Privacy Policy
Version 3.0 · Last Updated: August 15, 2026 · Effective: August 15, 2026
1. Who We Are (Data Controller)
This Privacy Policy describes how 90 Minutes a Week ("we," "us," "our") collects, uses, discloses, and safeguards your personal information when you use our websites, mobile applications (I'm Home, Shuffle Date, Shalema, LoveSync), guided audio sessions, and reflection workbooks (together, the "Services").
The data controller responsible for your personal information under the Israeli Protection of Privacy Law, 5741-1981 ("PPL") and (where applicable) the EU General Data Protection Regulation 2016/679 ("GDPR") is:
Jacob Lipsky, founder of 90 Minutes a Week (operating as a sole individual; Israeli business registration pending)
Address: [TO BE FILLED — registered Israeli address]
Email: jacoblipsky@90minutes-a-week.com
Phone: [TO BE FILLED]
Business ID: Not yet registered with Israeli authorities — this notice will be updated once registration is complete.
2. What Personal Information We Collect
2.1 Information you give us directly
- Account & profile data: name, email address, authentication credentials, optional profile details about you and your relationship (used inside our mobile apps).
- Lead-magnet email signups: when you request a free workbook from one of our landing pages, we store your email address and the page you signed up from in our mailing list (Firestore collection
mailing_list). - Waiting-list signups: when you join the LoveSync waiting list, we store your email address.
- Contact form submissions: name, email, and the message you send us. (The website's contact form opens your email client to send the message directly to us; we receive whatever you submit.)
- User content inside apps: answers to questionnaires, journal entries, conversation prompts and reflections you create.
- Voice recordings (Shalema): the voice notes you record for your future self. These are audio recordings of you. They are stored on your device by default and are only uploaded if you turn on backup or sync, or explicitly choose to share one.
- AI companion conversations (Shalema, opt-in): if you turn on the optional reflective companion, the journal text or prompt you submit and the companion's replies are processed as described in §4.
- Date-planning inputs (Shuffle Date): the location you enter or allow the app to read, your budget range, your mood/energy selection, the categories you spin, and the ratings and preferences you give after a date, which the app uses to tailor later suggestions.
- Daily check-in history (I'm Home): your answers to the daily reconnection prompts, kept as your relationship timeline.
- Partner pairing data (LoveSync): the connection code you generate or enter, the identity of the partner account you link to, your shared reminders, and your readiness responses (accept / counter-propose / decline).
- Referral codes: if you enter an affiliate or partner discount code, we record that code against your app user ID so the correct price applies and the referring partner is credited.
- Affiliate partner details: if you join our affiliate program, we collect your name, email address, payout currency, payout instructions, and the commission records generated by referrals you make.
- Purchase information: when you buy a guided experience, our payment processor (see §5) collects the data needed to process your card. We do not receive or store full card numbers.
2.2 Information we collect automatically
- Usage / analytics data (only if you accept analytics cookies): pages viewed, buttons clicked, scroll depth, session duration, audio play/pause events, language toggled.
- Device / log data: device type and OS, browser type and version, approximate location (country/region — derived from IP), timestamp, referring URL.
- Cookies and similar storage: see our Cookie Policy. Essential storage is used to remember your language and consent choice; analytics storage is only set with your consent.
2.3 Information from third parties
If you reach us through a Meta (Facebook/Instagram) ad and interact with a ManyChat conversational flow, Meta and ManyChat may share certain attributes with us (the ad you clicked, your messaging-app handle, the answers you gave the bot). We import only the information necessary to follow up on your request.
Apple and Google Play send us purchase, subscription, renewal, and refund events for our apps so that we can provide the features you paid for, keep your entitlement accurate, and calculate affiliate commissions.
2.4 Sensitive information
Our apps are about relationships, feelings, and self-reflection. That means the free-text you write — journal entries, check-in answers, reflections, companion conversations — can contain information that privacy law treats as sensitive: information about your health or mental state, your relationship and sex life, your religious or philosophical views, or details about your partner.
- We do not ask for this information and we do not analyse it to categorise you. It reaches us only because you chose to write it.
