Privacy Policy

1. Information we collect

Account and sign-in

We use Auth0 for sign-in (including social logins like Google or Apple, where offered). We receive your email, name, an internal user ID, and sign-in metadata.

Payments and subscriptions

Payments are processed by Stripe and RevenueCat. We receive your subscription and entitlement status only. We don’t receive or store card numbers or purchase receipts.

App usage, device, and diagnostics

• Usage: feature interactions, session times, app version, errors and crashes.
• Analytics: Countly, using a pseudonymous user ID (no email or name).
• Mobile identifiers: where applicable (for example AAID/IDFA), for basic analytics and attribution. Never for targeted ads.

The live flow

• Your intention: subscribers can plant an intention. It’s used to shape the flow, kept for up to an hour while you’re in it, then deleted automatically.
• Your display name and an intention summary: may be heard by people in the live flow with you. There are no public leaderboards or archives.
• Pose choices, focus, intensity, ratings, and feedback: used to run and improve the service.
• Time in the live flow: we count the minutes you spend in the live flow each day, to apply the daily limits for free use. These totals are kept for two days.

If you join as a guest

You don’t need an account to join the live flow. To count a guest’s free daily minutes, your browser keeps a random ID that isn’t linked to you, and sends it along with your time zone (so a “day” is your day). If a browser doesn’t keep that ID, we use its IP address for that count instead. Clearing your browser’s site data starts a new ID.

Stored in your browser

The app remembers some choices on your own device, not on our servers: the character you practise as, your live flow settings (like volume and music), and the guest ID above.

What we don’t collect

Precise location, health records, contacts, or camera and microphone streams (beyond what your device normally does).

2. How we use it

• To run the service: sign you in, guide the live flow, keep everyone in step, and tailor the cues.
• Subscriptions and support: manage access, billing, and help when you ask.
• Fair use: apply the daily time limits for guests and free accounts.
• Safety and integrity: prevent abuse, troubleshoot, and secure the platform.
• Improvement: understand how features are used and how reliable they are (pseudonymously).
• Legal: comply with lawful requests and enforce our terms.

3. AI processing

The live flow is written and voiced with AI. We send the minimum needed: for example, the intentions and preferences of the people in the flow and where the flow is, to Anthropic (Claude) to choose poses and write the cues, and the cue text to OpenAI and Google Cloud Text-to-Speech to voice it.

We instruct our providers not to use customer content for training, keep what we send to a minimum, and avoid sending direct identifiers wherever possible.

4. Sharing and processors

We share data with these vendors only to run the service:

• Sign-in: Auth0
• Payments and subscriptions: Stripe, RevenueCat
• Hosting and storage: Google Cloud (storage), Render.com (including Redis and Postgres on Render)
• Analytics: Countly (pseudonymous user ID only)
• AI: Anthropic, OpenAI, Google Cloud Text-to-Speech

We do not sell your personal information or share it for cross-context behavioral advertising.

5. Cookies, storage, and SDKs

• Essential: sign-in session, and the browser storage described above.
• Analytics: Countly; mobile identifiers for analytics and attribution.
• You can block cookies, storage, or identifiers in your browser or device settings; some features may not work without them.

6. How long we keep it

• Intentions: up to an hour, while you’re in the live flow.
• Daily time totals (guests and accounts): two days.
• Account, usage, subscription, ratings, and feedback: until you ask us to delete them, or your account is inactive for 90 days, then deleted or anonymized.
• Logs: 30 days.
• We may keep minimal records where the law requires (for example fraud prevention or accounting).

7. Your rights and choices

Where applicable (for example under GDPR/UK GDPR or CCPA/CPRA), you can access your data, correct it, delete it, export it, and object to or restrict some processing.

To do any of these, email hi@ntntn.io from the address tied to your account. We’ll respond within the required timelines. (Self-serve deletion isn’t available in the app yet.)

8. International transfers

We operate mainly in the United States and use vendors (including Anthropic, OpenAI, Google, Stripe, RevenueCat, Auth0, and Render) that may process data in the US and other countries. Where required, we rely on Standard Contractual Clauses and comparable safeguards.

9. Security

• Encryption in transit and at rest; least-privilege access; audit logging.
• Two-factor authentication for administrative systems where supported.
• Regular patching and vendor due diligence.

No system is perfectly secure. If we identify a breach, we’ll notify you and regulators as the law requires.

10. Children

Seed Yoga is not directed to children under 13 (or the minimum age where you live). We don’t knowingly collect personal information from children. If you believe a child has given us personal information, email hi@ntntn.io and we’ll delete it. We don’t perform age verification.

11. Changes to this policy

We may update this policy as Seed Yoga evolves. We’ll post changes here and update the effective date; for material changes, we’ll give additional notice (for example by email or in the app).

12. California and EU/UK notices

• No sale of personal information, and no cross-context behavioral advertising.
• You may have the right to know, access, delete, correct, opt out of certain sharing, and limit use of sensitive data. We don’t separately process “sensitive intentions,” and intentions are deleted within an hour.
• For EU/UK residents, our legal bases are typically contract (to provide the service), legitimate interests (security, analytics, fair-use limits), and consent where required (cookies and SDKs).

13. Contact

Questions or privacy requests: hi@ntntn.io
Controller: Stoner Yoga LLC DBA The Intention Engine