🔒Privacy

All of the following is stored locally on your device. Lechem never transmits any of it on its own — nothing here is uploaded, synced or reported in the background, and none of it is used for advertising or profiling. The only thing that can carry any of it off the phone is a feedback report you deliberately send, and section 2.1 sets out exactly what such a report contains. The usage record described in section 2.5 is a separate thing and is not covered by this paragraph — it is designed to follow your account, and it is not in the list below.

Two ways a report can carry it, and both are visible to you before you send. Some of these are sent as fields in their own right — they are marked below. And a report can include an automatic picture of the screen you were on, so whatever was on that screen at that moment is in the picture, whether or not it is a field the report collects. Nothing forces you to send the picture: the app shows you the whole report, picture included, before you tap Send, and you can remove it. The strictly private screens are the exception with no exception — they are never photographed at all.

• Your bracha count and everything behind it — what you counted, when, on which day. Never sent as a field.
• Your davening, your learning, your Chitas and Shnayim Mikra progress. Never sent as a field.
• The names you daven for, refuah names, yahrtzeits, kevarim tefillos, your kabbalos. Never sent as a field.
• 🩸 Your minhag, nusach, edah, and the city you chose for zmanim. Sent as a field in a feedback report: your edah/nusach and the city name you set are included in one, and the app shows you both on the send screen before you tap Send. Your coordinates are never sent; only the city name you chose.
• 🩸 Your profiles and any family or child profiles set up on the phone. Sent as a field in a feedback report: the name on the profile that filed it, its profile identifier and your account number are included, and the app shows you all three before you tap Send. A child’s name is never included, from any field.
• Everything on the screens the app treats as strictly private (the cycle and mikvah sections). These are held to an additional rule with no exception at all: they are never photographed by the app, never named in a report, and never included in any transmission for any reason. A report filed from one of those screens carries none of the identifying fields above.

The cycle and mikvah records, stated plainly. Google Play classes menstrual cycle tracking as a health feature regardless of why an app does it, and this app declares it as one. So it is set out here rather than left to be inferred. What the app records is the dates you enter yourself — nothing is measured, sensed or imported, and no other app or device supplies them. What it does with them is arithmetic under halacha: it counts the days and tells you what the count means for vestos and for mikvah timing. It does not diagnose, does not track fertility, and is not a means of preventing or planning a pregnancy — for anything about your health, ask a doctor, and for any question of halacha, ask your Rav. Where the records live is this phone, in the app’s own store, and nowhere else: no account behind them, no server copy, and no sync — nothing carries them anywhere on its own. How long they are kept is entirely up to you — they stay until you delete them or uninstall the app, and there is no expiry, no archive and no backup that outlives either. Who else can read them is nobody unless you choose otherwise — not us, not a third party, not the two Android backup channels, and not a feedback report, which is held to the additional rule above with no exception at all. There is exactly one way these records leave the phone, and it is your hand: inside that section, Copy and Download file put them where you point them — to your Rav, your husband, a parent, or nobody. The app never does it for you, never on a timer, and never anywhere you did not choose; and what you do with the copy after that is between you and the person you gave it to.

If you uninstall the app, the app’s own storage is deleted with it — with the one exception in the next paragraph. That storage is also kept out of both of Android’s backup channels — Google cloud backup, and the phone-to-phone transfer that runs when you set up a new device. Three settings control this and all three are set against copying: the app opts out of backup entirely, and it additionally ships two rules files that exclude every one of its stores by name. 🩸 Those two rules files were added on 1 August 2026, and they are a repair rather than a formality: on some manufacturers’ phones the opt-out flag alone closes cloud backup but does NOT close device-to-device transfer, so until that date the phone-to-phone channel was not in fact shut. It is shut now, and it is shut by the rules files rather than by the flag alone. (android:allowBackup="false" — the app opts out of Android’s automatic backup entirely, plus all-exclude dataExtractionRules and fullBackupContent — so this data does not land in a Google account, or on a new phone, without you asking). If you signed in, see section 6 — the account itself is the one thing an uninstall does not remove.

