Tov PocketTovPocket

Privacy Policy for Tov Pocket

Last Updated: November 5, 2026

At Tov Pocket (https://tovpocket.com), operated by MITP5787, Inc., a Florida corporation ("Company," "we," "us," or "our"), we respect your privacy and are committed to protecting your personal data. This policy outlines how we handle information when you use our services. It also serves as our notice at collection for California residents (see Section 7).

1. Information We Collect

When you choose to sign in using Google or a telephone number, we collect specific information to create and manage your account:

  • Identity Data: Your name.
  • Contact Data: Your verified email address associated with your Google account, or your telephone number verified with a callback or a text message code.
  • Authentication Data: A unique identifier (ID) provided by Google to recognize you upon return.

Note: We do not receive or store your Google password. Authentication happens entirely on Google's secure servers.

As you use Tov Pocket, we also collect:

  • Location Data: The approximate area (country and region) that your network address suggests, the ZIP code or place name you type into a search, and, only if you allow your browser to share it, the coordinates it reports. Your last search area is also remembered in your own browser (see Section 3).
  • Activity Data: The pages you view, the searches you run, the coupons you claim or redeem, the reviews you write, the sweepstakes you enter, the invitations you send, and the places you save to your Favorites and the names you give your lists.
  • Messages: Anything you send us by email, text or a contact form, including your name and address as they appear on that message.
  • Technical Data: Browser and device type, and your network (IP) address. For page-view counting the address is stored only as a one-way hash; the full address is kept briefly in security logs (Section 5).
  • Business Account Data: If you list a business, the contact and billing details you give us for that business.

1a. Business Contact Information and Email Permission

Separately from account sign-in, we maintain a directory of businesses. Some of the contact details
in it — including a business's publicly listed email address — are gathered from that business's
own public website, not provided to us by an account holder.

If we email a business at an address we found this way, that message says so plainly and includes a
link asking whether they would like to keep hearing from us. When someone uses that link, we record:

  • Their answer (yes or no) and the date and time.
  • The IP address and browser user agent of the request that answered it.

We record those last two for one reason: to be able to show, if we are ever asked, that a real
person gave permission rather than a piece of software. They are not used for advertising,
profiling, or tracking anyone across websites. We keep a consent record for as long as we hold the
address, and delete it when the address is removed.

If nobody answers after a small number of emails, we stop emailing that address. Saying no removes
the address immediately, and every email we send also carries a one-click unsubscribe link that
takes effect straight away.

2. How We Use Your Data

We use your data strictly for the following:

  • To create your Tov Pocket account and verify your identity.
  • To personalize your experience (e.g., displaying your name).
  • To send coupons and confirmation emails you request.
  • To send essential service-related communications to your verified email.
  • To show you listings near you and remember the area you last searched.
  • To run the sweepstakes and referral programs you choose to join.
  • To keep your Favorites and, when you turn on a list's share link, to show that list to anyone who opens the link. A shared list shows its name and its places, never your name or email, and stops being visible the moment you stop sharing it.
  • To understand, in aggregate, which pages and features are used.
  • To detect and prevent fraud, abuse and unauthorized access.
  • No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.
  • SMS messages are used to share coupon information and you can opt out at any time by replying with STOP.
  • Customers visit our public website and enter their mobile phone number into a web form to receive a single one-time discount coupon code via SMS. Messaging is strictly transactional and user-initiated upon form submission. We do not send recurring marketing blasts or share opt-in data with third parties.

3. Cookies, Browser Storage and Analytics

Tov Pocket sets a small number of first-party cookies. None of them is used for advertising, and none follows you to other websites. There is no cookie banner because none of these cookies requires consent under United States law.

  • jewish_fun_session — keeps you signed in. Not readable by page scripts. Expires after 7 days.
  • jewish_fun_authed — tells the page whether you are signed in so it can show the right menu. Expires after 7 days.
  • jewish_fun_oauth_state — protects the Google sign-in handshake against forgery. Set only during sign-in, for 10 minutes.
  • kp_ref — remembers who invited you through a referral link so they receive credit if you join a sweepstakes. Expires after 30 days.
  • kp_sw_day — notes that today's sweepstakes visit entry has already been counted. Expires after 5 minutes.
  • d1_bm — a database bookmark so that a change you just made is shown back to you immediately. Not readable by page scripts. Expires after 60 seconds.
  • jewish_fun_grounding_off — temporarily switches off an optional AI web-search feature after it hits a rate limit. Expires after 24 hours.

