SHORESH Privacy Policy

SHORESH is used in two completely different ways, and they are built differently on purpose.

When a family subscribes directly, the parent gives us the parent's own name and email address and the child's first name. We know who the child is, in the sense that we hold a first name linked to a parent's email.

When a school subscribes, we hold no names at all for the children. The school's teachers generate anonymous usernames, give them out in class, and keep the list of which username belongs to which child. That list stays at the school. We never receive it, we never ask for it, and we cannot work it out. To us, a school student is a username and a set of quiz scores.

The rest of this policy says, for each of the two, exactly what we hold.

SHORESH is operated by David Vaknin, a sole proprietor registered in Israel (עוסק מורשה), trading as ABCschool, of 11 HaRav Mordechai Eliyahu Street, Kiryat Malakhi, Israel. We are the controller of the personal information described in section 3A. For the information described in section 3B we act as a service provider (processor) for the school, under our agreement with that school.

For any privacy question, or to exercise any right in this policy: info@shorsh.org.

3A. From families who subscribe directly

We do not ask a family for a home address, a school name, a date of birth, a photograph, a government identifier, or a child's contact details of any kind.

Payment information. We never receive it. Paddle.com Market Ltd is the merchant of record for family subscriptions and handles the whole payment. Card numbers, bank details and billing addresses go to Paddle and are governed by Paddle's privacy policy. We receive only the fact that a subscription was paid for, and when it renews or lapses.

3B. From students who use SHORESH through their school

We do not receive or hold a school student's name, email address, home address, telephone number, date of birth, photograph, government identifier, parent's details, grades outside SHORESH, health information, or anything else about them.

3C. From school staff

For the principal and the teachers at a subscribing school we hold a name, a work email address and a password hash — the ordinary details any staff account needs.

We use the information above only to:

1. provide the service — sign a user in, serve the right lessons, record progress;
2. keep the account working — support, password resets, service notices;
3. bill a family subscription, through Paddle;
4. keep children safe — the moderation and alerting described in section 6;
5. keep the service secure and working — abuse prevention, fraud prevention, diagnosing faults;
6. understand, in aggregate, which lessons work — using counts and averages, not individual children;
7. meet our legal obligations.

Where the law requires a legal basis: for families we rely on performance of our contract with the parent, on the parent's consent for the collection of their child's information, and on our legitimate interest in security and service integrity. For school students we process on the school's instructions, under the school's authority; the school is responsible for having the authority to give those instructions.

• We do not sell personal information, and we never have.
• We do not share it for cross-context behavioural advertising.
• We do not show advertising of any kind inside SHORESH.
• We do not use children's information, or anything a child writes or draws, to train artificial-intelligence or machine-learning models.
• We do not build advertising or marketing profiles of children.
• We do not let a child communicate with another child, or with any adult other than their own teacher and our own moderation staff.
• We do not require more information than the service actually needs in order to work.

Because we do not disclose a child's information to any third party for that third party's own purposes, and because we do not serve targeted advertising, we do not ask a parent for the separate consent that those activities would otherwise require. A parent's consent covers collection and use for the purposes in section 4, and nothing beyond them.

In schools that run our international programme, a student can write a short letter to one of our animated characters. A character answers in a video published to the whole group once a month. This feature is off for family subscriptions and off for all other schools.

What is built around it:

• A letter is at most 200 characters. A student can write at most two per lesson.
• Before a letter is saved, our server automatically rejects it if it appears to contain an email address, a street address, a telephone number, or the student introducing themselves by name. The student is asked to rewrite it. This runs on our server, so it cannot be bypassed from the browser.
• A student can never see another student's letter. There is no feature anywhere in SHORESH that shows one child another child's writing.
• Letters are visible to the student's own classroom teacher, to the school's principal, and to our own moderation staff. No one else.
• A teacher can flag a letter for our attention. Our staff can remove a letter.

If a letter suggests the child may need help. Our server automatically scans every letter for wording that may indicate a child in distress — for example being hurt by someone, being afraid of someone, being left alone or unfed, being bullied, or wishing to harm themselves. The scan runs in English, Hebrew, Spanish and French.

If such wording is found, the letter is saved and shown to the child exactly as normal — the child is not blocked, warned, or told anything different — and two notices are sent at once: one to us, and one to the principal of that child's school. The notice to the principal contains the letter, the student's username, the classroom and the name of the classroom teacher, so that the principal can go to the teacher and the teacher can identify the child.

Where our responsibility ends. We are an Israeli software company. We are not the child's school, not their teacher, and not a mandated reporter under United States or Canadian law. We cannot identify the child, because we do not hold their name. What we can do is put the letter in front of the adults at the school who do know the child, quickly, and that is what we do. The legal duty to assess the situation and to report it to the authorities where required rests with the school and its staff, under their own child-protection policy and their own local law. Our school agreement says this explicitly.

This detection is automatic and imperfect. It will sometimes flag an innocent sentence, and it will sometimes miss a real one. It is a safety net, not a guarantee, and it is not a substitute for the supervision a school and a parent provide.

We keep the list of suppliers deliberately short. Each one is bound by contract to use the information only to provide its service to us.

Beyond these we disclose information only: to the school, for its own students; to a parent, for their own child; where we are legally required to, by a valid legal process; where it is necessary to protect a child from imminent harm; and to a buyer or successor if the business is sold, in which case this policy continues to apply to information transferred and we will give notice before it happens.

The database that holds everything described in section 3 is located in the European Union (Frankfurt, Germany). Our website is served from the United States and from a global content-delivery network. We operate from Israel, and our staff in Israel access the information in order to run and support the service. Our other suppliers process it in the countries listed in section 7. If you are in the United States or Canada, your information is therefore stored and processed outside your own country.

