Privacy policy

Last updated 8 August 2026

This describes what we store, why we store it, and who else can see it. It is written about the system as built rather than about what a service like this might in principle do.

What we collect

Account - name, email address, password (stored only as an Argon2 hash, never as text), and time zone. We do not ask for your country: a rough one is inferred from your time zone for support and reporting, and your checkout currency comes from the same time zone, in your browser, with no location lookup and no third party involved.
Bookings - which sessions you booked, when, whether you cancelled, and whether you attended.
Credits - a permanent, append-only record of every change to your balance. It is never edited, because a balance you cannot audit is a balance you cannot trust.
Payments - amount, currency, and the reference our payment provider gives us. Card numbers never reach us; the card details are entered on Stripe's or Razorpay's own checkout.
Join access - each time a session's video link is fetched, with the time and IP address. The link is a credential, so its use is logged; the same record is what tells the instructor who turned up.
Messages - anything you send through the contact form.

What we do not collect

No advertising or analytics trackers, and no third-party cookies.
No session recordings, transcripts, or audio. We do not record classes.
No card, UPI, or bank details - those stay with the payment provider.

Cookies

Two, both strictly necessary: an httpOnly sign-in cookie and its refresh counterpart. There is no tracking cookie to consent to, which is why this site has no cookie banner.

Who else sees it

Your instructor - your name, and whether you attended their session. Not your email, your balance, or your other bookings.
Google - a session is a Google Calendar event on the instructor's own account, which is what creates the Meet link. Learners are deliberately not added as calendar guests, so your email address is not sent to Google.
Stripe and Razorpay - whichever handles your payment receives what it needs to take it.
Nobody else. We do not sell or share personal data.

How long we keep it

Account and booking history: while your account exists.
Payment and credit records: seven years after the transaction, because tax law requires it - these survive account deletion in a form tied to the transaction rather than to a live profile.
Join access logs: twelve months.
Contact messages: two years.

Your rights

You can ask for a copy of your data, ask us to correct it, or ask us to delete your account. Write from the address on the account through the contact form and we will act within 30 days, keeping only the financial records named above.

Security

Passwords are hashed with Argon2. Instructors' Google tokens are encrypted at rest. Session video links are served only to people booked onto that session, only inside the joining window, and every request for one is logged.

Changes and contact

Material changes are announced by email before they take effect. Any question about this policy - including a request under it - goes to the contact form or to [email protected].