- Where the GDPR applies, our legal basis for processing special-category data under Art. 9 is your explicit consent (Art. 9(2)(a)), given when you create the content or when you switch on an optional feature. You can withdraw it by deleting the content or turning the feature off.
- Under the Israeli Protection of Privacy Law this is "sensitive information" (מידע רגיש) and we apply the heightened security and access-control duties that come with it.
- Shalema is offered to women. If you tell us your gender in order to use it, that is also information you provide voluntarily and we use it only to give you access.
- Please avoid writing information about other people that they would not want recorded. Content you write about your partner is your responsibility to share.
3. Purposes & Legal Bases
We process your personal information for the following purposes, on the following legal bases (PPL §11 / GDPR Art. 6):
| Purpose | Legal basis |
|---|---|
| Deliver the free workbook you requested and follow-up emails about it | Consent (ticked at the form) / performance of pre-contract steps |
| Process a purchase, deliver the audio + workbook, send the receipt | Performance of a contract |
| Send marketing emails about new experiences / apps | Consent — you may withdraw any time |
| Provide the app features you use: store your journal, check-ins, reminders, voice notes, and pair you with your partner | Performance of a contract (and explicit consent for sensitive content — see §2.4) |
| Run the optional AI companion (Shalema) and the AI route planner (Shuffle Date) on the input you submit | Consent — these features are off until you switch them on, and you can switch them off at any time |
| Tailor date suggestions to the preferences and ratings you give | Performance of a contract — it is the feature you asked for |
| Credit a referral code, calculate affiliate commission, and pay affiliate partners | Performance of a contract (with the affiliate) / legitimate interest in running a referral programme |
| Assign which price you are shown, and measure how pricing performs (see §13) | Legitimate interest in setting and testing our prices |
| Web/app analytics, performance monitoring | Consent (via cookie banner) |
| Detect fraud, prevent abuse, secure our infrastructure | Legitimate interest / legal obligation |
| Comply with tax, accounting, and consumer-protection laws | Legal obligation |
4. AI Features and How Your Input Is Used
Some parts of our Services use artificial-intelligence models that run on a third party's servers, not on your phone. When you use one of these features, the text you submit leaves your device and is processed by that provider on our behalf. This section tells you exactly which features do that, what is sent, and what is not.
4.1 Shalema — the optional reflective companion
- It is off by default. Your journal stays on your device unless you switch the companion on. You can switch it off again at any time, and nothing further is sent.
- What is sent: the journal text or prompt you submit in that moment, plus enough recent conversation to keep the reply coherent. We do not send your name, email address, or account identifiers with it.
- Who processes it: [TO BE FILLED — name of the AI model provider, e.g. OpenAI, L.L.C. / Anthropic, PBC / Google LLC], acting as our processor under a data-processing agreement.
- Training: we use an API tier under which your input is not used to train the provider's models.
- Retention at the provider: [TO BE FILLED — the provider's retention window, e.g. "up to 30 days for abuse monitoring, then deleted"].
- It is not a person and not a therapist. The companion is software. It does not provide medical, psychological, or crisis care, and it is not a substitute for a professional or for the people in your life. You are told this in the app before your first message.
- If you write about harming yourself, the companion is designed to stop reflecting and instead point you to real help. If you are in danger now, contact your local emergency number, or in Israel SAHAR or ERAN at 1201.
4.2 Shuffle Date — the AI route planner
- What is sent: the location you enter or allow the app to read, your budget range, your mood/energy selection, and the type of date you asked for. This is used to generate one route and is not linked to your journal or check-in content.
- Who processes it: [TO BE FILLED — name of the AI model provider] for generating the plan, and [TO BE FILLED — places/maps provider, e.g. Google LLC (Places API)] for finding real venues near you.
- Location: we ask for location only when you use this feature, you can decline and type a city or area instead, and you can revoke the permission in your phone's settings at any time. We do not track your location in the background.
- Training: your input is not used to train the provider's models.
