Privacy Policy
Privacy Policy
Effective date: 9 August 2026 Last updated: 9 August 2026
Who runs this app?
EveryBody Yoga — is a Canadian company, a partnership based in Saskatchewan - and the name you'll see on the App Store listing is 13251314 Canada, Inc., one half of the partnership and the developer of the App itself.
What do we collect?
Your name and email from Apple or Google sign-in, your subscription status, what you post in the community, and the videos you save to favourites and playlists
Do you sell my data?
No. We have never sold or rented personal information, and we do not share it for advertising
Do you track what I watch?
No. We don't record which videos you play or how far you got
Do you use AI on my data?
No. No AI reads your posts, profiles you, or makes decisions about you
Who can see what I post?
Other subscribers. The community is closed to non-members — but it is not private from the members inside it
Can I message another member?
No. There is no direct messaging in the app
Who is it for?
Adults, 18 and over
Where is it stored?
Your account and community data in Canada; videos in Germany. Not in the United States
Can I delete it?
Yes — your posts and comments any time, your whole account on request
Is this medical advice?
No. The EveryBody Yoga App is a wellness service, not healthcare, and is not covered by HIPAA
This summary is for convenience. The sections below govern.
2. Who we are
EveryBody Yoga is a business registered in Saskatchewan, Canada (registration number 102214886), used by a partnership between Susan Spinarski and 13251314 Canada, Inc.
13251314 Canada, Inc. holds the Apple Developer account and the technology accounts used to run the app, and is the organization accountable under Canadian privacy law for your personal information. That is why its name appears on the app's App Store listing and on your receipt.
Contact: EveryBody Yoga App - 13251314 Canada, Inc., Dartmouth, Nova Scotia, Canada privacy@everybodyyoga.app
This policy covers the EveryBody Yoga app on iPhone, iPad, and Android, the website at everybodyyoga.app, and any support or community interaction you have with us (together, the "Services").
Our Privacy Officer
Canadian federal law requires us to name an individual accountable for our privacy compliance.
Nichole Moser, Privacy Officer for EveryBody Yoga and 13251314 Canada, Inc. privacy@everybodyyoga.app
3. Information we collect
3.1 How you sign in
You sign in with Apple or Google. We never create, see, or store a password. Apple and Google handle authentication and tell us only that you signed in successfully, along with your name and email address.
If you use Sign in with Apple and choose Hide My Email, Apple gives us a private relay address instead of your real one. That works completely — we only need a working address to reach you, and we do not ask you for the underlying one.
3.2 What we collect
What: Name
When: From Apple or Google at sign-in
Why we need it: To identify your account and match it to your subscription
What: Email address
When: From Apple or Google at sign-in
Why we need it: To confirm you are an active subscriber, send service messages, and answer support requests
What: Display name and avatar
When: If you set one
Why we need it: To identify you to other members in the community. You choose an avatar from a set we provide — you cannot upload a photograph, and we never access your photo library
What: Posts, comments, and reactions
When: When you write or react
Why we need it: To publish them to other subscribers, as you intended
What: Favourites and playlists
When: When you save or organise videos
Why we need it: To show you your own library
What: Push notification token
When: If you turn notifications on
Why we need it: To send the notification to your device. Deleted when you sign out or when the token stops working
What: Device and app data
When: Automatically
Why we need it: Device model, OS version, app version, language, time zone — to make the app work and diagnose problems
What: Support correspondence
When: When you contact us
Why we need it: To answer you and keep a record
We use your name and email specifically to confirm and validate that you are an active subscriber before granting access to videos and the community. That is a contractual necessity, not an optional extra.
3.3 IP addresses and server logs
Our hosting and video delivery providers keep technical logs that include your IP address, as essentially all internet infrastructure does. We use these only to deliver content to your device, to diagnose faults, and to detect abuse — never to identify you, build a profile, or track you across other apps or sites.
Our database provider keeps these for 7 days, and our video delivery network keeps them for 3 days. Both delete them automatically after that.