The copy that survives an uninstall. Since version 0.171 Lechem writes an automatic copy of your record to your phone’s own Documents folder — Documents/lechem-auto-1.json and lechem-auto-2.json, two files that take turns so a write that fails halfway can never destroy the good copy. It exists because people were losing everything when they reinstalled. It is a file on your phone: it is never uploaded, and nothing in Lechem sends it anywhere or ever deletes it. Because it sits in shared Documents rather than inside the app, it survives uninstalling Lechem — and the same fact cuts the other way: any app you have granted All-files access can read it, any computer the phone is plugged into can browse that folder, and device and manufacturer backups carry it, because the backup opt-out above governs the app’s own storage and does not reach Documents. It holds the first names of children set up on the phone, the name on your own profile, the names you daven for and the yahrtzeits you keep, reward notes, unsent feedback text, your counts, davening, learning and settings, and from 0.253 your usage record (section 2.5). It never contains your cycle or mikvah records. To remove it, delete those files from Documents like any other file.

There are exactly seven pieces of code in Lechem that are permitted to use the network. This is enforced by an automated build gate, not by good intentions: they are named in an allow-list, and a build in which any other file contains a network call is refused and never produced. Adding one more is a deliberate, recorded decision — it cannot happen quietly. Each of them is described below, and between them they account for every byte this app can send or fetch.

• One sends a feedback report you chose to send (section 2.1).
• Three fetch files and send nothing about you: the app-version check, the content check, and the language-pack download (section 2.2).
• One signs you in, if you choose to sign in (section 2.3).
• One is the sync transport, which is built and not switched on (section 2.4).
• One is the developer’s own message channel, which the server refuses to anybody else (section 2.6).

The code that keeps your usage record (section 2.5) is not one of them and cannot become one. It writes to storage on your phone and has no way to reach a network at all; if your record ever travels, it travels through the sync code in section 2.4, behind your account, and the same build gate refuses any build where that stops being true.

The app does not request background location, does not read your contacts, does not read your photos or files, and does not read your calendar.

Lechem is built so that a child can use it — the pictures do the talking and nothing is asked of a child that a child should not be asked. A child’s name and details stay on the phone. If a report is sent from a child’s profile, the child’s name is not included.

Specifically: a child’s profile cannot sign in, cannot get an account, and cannot attach or send a picture, a video or a voice recording to us at all. A child’s name is removed from every part of a report before it is sent — from the words, from the details, from the label of the button that was tapped, and from the name of any file attached.

One thing a parent should know. Those protections work on text. If you, as the adult using the phone, send a feedback report while you are looking at the children’s screen, the report includes an automatic picture of that screen — and a name printed on that screen will be in the picture. Nothing forces you to send it: the app shows you exactly what the report will carry before you tap Send, and you can remove the picture.

Lechem does not knowingly collect personal information from children. If you believe a report was sent that contains a child’s personal information, contact us and it will be deleted.

• Supabase hosts the storage, the endpoint that receives feedback reports, the authentication server that checks a sign-in, and — in future — sync. They act as a processor for us, on our instructions.
• Google is one of the two identity providers behind "Continue with Google". If you use that button, you sign in on Google’s own page, under Google’s privacy policy, and Google tells our authentication server that you signed in and what your email address is. If you never tap that button, Google is not involved in your sign-in at all.
• Microsoft is the other, behind "Continue with Microsoft", on exactly the same terms.
• Google Play services supplies the on-device text-recognition model used by the ingredients label reader; the model is downloaded to the device by Google Play, and the recognition itself happens on the phone. No photograph is uploaded.
• There are no advertising networks and no social-media SDKs in this app.

"No analytics" used to stand here unqualified, and it no longer stands at all. Lechem’s own usage record (section 2.5) goes to you and to your own account, and to nobody else; there is no analytics library, no advertising SDK, no crash reporter, no session recorder and no ad identifier in the app, and that is checked mechanically on every build. Separately, the text-recognition component supplied by Google brings Google’s own standard reporting library with it, which can send Google device and app descriptors and its own API-usage events — no photograph, no recognised text and no Lechem record. That one is not ours and we cannot read it; it is why Lechem’s Google Play Data safety declaration ticks Diagnostics. If you never open the label reader, it does not apply to you.

