Privacy policy

Mazaaal is built to collect the bare minimum: an email address, a nickname, your study progress. No public leaderboard, no advertising, no trackers. This page sets out exactly what we do with your data.

Data controller: Mordehai LTDA (see the legal notice). Contact: contact@mazaaal.com.

As Mordehai LTDA is established outside the European Union, its representative in the Union within the meaning of Article 27 of the GDPR is Axel Mardoche Berdugo, established in France. You may contact him, as you may contact us, about anything concerning your data: contact@mazaaal.com.

What we collect

• Account: your email address and the nickname you choose. That is all we ask for. Signing in works through a link or a code sent by email: we store no password.
• Study progress: the lessons you have done, your answers to exercises and your reviews, so that your path follows you from one device to another.
• Subscription: if you subscribe on the website, payment is handled by Stripe. If you subscribe in the iOS application, it is an in-app purchase collected by Apple, whose status is reported to us by RevenueCat. In both cases, we never see or store your payment method; we keep only the status of your subscription and the billing references passed on to us.
• Newsletter: if you sign up, your email address, with an unsubscribe link in every message.
• Technical logs: like any server, ours records logs (IP address, pages requested) for security and diagnostics, kept only briefly.

What we do not do

• No trackers: no advertising cookies, no third-party analytics, no pixels. The site sets a single, strictly necessary cookie: the one for your sign-in session (duration: one year). That is why there is no cookie banner.
• No selling or commercial sharing of your data, to anyone.
• No profiling: your progress serves your revision, nothing else.

One piece of data we treat as sensitive

Using an app to study Judaism may suggest beliefs or a personal journey. We never ask where you stand or why you are studying, we infer nothing from your use, and we never disclose our list of users. This is a design commitment, not an option.

Where the data goes

• Hosting and database: Hetzner Online GmbH, servers in the European Union.
• Payments on the website: Stripe, which handles your payment data as a data controller for that operation.
• Purchases in the iOS application: Apple, which collects payment and invoices under its own terms, and RevenueCat, which reports to us the status of the subscription attached to your account.
• Emails: Resend, for sign-in emails and the newsletter.

Each of these providers is required to give your data protection that is equal or equivalent to the protection described in this policy. We pass on only what their role requires. Those acting on our behalf may not use it for anything else; Apple and Stripe, which answer for the payment operation themselves, apply their own terms, which are also subject to the GDPR.

Some of these providers process data outside the European Union; those transfers are covered by the mechanisms provided for in the GDPR (standard contractual clauses or an adequacy decision).

For how long

• Your account and your progress: for as long as your account exists.
• You can delete your account yourself. In the mobile app, deletion happens inside the app: after an on-screen confirmation, it is immediate and permanent. On the website, it is confirmed by a link sent to your email address. Either way, your account and progress data are erased.
• Billing references are kept for as long as accounting and tax obligations require.
• Technical logs are purged at short intervals.

Your rights

Under the GDPR (for people located in the European Union) and under the Brazilian LGPD, you may access your data, correct it, erase it, object to a processing operation, or request its restriction and portability. Write to contact@mazaaal.com: we answer as quickly as we can.

If you believe your rights are not being respected, you may lodge a complaint with the supervisory authority of your country of residence (in France: the CNIL, cnil.fr).

Changes

If this policy changes substantially, the new version will be published on this page with its update date.

Last updated: 26 August 2026.