3.4 What Apple and Google give us
Subscriptions are sold through Apple In-App Purchase or Google Play Billing, depending on where you downloaded the app. Apple or Google processes your payment. We never see your card number, billing address, or full payment details. We receive only whether a subscription is active, its renewal status, and an anonymous transaction identifier.
Apple's or Google's own privacy policy governs that transaction.
3.5 We do not track what you watch
We do not record which videos you play, how long you watch, or how far through you get. There is no viewing history in your account, and we cannot tell you what you practised last Tuesday because we never wrote it down.
Our video host counts plays at its end, as any video service does, so we know a given class has been watched a certain number of times overall. Those counts are not connected to individual accounts.
3.6 What we do not collect
We do not collect precise geolocation, your contacts, your camera or microphone, your photo library, or any data from Apple Health, Google Fit, or a wearable.
3.7 There is no AI in this app
EveryBody Yoga does not use artificial intelligence to generate content, read or analyse your posts, profile you, moderate the community, or make any decision about you. Your content is never used to train an AI model, by us or by anyone else.
We built the app ourselves. Some of the developer tools we used to write the software are AI-assisted — but those tools operate on our source code, not on your data, and they have no access to the app in operation or to anything you enter into it.
A note about the previous version. Earlier releases included a chat feature called YogAI, built on a third-party platform. That feature has been retired, the third-party project and account were deleted, and the conversation data collected through it was permanently deleted on 5 August 2026.
4. The community — what other people can see
The community is open only to active subscribers. It is closed to the public internet. It is not private from other members.
Visible to every other subscriber: your display name, your avatar, everything you post, every comment you write, your reactions, and when you posted them.
Visible only to us: your legal name, email address, subscription status, viewing history, favourites, and playlists. We never show these to other members.
There is no direct messaging. Members cannot send you private messages, and we have deliberately not built that feature. Everything in the community happens in the open, where it can be seen and moderated.
Please think before you post
People share injuries, pregnancies, illnesses, ages, bodies, and emotional states in wellness communities. That is often the point of one. But anything you post can be read, screenshotted, and repeated by other members, and we cannot control what they do with it. Post only what you are comfortable having seen by everyone in the community.
Deleting what you post
You can delete your own posts and comments at any time, from within the app.
Two honest limits. Deletion removes your content going forward — it does not reach copies other members already saved, and it does not remove your words where another member quoted them in their own post. And where a post was the subject of a moderation report, we keep a record of it for the period in section 9 so we can handle repeat conduct fairly.
When you close your account
Your posts and comments are deleted along with your account. Nothing you wrote stays behind under a placeholder name. Where you were part of a conversation, other members' replies will remain but your side of it will be gone.
Moderation
We moderate the community to keep it usable and safe.
We review content that members report to us, and we may remove content or suspend accounts where content breaches our Community Guidelines or Terms of Use. Moderation is done by a person, not by software and not by AI.
When we act, we keep a record of what was removed, why, and the account involved. We use these records only to apply our guidelines consistently and to handle repeat conduct — never for advertising or profiling.
If we remove your content or suspend your account, email privacy@everybodyyoga.app and a person will review the decision.
5. Wellness and health-related information
Some of what the Services record can reveal something about your body or your mind: that you saved a prenatal class to a playlist, that you favourited restorative sequences for back pain, that you posted about an injury or about anxiety.
We collect less of this than most wellness apps, because we do not record what you watch. What remains is what you deliberately save and what you deliberately write.
Several US states treat that as consumer health data and regulate it specifically, with obligations that apply regardless of company size.
We treat it as sensitive. We do not use it for advertising, we do not sell it, and we disclose it only to the service providers in section 7 who help us run the app.
If you live in Washington, Nevada, Connecticut, or Maryland, additional rights apply — see our separate Consumer Health Data Privacy Policy.
We are not a healthcare provider. EveryBody Yoga is not a covered entity or business associate under HIPAA, and what you enter here is not protected health information under that law. Nothing in the Services is medical advice. Talk to a physician before starting any exercise programme, especially if you are pregnant, injured, or managing a condition.
