Privacy Policy

Version 1.3 · Updated: 25 October 2026 · Operator: Oshik team (Yehuda) · udah10@gmail.com

Oshik is an educational money journal for families. Parents are the bank; the app is the ledger. Figures in the app are educational simulations. There are no real bank accounts, cards, payment processing, or bank credentials.

Who this applies to

The account belongs to a parent or legal guardian. A child joins the family with a code or QR shown on the parent device, with no independent child account and no Google / Apple / social login for the child.

Current state

There is a live journal backend on Supabase in Frankfurt, EU. Parent accounts, linked children, and ledger records are stored in the cloud so the service works across devices. The store build is not an in-memory demo.

What we collect

• Parent name and email for sign-in and contact.
• Parent sign-in: email and password, and Google or Apple if the parent chooses them. Children do not use OAuth.
• First name (or nickname) and age/gender the parent enters for a linked child. No independent child account.
• Journal records: track balances (spend, save, invest), requests (cash, lock, purchase), tasks and goals, family settings (caps, deposit tracks, toggles, shekel or virtual currency).
• If Oshik chat for the child is on: message content (money questions and educational replies) and the journal data sent to answer them (that child's name and journal figures) are transferred to the model provider (currently Google Gemini) and processed outside Israel / outside the European Union to produce a reply. The parent can turn chat off for the family or for one child. Chat content is not used for ads and is not sold.
• If push is enabled: a device token to send notifications (for example a matured deposit).
• Camera: optional, only to scan the pairing square. We do not store children's photos.

What we never collect

Real money balances, bank account numbers, card numbers. Payment processing, payment apps, or cash transfers - those happen outside the app. No location. No Advertising ID. No ads in the app.

On-device

PIN and biometrics (if set) stay on the device, not on the server.

Sharing

We do not sell data or share it for advertising. Infrastructure processors that receive data only to run the service: Supabase (auth and database), Resend (SMTP for verification and password-reset emails from Oshik's noreply address), Google/Apple (parent sign-in if used), Expo/FCM (push), and the language-model provider when chat is on.

Children

Use by a minor requires the parent account holder's consent. No ads to children, no ad tracking, no sale of data, and no use of children's data for targeted advertising.

Retention, deletion, contact

We keep journal records while the account is active. Access: in the parent app you can download a copy of account and journal data (export from the device). For corrections or other questions: udah10@gmail.com. Delete the account in the parent app with the Delete account control. Deleting the parent account also deletes linked children's records. Full steps: Delete account.

Security

Traffic is encrypted (HTTPS). No security is perfect. We will handle reasonable requests to see or correct details.

Governing law

Laws of the State of Israel, including the Protection of Privacy Law. Courts of Israel have exclusive jurisdiction.

Changes

Policy changes will be posted here with an updated date at the top.