaded, screenshotted, or forwarded.

Please share only what you are comfortable being seen, and only with people you trust. Access links are served privately and are not indexed by search engines.

7. Shadchanim you authorized

Jewgo Card used to let you grant a shadchan (a matchmaker) permission to create and revoke access links on your card, and gave that shadchan a private workspace for their own working records. That feature has been removed. No new grant can be made, no shadchan has access to any card through it, and the workspace is gone.

Links created before the removal are still yours. A link a shadchan created on your card belongs to you and keeps working until it expires or you revoke it. You can see every one of them, and revoke any of them, from your list of links (the Access tab in the app) — the same as a link you created yourself.

Records created before the removal are still covered by your rights. Working records a shadchan kept about you were never shown to you and are no longer shown to anyone. They are still deleted when you delete your card or your account (Section 8), and a formal request about them is answered as described in Section 9.

8. Data retention

We keep your profile and photos until you delete them, and your account information until you delete your account. Deleting your Jewgo Card account does not delete your Jewgo Account sign-in (email and name), which you may use in other Jewgo products; you can manage or delete it at Jewgo Account. Beyond that, specific data types are kept only as long as stated here, then deleted automatically:

Link view activity (who opened your link, when, a hashed IP address, browser/user-agent type, referrer, general area): kept 90 days, then deleted.
Protected-video view records (playback activity for Premium’s Privacy-view video links, used to show you view counts and to measure hosting cost): kept 90 days, then deleted. Monthly cost summaries derived from them are kept separately and contain no viewer data.
In-app notification records (the entries behind your activity feed): kept 90 days, then deleted. Dismissing a notification hides it immediately and does not wait for this. The record that you dismissed it is kept until you delete your account.
Sign-in sessions: expire automatically 30 days after you sign in, and are removed from our database shortly after expiring. Signing out revokes a session immediately; its row is removed within 30 days of that.
Share links: an active link is kept until it expires, you revoke it, or you delete it. A revoked link is kept — so you can still see in Settings that it was revoked and by whom — until you delete it yourself; revoking never auto-deletes it. An expired link that was never revoked is deleted automatically 90 days after it expired, taking its view-activity and internal audit records with it.
Push-notification device tokens: disabled immediately if delivery fails (for example, the app was uninstalled or reinstalled), and deleted when you sign out on that device or delete your account.
Administrative audit logs (records of actions our own administrators took, such as responding to a support or safety report): record the administrator, the action, and the type and ID of the record it concerned (for example, a user account, a profile, or a share link), and are kept indefinitely, including after account deletion — this is our internal accountability record of what our team did, and it has to outlive the account it may concern so we can answer for it later. See our Delete your account page for how this fits into what deleting your account removes.

Rate-limiting security records are pruned automatically. When you delete a profile or account, we revoke sign-in and every share link immediately, then delete the associated records and submit deletion requests for stored photos and videos, which are normally completed shortly after. Revoking a link does not erase a copy a recipient already saved, downloaded, or screenshotted while the link was active. Residual copies may remain in our backups until they are rotated out under our backup retention schedule. Backup storage is access-restricted, and the off-site backup copy is encrypted before it leaves our infrastructure when our offsite-encryption option is enabled.

Analytics. Our error-reporting provider (PostHog — see “Diagnostic reports” above) never receives your name or email: our apps never call PostHog’s identify function, and person profiles stay off, so no PostHog person profile is created for you at all. Each report still carries an anonymous, pseudonymous distinct ID — generated by PostHog’s mobile SDK for app reports, and a shared synthetic ID for reports from our servers — which lets PostHog group repeated occurrences of the same error without identifying who hit it. There is nothing tied to your identity there to delete on request; deleting your account does not change this. PostHog retains these events under our PostHog project’s configured retention settings.

Shadchan workspace records. The shadchan workspace has been removed (Section 7). Records created in it before the removal are kept until the account that wrote them is deleted, at which point they are deleted with the rest of that account’s data.

Deleting your card also deletes what a shadchan wrote about you. If you delete your card or your account, we do not merely end any shadchan’s access — we delete the introductions, reminders, and private notes they recorded about you, along with the grant itself. Where you appeared as the other side of an introduction that belongs to a different person, we remove the reference to you and leave that person’s own record intact. So the one thing you cannot read, you can still erase.

9. Your privacy rights

Depending on where you live, you may have some or all of the following rights. We will respond to verified requests as required by applicable law and will not discriminate against you for exercising them.

EEA/UK (GDPR). You have the right to access, correct, delete, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent where processing is based on consent. You may also lodge a complaint with your local supervisory authority. We aim to respond within one month.

California (CCPA/CPRA). You have the right to know and access the personal information we hold about you, to request its deletion, to correct inaccurate information, and to limit the use of sensitive personal information. We do not sell or share personal information, so no opt-out of sale/sharing is required. We aim to respond within 45 days.

You can exercise many of these rights directly: edit your profile at any time; download a machine-readable copy (JSON) of your account, profile, references, contacts, photos, and share links from Settings in the app or on shidduchcard.com; and delete your profile or entire account from Settings. Premium subscribers can also export a PDF of their card. For other requests, contact us using the details in Section 13. We may need to verify your identity before acting on a request.

Appeals. If we deny all or part of your privacy request, you may appeal by replying to our decision or emailing privacy@jewgo.app with the subject “Privacy Request Appeal.” We will review the appeal and respond within the time required by applicable law. If we deny your appeal, we will explain how to contact the appropriate regulator.

10. International data transfers

We and our service providers process and store your information primarily in the United States (US East). Some subprocessors may also process data in other countries, which may have different data-protection laws than your own. Where required, we rely on appropriate safeguards, such as Standard Contractual Clauses, for international transfers.

11. Children’s privacy

The Service is intended for adults and is not directed to anyone under 18. The current web app and the current mobile app ask you to confirm that you are 18 or older before you can accept our Terms of Use (on the web by checking a box; in the mobile app, tapping “Agree and continue” states that confirmation), and we record that confirmation together with your acceptance. An older, already-installed version of the mobile app built before this confirmation existed may accept the Terms without sending it — but every account, on every app version, remains subject to the 18-or-older eligibility requirement in our Terms of Use. We do not knowingly collect personal information from anyone under 18. If we learn that an account belongs to someone under 18 — including if you tell us — we will disable the account and delete its Jewgo Card data, subject to the retention described in Section 8.

12. Changes to this Policy

We may update this Privacy Policy from time to time. Every change updates the “Last updated” date above. This Policy is accepted together with our Terms of Use, and changes to it follow the same gate described in Terms of Use §18: where a change is material, we give advance notice and update the version you must accept, and the app and website will ask you to review and accept the current Policy before you can keep using the Service. Where a change is not material — such as a clarification that does not change how we handle your information — no re-acceptance is required, and continued use of the Service after the update means you accept the revised Policy. This Policy describes our data practices; it does not replace any consent choice required by law.

13. Contact us

For privacy questions or to exercise your rights, contact us at privacy@jewgo.app or through our contact page. For other questions, contact support@jewgo.app.

Our operating entity is Jewgo LLC, 20401 Northwest 7th Court, Miami Gardens, FL 33169, USA.