4.3 Voice
Some of our guided audio sessions are narrated by a synthetic voice generated with ElevenLabs. That is our own script, generated once, before you ever hear it — none of your personal information, and none of your own voice notes, are sent to ElevenLabs. Your Shalema voice notes are recordings of you, kept on your device, and are not transcribed, analysed, or sent to any AI provider.
4.4 What we never do with AI
- We do not sell your content to AI companies.
- We do not use your journal entries, check-ins, or companion conversations to train any model, ours or anyone else's.
- We do not use AI to make a decision that has a legal or similarly significant effect on you (see §13).
5. Recipients and Third-Party Processors
We do not sell or rent your personal information. We share it only with the service providers listed below, each of whom is contractually bound to use it solely on our instructions:
| Recipient | Purpose | Where the data goes |
|---|---|---|
| Google LLC — Firebase (Hosting, Firestore, Storage, Cloud Functions, Authentication) | Hosts the website, stores account & mailing-list data, delivers free-guide downloads | USA / EU (Google data centers) |
| Google LLC — Firebase Analytics | Aggregated website / app usage analytics (only with consent) | USA |
| Google LLC — Google Fonts | Delivers the Inter typeface used on the website (your IP and User-Agent are exposed to Google when fonts load) | USA / EU |
| Dodo Payments — merchant of record for guided-experience purchases | Card payment processing; tax handling; receipts. Dodo Payments is the seller of record for these transactions and its own privacy notice governs how it processes payment data. | EU (Lithuania) / USA |
| Apple Inc. & Google Play | App-store purchases and in-app subscriptions for our mobile apps | USA / per their data residency |
| Meta Platforms Ireland Ltd. — Meta Ads / Pixel / Conversions API | Advertising attribution and lookalike audience building, when used. (Pixel only fires after you accept marketing cookies.) | Ireland / USA |
| ManyChat, Inc. | Runs the conversational flows attached to our Meta ads; stores your messaging handle and the answers you give the bot | USA |
| [TO BE FILLED — AI model provider] — Shalema companion | Generates the optional companion's replies from the journal text you submit. Opt-in only. Your input is not used for model training. See §4.1. | [TO BE FILLED — USA / EU] |
| [TO BE FILLED — AI model provider] — Shuffle Date route planner | Builds a date route from the location, budget, and mood you supply. Your input is not used for model training. See §4.2. | [TO BE FILLED — USA / EU] |
| [TO BE FILLED — places / maps provider] | Finds real venues near the location you give the route planner | [TO BE FILLED] |
| ElevenLabs, Inc. | Generates voice for some of our guided audio sessions. We do not send your personal data, or your voice notes, to ElevenLabs. | USA |
| Affiliate partners (individuals and businesses who refer people to us) | Receive aggregate counts of referrals and commissionable revenue attributable to their code. They do not receive your name, email address, or any app content. | Israel / worldwide |
| Email delivery provider (currently routed through Google SMTP for transactional emails) | Sends free-guide downloads, receipts, daily admin reports | USA / EU |
We may also disclose your information when required by law, in response to a valid legal process, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets (in which case we will notify you in advance).
6. Advertising, "Sale" and "Sharing"
We do not sell your personal information for money, and we never share the content you write in our apps — journals, check-ins, voice notes, companion conversations — with advertisers. Not ever.
We do advertise. On our website, if you accept marketing cookies, the Meta Pixel and Conversions API send Meta a record of the pages you viewed and the actions you took (for example: viewed a product, submitted a form, started checkout), so that we can measure our ads and reach people like you. Under the California CPRA that counts as "sharing" personal information for cross-context behavioural advertising, even though no money changes hands, and some US state laws would call it a "sale". We describe it that way rather than hide behind the definition.
- The Pixel does not fire at all until you accept marketing cookies. Declining is the opt-out, and it is the default.
- You can change your mind at any time using the Cookie Settings link in the footer of every page. Turning marketing off revokes consent immediately.
- We treat a Global Privacy Control (GPC) signal from your browser as a valid opt-out of sharing.
- Our mobile apps do not contain advertising SDKs and do not show you ads.
