Privacy Policy — Toshema
Effective 10 September 2026 · Last updated 16 September 2026
Toshema (“we”, “us”) provides the Toshema mobile app and the toshema.com website (together, the “service”) for daily Talmud study. They share one account, so signing in, commenting and dedicating work the same way and reach the same records whichever you use. This policy covers both and explains what we collect, why, and what you can do about it. Where something applies to only one of them, it says so.
Who is responsible: Toshema, the publisher of the Toshema app, based in London, United Kingdom. We are the data controller for the information described here. Contact: shiur@toshema.com.
What we collect
- Account information. You sign in with Google or Apple. We receive your name, email address and an account identifier through Firebase Authentication, and store an internal user ID. We never receive your password. If you use Apple’s “Hide My Email”, we only ever see the relay address.
- Your learning activity. Which shiurim you play and how far through you are, so playback resumes where you left off, plus your chosen learning schedule and playback preferences.
- Comments. If you post a comment on a shiur, we store its text, your display name and the time you posted. Comments are visible to other users.
- Donations. Payment is processed by Stripe. Card details go directly to Stripe and are never stored by us or held on your device. We keep a record of the donation — amount, date, the dedication text you supply, and the period it covers — so the dedication can be displayed and the donation accounted for.
- Content you download (app only). Videos, audio and documents you save for offline use are stored on your device only. We record which items you downloaded so the app can play them offline; the files are never uploaded anywhere. The website has no offline downloads.
- Technical information. Standard request data reaching our servers. We use no advertising identifiers, and the app contains no advertising or behavioural analytics.
- Crash reports (app only). If the app crashes, a diagnostic report is sent to Sentry so we can fix it: the error, where in the code it happened, and basic device information such as the model and operating-system version. These reports are not linked to your name or email address.
What we do not collect
We do not collect your location, contacts, photos, microphone or camera data. The app requests no such permissions.
Why we use it
- To sign you in and keep you signed in
- To resume playback and follow your learning schedule
- To display comments and dedications
- To process donations and keep the accounting records the law requires of us
- To operate, secure and troubleshoot the service
We are based in the United Kingdom, so the UK GDPR and the Data Protection Act 2018 apply to what we do, and the EU GDPR applies in addition where we serve people in the EU. Our legal bases are: performing our agreement with you (account, playback, downloads), your consent (comments, dedications), our legitimate interest in operating and securing the service, and compliance with a legal obligation (donation and tax records).
Who we share it with
We do not sell your information. We share it only with the providers who run the service on our behalf:
- Google Firebase — authentication (privacy policy)
- Stripe — payment processing (privacy policy)
- Amazon Web Services — hosting of shiur video, audio and documents
- Expo (EAS) — delivery of app updates
- Sentry — crash reporting (privacy policy)
Talmud page images are loaded from outorah.org; requesting one tells that site your IP address, as any web request does. We also disclose information where the law requires it.
How long we keep it
- Account and learning data: while your account exists. Deleting your account clears your account record and your playback progress.
- Comments are kept after account deletion, but your name is removed from them — they are shown as "Guest". A comment is something you chose to publish for other learners, so it stays on the shiur it belongs to. Ask us and we will remove a particular comment.
- Dedications are kept. A dedication is a zchus given in someone's merit and it stays with the learning it sponsored. The financial record behind it is retained for 7 years, because tax and charity-accounting rules require it.
Deleting your account
In the app, you can delete your account yourself: Profile → Delete account. This removes your sign-in identity and the settings, progress and downloads stored on your device. The website has no equivalent button — if you use only the website, use the email route below.
To have the records held on our servers deleted as well — your account record and playback progress — email shiur@toshema.com from the address on your account and we will action it within 30 days. The same account covers both the app and the website, so deleting it ends your access to both. Comments and dedications are retained as described above.
Your rights
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your information, to object to or restrict how we use it, and to complain to your data protection authority. Write to shiur@toshema.com.
In the UK, that authority is the Information Commissioner's Office — ico.org.uk, or 0303 123 1113. We would rather you came to us first so we can put things right, but you do not have to.
Children
The app is not directed at children under 13 and we do not knowingly collect their information. If you believe a child has given us information, contact us and we will delete it.
International transfers
Our providers operate in the United States and elsewhere, so your information is processed outside the United Kingdom. Where a country has not been found adequate, those transfers rely on the UK International Data Transfer Agreement, or on the European Commission’s Standard Contractual Clauses together with the UK Addendum to them.
Changes
We will post any changes here and update the date above. Significant changes will be notified in the app.
Contact
Toshema
shiur@toshema.com