Privacy
MyKehila is a product of Yetzirah LLC, and provides software to synagogues. Most of the personal information in the system is not ours — it belongs to the shul that entered it, and we hold it on that shul's behalf and act on its instructions. This page explains what is collected, why, who it reaches, and how it is kept safe.
Who we are
MyKehila (mykehila.org). Questions about this policy, or a request about your information, go to privacy@mykehila.org. If you are a member of a shul rather than a member of its staff, contact your shul's office first — they control their records and can usually answer faster than we can.
What we collect
Information a shul enters about its members
Names, addresses, email addresses and phone numbers; household relationships; English and Hebrew dates of birth; yahrzeit records; and details a shul keeps for religious practice, such as whether someone is a kohen or levi and when they last received an aliyah. Also membership status and plan, invoices, payments recorded against them, and kiddush sponsorships.
Information about people who sign in
Email address, a password stored only as a scrypt hash (never the password itself), and — where two-factor authentication is switched on — the secret needed to verify codes. Sessions are held in a signed cookie.
Records of activity
Changes made in the system are recorded: who made the change, when, what changed, and the IP address and browser the request came from. This exists so a shul can answer questions about its own records — who altered an invoice, who granted an administrator role. Passwords, two-factor secrets and member portal links are deliberately never written to these records.
Files a shul uploads
Logos, flyers, background images and documents intended for that shul's board or website.
What we do not collect
We do not store card numbers or bank account details. Payments are handled by Stripe, and those details go to Stripe directly without passing through our systems. We do not use advertising trackers, we do not sell information to anyone, and there is no analytics or tracking script on this page or on a shul's public site.
Why we hold it
To provide the service a shul is paying for: showing prayer times and announcements on its display board, keeping its membership records, issuing and collecting dues, giving members a page showing what they owe, publishing its website, and sending email it asks us to send. We also use it to keep accounts secure, to investigate problems, and to meet our own legal and accounting obligations.
We do not use a shul's member data to market to anyone, and we do not use it to train machine learning models.
Who it is shared with, and how
We share information only with the service providers needed to run the product. Each receives only what its job requires, over an encrypted connection:
- Amazon Web Services — hosting. The application and its database run on AWS in the United States.
- Resend — email delivery. Receives the recipient's address and the content of the message being sent, such as an invoice or a receipt.
- Stripe — payment processing, where a shul has switched it on. Receives payment and payer details directly; money is paid into the shul's own bank account, and we never hold it.
- Cloudflare — domain name service.
- Anthropic — only if a shul uses the optional drafting assistant, and only the shul's own public details, such as its name and town. Member information, financial information and anything personal is excluded from those requests by design, not by policy.
We may also disclose information if the law requires it, or to protect someone's safety. We would tell the affected shul unless we were legally prevented from doing so. If the business were ever sold or transferred, information would move with it and shuls would be told beforehand.
We never sell personal information, and we never share it for advertising.
How it is protected
- All traffic is encrypted in transit with HTTPS.
- Passwords are stored as scrypt hashes and are never recoverable, by us or anyone else.
- Each shul's records are isolated at the database level — every query is scoped to one shul, so one congregation cannot reach another's information.
- Access inside a shul is limited by role: someone given only gabbai access cannot see financial records.
- Two-factor authentication is available on every account.
- Sign-in attempts are rate limited, and failed attempts are recorded.
- Backups run nightly, are checked for integrity, and are kept on a rolling schedule.
- Changes to records are logged, and those logs can only be read by a shul's owner.
No system is perfectly secure. If information were ever exposed, we would tell the affected shuls promptly and explain what happened and what we were doing about it.
How long it is kept
A shul's information is kept while it uses the service. If a shul leaves, it can ask for an export, and we delete its records on request. Financial records and change logs may be kept longer where accounting or legal obligations require it. Backups age out on their own schedule, so deleted information can persist in backups for a short period after removal.
Your rights
You can ask what information is held about you, ask for it to be corrected, or ask for it to be deleted. Depending on where you live you may have further rights, including asking for a copy in a portable form or objecting to particular uses.
If you are a member of a shul, ask your shul's office — they hold your record and can change it directly. If they need our help, or if you would rather come to us, write to privacy@mykehila.org. We do not charge for this.
Children
Shuls record children as part of a household, entered by a parent or by the shul office — for birthdays, bar and bat mitzvah dates and family records. Children do not have accounts and cannot sign in. We do not knowingly collect information directly from a child.
Where information is held
Our servers are in the United States. If your shul is elsewhere, information is transferred to and processed in the United States.
Changes
If this policy changes materially we will tell the shuls using the service before the change takes effect. The date at the top always reflects the current version.