Your browser's local storage holds the area you last searched (which may be the coordinates your browser shared), the ZIP code you confirmed, a place you tapped ♡ on before signing in (kept for up to 30 minutes so it can be saved once you are back), and, for business owners who use it, a business ID and PIN. Session storage holds a random identifier for the current tab, used to count page views, and a few display preferences. These values never leave your device except as described in this section, and clearing your browser's site data removes them. Clearing cookies signs you out.

Analytics. We measure site usage in two ways:

  • Cloudflare Web Analytics, a privacy-first service that uses no cookies and no device fingerprinting and does not track visitors across sites.
  • Our own page-view counts, which record the page address, the time, the random tab identifier above, your account if you are signed in, and a one-way hash of your network address. These are kept for 60 days (Section 5). We also record device type and approximate location (country, region and city) for aggregate reports.

We do not use Google Analytics, advertising pixels or social media trackers.

Do Not Track and Global Privacy Control. We do not sell or share personal information, so there is nothing for an opt-out signal to switch off. We nonetheless treat a Global Privacy Control signal as a valid request to opt out of any sale or sharing.

4. Service Providers (Sub-processors)

We rely on a small number of companies to run Tov Pocket. Each receives only the data it needs to do its job for us and is bound by its service terms to use that data only to provide the service. We do not sell personal information to any of them.

  • Cloudflare, Inc. (United States) — hosts the website and its database, stores files, routes our email, provides the analytics described in Section 3, derives your approximate location (country and region) from your network address, and takes screenshots of business websites. As our host, Cloudflare handles every request you make, including your network address.
  • Twilio Inc. (United States) — delivers our text messages and verification phone calls. Twilio receives the phone numbers you give us — including a friend's number when you ask us to text them an invitation — and the content of each message. Twilio may not use these numbers for its own purposes.
  • Resend, Inc. (United States) — delivers our email. Resend receives email addresses, names and message content.
  • Stripe, Inc. (United States) — processes payments for business customers only, on pages hosted by Stripe. We never see a full card number. Consumers are never charged.
  • Google LLC (United States):
    • Google Sign-In — when you sign in with Google, Google tells us your name, email address and account ID.
    • Google Maps — every venue and business page embeds a Google map of that listing's location and a "Get directions" link. Your browser loads the map directly from Google, so Google sees your network address and may set its own cookies under the Google Privacy Policy. The map shows the listing's location, not yours.
    • Gemini AI — used mainly by our staff to maintain listings. Two visitor features send what you type to Gemini to interpret it: a location you enter that we cannot match, and a search phrase we cannot match. Nothing identifying you is sent with the text.
    • Google Web Risk — checks business website addresses for malware and phishing. No personal data is sent.
  • Anthropic, PBC (United States) — Claude AI helps us find business websites and helps our staff summarize and draft replies to messages sent to our support and sales mailboxes. A message you send us may therefore be processed by Anthropic to produce a summary or a draft for a human to review.
  • ZeroBounce (United States) — checks that an email address can receive mail before we write to it. Used for business addresses.
  • OpenStreetMap Foundation (United Kingdom) — turns the coordinates of searches into a town or neighbourhood name for our aggregate reports. Coordinates only; nothing identifying you is sent.
  • CJ Affiliate (Commission Junction LLC) and deal websites such as Groupon (United States) — when you press "See deal" on a deal from another website, you leave Tov Pocket through a CJ Affiliate link. We pass CJ a reference to the listing (for example "venue 12, deal 345") so a commission can be credited, never your name, email or account. CJ and the deal website may set their own cookies under their own privacy policies.
  • Browser push services (Apple, Google or Mozilla, depending on your browser) — if you turn on notifications, your browser's push service delivers them. We store the subscription address your browser gives us and the browser type.

Our fonts and scripts are served from our own domain; we do not load fonts or scripts from Google or any other third party, apart from the Cloudflare analytics beacon above. We will update this list before adding a provider that handles personal data.

5. Data Retention

We keep personal data only as long as it is needed for the purpose it was collected for, and then delete it automatically on the schedule below.

  • Account and profile data — for as long as your account exists. After a deletion request, see Section 10.
  • Sign-in and verification attempt logs (including the full network address) — 7 days.
  • Sign-in security events (password sign-in attempts and changes) — 90 days.
  • Page-view records — 60 days.
  • Error logs (which may include a page address and network address) — 90 days.
  • Search history (search area and terms, used to compare one season with the last) — 400 days.
  • AI request logs (what was sent to and returned by an AI provider, including the two visitor features in Section 4) — 400 days.
  • Email you send to our support and sales mailboxes — the original message file for 730 days (2 years); the conversation itself is kept while we may need it to help you.
  • Delivery records of text messages and emails we sent (number or address, content, time) — kept as our compliance record of consent, opt-outs and delivery under telephone and email marketing laws, for as long as we operate those programs.
  • Sweepstakes entries — kept for audit as the Official Rules of each sweepstakes state.
  • Cached copies of business websites — refreshed after 7 days; website safety checks after 14 days.
  • Cookies — the lifetimes listed in Section 3.