• Don’t want anything to leave the phone at all? Don’t send a feedback report and don’t sign in. For the first 14 days on a phone, "Not now" on the sign-in screen opens everything with the phone offline. After that the app asks you to sign in to go on; the sign-in screen always offers to save your records to a file first, so you can take them with you without signing in.
• Want to see, take, stop or delete just the usage record? Everything in section 2.5 is on one screen inside the app. Stopping and deleting are separate buttons on purpose.
• Want a report deleted after you sent it? Contact us with the ticket number the app showed you.
• Signed in and want to stop? Sign out on the Settings & Account screen. The session tokens are removed from the phone.
• Want everything on the phone gone? Uninstalling is not enough. It removes the app’s own storage, which is not sitting in a Google backup or waiting in a phone-to-phone transfer (section 1). It does NOT remove the automatic copy in your phone’s Documents folder, which is built to outlive an uninstall, holds your names, your children’s first names, your counts and your usage record, and is carried by device and manufacturer backups. Deleting it is a second act, and it is yours: delete Documents/lechem-auto-1.json and lechem-auto-2.json (or Documents/.lechem/ if you moved them) like any other file. Lechem never deletes them for you.
• Want your account gone too? Uninstalling does not remove it — signing in created a record on our authentication server, and that record outlives the app on your phone. You can delete it yourself, at https://lechem.app/delete (the same page is at ooretz.space/lechem/delete, and it is linked in the footer of every page on this site). Sign in there and the page shows you your own answer before anything is armed. It always deletes your Lechem membership and every feedback report you filed — the words, the pictures, the screen recordings and the voice notes with them. It deletes the account itself only if you hold nothing in any other OOretz service; if something else is holding it open, the page names what, and your Lechem data goes regardless.
• The app can start you on that road: Settings carries a row called "Delete my account" which opens that same page. It opens it in a browser rather than doing it inside the app, because the act requires you to be signed in where the server can check it — the page is readable by anybody, but nothing on it can be armed without a session we validated ourselves. And if you have lost access and cannot sign in to use the page at all, write to us by the contact route in section 7 — but know that we will not delete an account on the strength of a message alone, because a message is not proof that the account is yours.

What is collected is described above. This section says how long each of those things is kept, which is a separate question and is answered here in full.

• What stays on your phone — kept for as long as the app is installed. Nothing expires and nothing is removed on a timer: your count, your davening, your learning, the names you daven for and your kabbalos are yours to keep or clear. Uninstalling deletes the app’s own storage, and it is not left behind in either Android backup channel (section 1) — but the automatic copy in Documents is kept until you delete it yourself, because it is built to survive an uninstall.
• Your usage record (section 2.5) — kept on the phone, one record per day, until you delete it on its own screen; stopping it does not delete what is already there. It is inside the Documents copy, so it lasts as long as that copy does. Once sync is switched on it is also held with your own account until you delete it or the account.
• Feedback reports — kept until they are deleted, with no automatic expiry. A report is held so the problem you raised can actually be worked on and answered, which is why there is no fixed window. You can end that at any time: contact us with the ticket number the app showed you, or delete every report you have ever filed at once from https://lechem.app/delete — the words, the pictures, the screen recordings and the voice notes go with them.
• Your account, if you signed in — this is the one thing an uninstall does not remove. Signing in creates a record on our authentication server, and it is kept until you delete it yourself at https://lechem.app/delete. That page always removes your Lechem membership and all of your feedback reports; it removes the account itself only where nothing in another OOretz service is still holding it open, and it names what is holding it when that happens.
• Syncing your practice between devices — built and not switched on (section 2.4), so nothing is being held on any server for it. If that changes, this policy is updated in the app before the first byte moves.

Nothing about you is retained for advertising, profiling or resale — not for a short period and not for a long one. The usage record in section 2.5 is kept for you, and so the people who build Lechem can see what nobody can find; it is never sold and never joined to an advertising identifier.

If this policy changes in a way that affects what leaves your phone, the change will be announced in the app before it takes effect — not merely posted here.

That promise has been broken once, and it is written here rather than quietly repaired. Sign-in shipped, and for a period this page went on telling readers that the sign-in server was not enabled. It was corrected across late July and early August 2026, and the corrections are stated inside the sections themselves — §2.3 and §3 both say what they used to say — so that anyone who read the older text can see exactly what changed.

And again in September 2026. From version 0.253 Lechem keeps a record of how you use it (section 2.5), and this page went on saying it had no analytics of any kind; and after the sign-in screen became the first screen, this page went on saying signing in was optional. Both were corrected on 23 September 2026, and sections 1, 2.3, 2.5, 5, 6 and 7 say what they used to say.