Israel has been recognised by the European Commission as providing an adequate level of data protection, which is the basis on which information moves between our European database and our team in Israel. Where a transfer needs a contractual safeguard in addition to that, we use the standard contractual clauses or the equivalent mechanism the supplier offers.

This section is our written data-retention policy. We keep each kind of information only for as long as the purpose it was collected for actually requires, and then we delete it. We do not retain a child's personal information indefinitely. The table states, for each kind, why we hold it and when it goes.

When we delete, we delete. The records are removed from the live database immediately, and they disappear from our backups as the backup rotation turns over: backups are taken daily and kept for seven days, so nothing we delete survives in a backup beyond seven days. Files held in our file storage are deleted at the same time as the records that refer to them.

Access to the service requires a password, and passwords are stored only as cryptographic hashes. Traffic is encrypted in transit. Access to the database is restricted at the row level, so a teacher can reach only her own class, a principal only her own school, and a student only their own records. Access by our own staff is limited to the people who need it to run the service. We rate-limit sign-in and submission endpoints against automated abuse.

We maintain a written information-security programme covering children's information. It names the person responsible for it, requires a risk assessment at least once a year, sets out the safeguards we apply, requires those safeguards to be tested, and requires the programme itself to be reviewed annually. We also take steps to satisfy ourselves that each supplier listed in section 7 is capable of keeping the information confidential and secure, and we hold written assurances from them to that effect. We will provide a summary of the programme to a school or a parent on request.

No service can promise perfect security. If a breach affects personal information we hold, we will notify the affected parents, the affected schools and the authorities where the law requires, without undue delay.

If you are a parent with a family subscription, you may at any time: see what we hold about you and your child; get a copy of it; correct it; have it deleted; withdraw your consent to our collecting your child's information, which ends the account; and ask us to stop using your child's creations in a response video. Email info@shorsh.org. We will respond within 30 days. We will ask you to confirm your identity from the email address on the account, so that we do not hand a child's information to the wrong person. We do not charge for this, and we will not treat you worse for asking.

If you are a parent whose child uses SHORESH through a school, the school holds the relationship with you and the key that connects your child to their username. Please go to the school. The school can ask us to show, correct, export or delete anything belonging to its students, and we act on that request. If you contact us directly, we will put you in touch with the school rather than guess which username is your child.

If you are a school, you may ask us at any time to export or delete your students' data, and we will do it.

If you are in California, Colorado, Connecticut, Virginia or another state with a comprehensive privacy law, or in Canada, you may have additional rights including the right to appeal a refusal. You may also complain to your state Attorney General, to the Office of the Privacy Commissioner of Canada, or to the Israeli Privacy Protection Authority.

Cookies. We use only the cookies and local storage the service needs in order to work — keeping a user signed in, enforcing our session limits, remembering a chosen language or a dashboard layout, and security. Our cookie notice lists them individually.

No product analytics on children. We do not use any third-party product-analytics, measurement or cross-site tracker on any page a child sees or uses. There is no Google Analytics, no tag manager, and no data-broker script anywhere in SHORESH. One narrowly scoped marketing pixel runs only on the parent-signup pages — see section 13.

Error monitoring. We do use one third-party technical service, Sentry, which records the details of a crash or a fault so that we can fix it. Sentry is not an analytics or advertising product, it does not build profiles and it is not used to study how children use the service. We do not send it information that identifies a child: for a child's session Sentry receives the fault and the technical context, not the user. For a staff account it also receives an internal account identifier, so that we can tell which account hit the fault.

Where our cookie banner offers a choice, declining the optional categories does not reduce the lessons, features or content available to a child.

On five parent-signup pages — /b2c, /b2c/choose, /b2c/parent-details, /b2c/payment and /b2c/register — we may load the Meta (Facebook) Pixel to understand which marketing pages lead to a parent signup. The pixel is a small JavaScript library provided by Meta Platforms, Inc. It sets cookies and reads your IP address and browser information, and reports a small set of events back to Meta.

We never load this pixel on any page a child sees or uses. It is specifically excluded from every path under /b2c/child (child dashboard, lessons, games, songs, quiz, shop, wardrobe, badges), from the shared sign-in page at /b2c/login, from the home page, and from the entire school platform (teacher, student, school-parent and admin screens). An automated test in our codebase fails our build if any child-facing path is ever added to the allow-list by mistake.

We never send Meta your email address, name, phone number, or any information about your child. The only events we send are: a page view on each of the five pages listed above; that the parent submitted the signup form (no form field values); that the Paddle checkout was opened; and, on a completed purchase, the subtotal in US dollars, the currency, and a Paddle transaction ID used only to de-duplicate the event.

The pixel only loads with your explicit consent. We ask for consent on your first visit via a cookie banner. The pixel is off by default; if you choose “Reject All” or do not accept the “Marketing” category in Manage Preferences, nothing is loaded or sent, now or on future visits. If you later withdraw consent from “Manage Cookies” in the footer, the pixel script is detached from the page and no further events are sent from that tab.

You can also opt out of Meta's own ad personalisation at facebook.com/adpreferences/ad_settings.

If we change this policy materially we will email account holders at least 30 days before the change takes effect, and post the new version with a new “Last updated” date. For any change that would mean collecting or using a child's information in a new way, we will obtain fresh parental consent before making it, as the children's appendix requires.

David Vaknin, trading as ABCschool
11 HaRav Mordechai Eliyahu Street, Kiryat Malakhi, Israel
info@shorsh.org