A nightly copy of the database is kept for recovery and testing. It is overwritten every night, so a deletion reaches it within a day.

6. Children's Privacy

Tov Pocket helps parents and other adults plan family activities. It is intended for people 18 years of age or older, and it is not directed to children under 13. We do not knowingly collect personal information from anyone under 13, and our sweepstakes are open only to adults.

If you believe a child under 13 has given us personal information, email support@tovpocket.com and we will delete it promptly. We comply with the Children's Online Privacy Protection Act (COPPA).

7. Your Privacy Rights — California (CCPA/CPRA) and Other US States

This section applies to residents of California and of other states with comprehensive consumer privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon and Montana). We extend these rights to every resident of those states.

Categories of personal information collected in the last 12 months, their sources and purposes:

  • Identifiers — name, email address, telephone number, Google account ID, network address and device identifiers. Source: you, Google (when you sign in with it) and your device. Purpose: your account, the messages you ask for, and security.
  • Commercial information — coupons claimed and redeemed, and purchases made by business customers. Source: you. Purpose: providing the service.
  • Internet or network activity — pages viewed, searches run and referral links used. Source: your device. Purpose: showing you results and measuring the site in aggregate.
  • Geolocation data — the approximate area suggested by your network address, the ZIP code or place you type, and precise coordinates only when you allow your browser to share them. Source: your device and you. Purpose: finding listings near you. Precise coordinates are used only to run your search and are never used to infer anything about you.
  • Inferences — none. We do not build profiles.
  • Sensitive personal information — none, other than precise geolocation when you choose to share it, which we use only to provide the service you asked for.

Disclosure. We disclose personal information only to the service providers listed in Section 4, for the business purposes described there. We do not sell personal information and we do not share it for cross-context behavioral advertising, and we have not done so in the preceding 12 months. We have no actual knowledge of selling or sharing the personal information of anyone under 16.

Your rights. Subject to applicable law, you may:

  • Know and access the personal information we hold about you, including the categories and specific pieces, and receive a copy in a portable format.
  • Delete personal information we collected from you (Section 10 explains what we keep and why).
  • Correct inaccurate personal information.
  • Opt out of the sale or sharing of personal information, and limit the use of sensitive personal information — neither of which we do.
  • Not be discriminated against for exercising any of these rights. Our service is free to consumers and that does not change.

How to exercise them. Email support@tovpocket.com with the subject "Privacy Request", or write to the address in Section 12. We verify a request by matching it to the email address or telephone number on the account, or by asking you to sign in. An authorized agent may submit a request on your behalf with your signed permission. We respond within 45 days; if we need longer, we will tell you why and take up to a further 45 days. If we decline a request, you may appeal by replying to our decision; we will review it again and tell you how to contact your state's attorney general if you still disagree.

California "Shine the Light". We do not disclose personal information to third parties for their own direct marketing.

8. Data Protection and Industry Standards

We protect your data using industry-standard security protocols:

  • Encryption: All data transmitted between your browser and our servers is encrypted via SSL/TLS.
  • Access Control: We use secure tokens (OAuth 2.0) to communicate with Google, ensuring we never have direct access to your Google account.
  • No Data Sales: We will not sell, trade, or provide your personal data to any third-party organizations or ad networks.

9. Third-Party Platform Compliance

  • Google: We adhere to the Google API Services User Data Policy, including the Limited Use requirements.

10. Data Deletion and Revocation

You may request deletion of your account and data at any time.

How to delete your data:

  1. Request: Email us at support@tovpocket.com with the subject "Data Deletion Request." Within 30 days we deactivate your account, remove your name and profile data, stop every message to you, and delete your activity data. We keep only what we must: a record that the email address or telephone number was closed so it cannot be reused fraudulently, the message delivery and consent records and sweepstakes entries listed in Section 5, and anything the law requires us to retain.
  2. Google Revocation: Go to your Google Account Settings, select Security, find "Your connections to third-party apps & services," select Tov Pocket, and click Delete all connections.

11. Changes to This Policy

We may update this policy to reflect changes in our practices or for legal reasons. We encourage users to check this page regularly for updates. The date at the top shows when it last changed.

12. Contact Information

For questions regarding this policy or your data, please contact:

MITP5787, Inc.
P.O. Box 640088
North Miami Beach, FL 33164

Email: support@tovpocket.com
Website: https://tovpocket.com

See also: Terms of Service · Refund Policy