- We do not knowingly share the personal information of anyone under 18 for advertising.
Details of each cookie and the exact events sent are in our Cookie Policy.
7. International Data Transfers
Most of our service providers are based outside Israel (primarily in the EU and USA). When your data is transferred outside Israel or the EEA we rely on the following lawful transfer mechanisms:
- From Israel: recipient countries either appear on the Israeli Privacy Protection Authority's list of countries offering adequate protection, or the transfer is made under the conditions of the Protection of Privacy Regulations (Transfer of Data to Foreign Databases), 5761-2001.
- From the EEA / UK: we (and our processors) use the European Commission's Standard Contractual Clauses (SCCs, 2021/914), plus supplementary technical measures (encryption in transit and at rest).
You can request a copy of the safeguards in place for a specific transfer by emailing jacoblipsky@90minutes-a-week.com.
8. How Long We Keep Your Information
| Category | Retention period |
|---|---|
| Mailing-list / lead-magnet emails | Until you unsubscribe, or after 24 months of inactivity |
| App account & profile | For the lifetime of the account; deleted within 30 days of your deletion request |
| Journal entries, check-ins, reminders, and other app content | Until you delete the item or your account. Content stored only on your device is removed when you delete the app. |
| Voice notes (Shalema) | On your device until you delete them. If you enabled backup, deleted within 30 days of the deletion request. |
| AI companion conversations | [TO BE FILLED — our own retention, e.g. "kept with your journal until you delete it"]. At the model provider: see §4.1. |
| Route-planner inputs (location, budget, mood) | Used to build the route, then kept only as part of your saved date history; deleted with your account |
| Referral attribution, commission and payout records | 7 years (accounting and tax obligations) — these are financial records and survive account deletion in pseudonymised form |
| Price-assignment record (see §13) | For as long as your account exists, so that the price you were shown stays stable |
| Purchase records, invoices, tax documents | 7 years (Israeli Income Tax Ordinance and VAT Law) |
| Analytics events | 14 months (Firebase Analytics default) |
| Cookie consent record | 13 months from the date you set it, then re-asked |
| Contact-form correspondence | As long as needed to handle your request, then archived for 24 months |
9. Deleting Your Data
You can delete your account and the content in it at any time, and you do not have to ask us to do it:
- In the app: Settings → Account → Delete account. This is available in every one of our apps and takes the same number of steps as creating the account did.
- By email: write to jacoblipsky@90minutes-a-week.com with the subject line "Delete my account".
- Mailing list: every email we send has a one-click unsubscribe link.
When you delete your account we remove your profile, your journal entries, check-ins, reminders, voice-note backups, and companion conversations from our systems within 30 days, including from routine backups on their next rotation. If you were paired with a partner, your content is removed from their view as well; content they wrote stays theirs.
Two things survive, and we would rather tell you than surprise you:
- Purchase, invoice, and commission records, which Israeli tax law requires us to keep for 7 years. We reduce these to what the law requires and unlink them from your app content.
- Records we must keep to handle a legal claim or a fraud investigation, kept only for as long as that matters.
Deleting the app from your phone removes the content stored on the device, but does not by itself delete a cloud account. Use the in-app deletion, or email us, if you want both gone.
10. Your Rights
Depending on where you live, you may have some or all of the following rights:
10.1 Under the Israeli Protection of Privacy Law (PPL) and Amendment 13
- Right to know which information about you we hold (§13 PPL).
- Right to ask us to correct, complete, or delete inaccurate information (§14 PPL).
- Right to withdraw consent at any time (the withdrawal does not affect prior lawful processing).
- Right to lodge a complaint with the Israeli Privacy Protection Authority (הרשות להגנת הפרטיות) — https://www.gov.il/en/departments/the_privacy_protection_authority.
10.2 Under the GDPR (EU/EEA/UK residents)
- Right of access (Art. 15), rectification (Art. 16), erasure / "right to be forgotten" (Art. 17).
- Right to restrict processing (Art. 18), data portability (Art. 20), object to processing (Art. 21).
- Right to withdraw consent at any time (Art. 7(3)) and to lodge a complaint with your local Data Protection Authority.
10.3 Under the CCPA / CPRA (California residents)
- Right to know what categories of personal information we have collected and to whom we have disclosed it.
- Right to delete personal information.
- Right to correct inaccurate information.
- Right to opt out of "sale" or "sharing". We do not sell personal information for money. We do "share" website browsing activity with Meta for cross-context behavioural advertising when you accept marketing cookies — see §6. To opt out, decline marketing cookies, change your choice under Cookie Settings in the footer, or send a Global Privacy Control signal. We do not share app content at all.
- Right to limit the use of sensitive personal information. We use the sensitive information described in §2.4 only to provide the features you asked for, never to infer characteristics about you or to advertise.
- Right not to be discriminated against for exercising any of these rights.
To exercise any right, email jacoblipsky@90minutes-a-week.com with the subject line "Privacy Request". We respond within 30 days (extendable to 60 days for complex requests, with notice to you).
11. How We Secure Your Information
- HTTPS / TLS for all traffic between you and our servers.
- Firebase Authentication for account access; passwords are hashed by Firebase and never visible to us.
- Default-deny storage. Our databases and file storage refuse every read and write unless a rule explicitly allows it. Journal content and account data are readable only by the account that owns them; financial records are not readable by any client at all. Nothing is left publicly readable except the free workbook files we intend anyone to download.
- Journal content in Shalema is stored on your device first and is only uploaded if you turn on backup, sync, or the optional companion.
- Firestore Security Rules restrict who can read or write each collection; lead-magnet emails are writable only via authenticated paths.
- Backend secrets (SMTP credentials, API keys) are stored in Google Cloud Secret Manager — never in the client bundle or in source control.
- Access to administrative tooling is restricted to the founder and protected by Firebase Authentication.
No system is 100% secure. If a breach occurs that is likely to put your rights at risk, we will notify you and the relevant authority within 72 hours (GDPR) and follow PPL Amendment 13 §17B notification rules.
12. Children
The Services are not intended for, and we do not knowingly collect personal information from, individuals under 18 years of age. Our apps are rated for adults on both app stores and you confirm your age before creating an account. The optional AI companion in Shalema is available only to adult account holders. If you believe a child has provided us personal information, contact us at jacoblipsky@90minutes-a-week.com and we will delete it. We do not knowingly sell or share the personal information of anyone under 18.
13. Automated Decision-Making and Pricing
We do not make decisions that produce a legal effect on you, or a similarly significant effect, using solely automated means. Nobody is denied a service, profiled for risk, or scored by a machine here.
Two things are automated, and we would rather name them than let you find them:
- Which price you are shown. When you open a paywall in one of our apps, our server assigns you to a pricing group. If you entered a valid referral code, you get that partner's discount. If you did not, you are assigned to one of a small number of price groups by a fixed calculation on your user ID — effectively a coin flip. The assignment is recorded so that it stays the same on every device and after a reinstall, and so that we can measure which prices work. It is not based on your behaviour, your location, your device, your income, or anything you have written in the app, and it never changes what you get for your money — only the price on the offer. If you would like to know which group you are in, or you believe the price you saw was wrong, email us and we will tell you and correct it.
- Which date route or reflection you are offered. The suggestions in Shuffle Date and the replies from the Shalema companion are generated automatically (see §4). These are recommendations. They have no effect on your rights, your price, or your access.
Where the GDPR applies, you may object to the pricing assignment under Art. 21, and we will handle your pricing manually if you ask.
14. Changes to This Policy
We will post the updated policy on this page with a new "Version" number and "Last Updated" date, and (for material changes) send a notice to registered users. The current and prior versions are kept on file; email us to request an earlier version.
15. Contact & Complaints
Privacy contact: jacoblipsky@90minutes-a-week.com
Israeli residents may also complain to the Israeli Privacy Protection Authority (הרשות להגנת הפרטיות): https://www.gov.il/en/departments/the_privacy_protection_authority.
EEA/UK residents may complain to their national Data Protection Authority (a list is maintained by the European Data Protection Board).