6. Why we use your information, and our legal basis
Purpose: Create and maintain your account
What we use: Name, email
Legal basis (EEA/UK): Performance of a contract
Purpose: Confirm you are an active subscriber and grant access
What we use: Email, Apple subscription status
Legal basis (EEA/UK): Performance of a contract
Purpose: Deliver videos and save your favourites and playlists
What we use: Account data
Legal basis (EEA/UK): Performance of a contract
Purpose: Publish your posts, comments, and reactions to members
What we use: Display name, avatar, content
Legal basis (EEA/UK): Performance of a contract
Purpose: Moderate the community and enforce our guidelines
What we use: Content, reports, account data
Legal basis (EEA/UK): Legitimate interests in a safe community
Purpose: Respond to support requests
What we use: Correspondence, account data
Legal basis (EEA/UK): Performance of a contract
Purpose: Keep the app working and fix faults
What we use: Device data, server logs
Legal basis (EEA/UK): Legitimate interests
Purpose: Send push notifications you have turned on
What we use: Push token
Legal basis (EEA/UK): Consent
Purpose: Send service messages — receipts, security notices, policy changes
What we use: Email address
Legal basis (EEA/UK): Performance of a contract; legal obligation
Purpose: Prevent fraud, abuse, and account sharing
What we use: Technical and account data
Legal basis (EEA/UK): Legitimate interests
Purpose: Comply with law
What we use: As required
Legal basis (EEA/UK): Legal obligation
Where we rely on consent — push notifications, and consumer health data where the law requires it — you can withdraw it at any time. Withdrawal does not undo processing already done, and some withdrawals mean we can no longer provide part of the Services. We will tell you if that is the case.
7. Who we disclose information to
We do not sell your personal information. We do not rent it. We do not share it for cross-context behavioural advertising or targeted advertising. We have not done so in the preceding twelve months. There are no advertising trackers in this app.
We disclose personal information only as follows.
7.1 To other members
Your display name, avatar, posts, comments, and reactions are shown to other subscribers, as described in section 4. That is the purpose of the community.
7.2 To service providers
We built this app ourselves and use a deliberately short list of vendors to run it. Each acts on our instructions, may use the information only to provide their service to us, and may not use it for their own purposes.
Provider: Apple Inc.
What they do: On iPhone and iPad: app distribution, sign-in, payment, subscription management
What they receive: Name, email, transaction and subscription data
Where: US / global
Provider: Google LLC
What they do: Sign-in, and on Android also app distribution, payment, and subscription management
What they receive: Name, email, transaction and subscription data
Where: US / global
Provider: Supabase (a US company)
What they do: Database, authentication, and app backend
What they receive: Account data, posts, comments, reactions, favourites, playlists, viewing history
Where: Canada
Provider: Bunny.net (a Slovenian company)
What they do: Video hosting and delivery
What they receive: Playback requests, IP address
Where: Frankfurt, Germany
Provider: RevenueCat
What they do: Managing your subscription and confirming your access
What they receive: An account identifier, subscription and purchase status, device information
Where: US
Provider: Expo
What they do: Delivering push notifications
What they receive: A push token for your device, and the content of the notification
Where: US
Provider: GitHub
What they do: Storing the app's source code
What they receive: No member data at all
Where: US
Provider: GoDaddy
What they do: Our email mailboxes, including privacy@everybodyyoga.app, and the marketing website
What they receive: Anything you email us, including support correspondence; website visitor data
Where: US
We do not currently use an analytics service. There is no analytics SDK, no advertising SDK, and no cross-app tracking SDK in this app.
We may add product analytics in future to understand which features are used and where the app is failing. If we do, it will be limited to aggregate counts — how many people opened a screen, how long sessions last — and it will not record your screen or capture what you write in the community. We will update this policy and tell you before that happens, as section 16 requires.
If we do, we will update this policy and tell you before it starts, as section 16 requires.
A note on notifications. Push notifications travel through Expo and then through Apple's or Google's notification service to reach your device. We keep the text of community notifications general — "someone replied to your post" rather than repeating what the post said — so that nothing personal appears on a lock screen or passes through those services unnecessarily.
A note on where our vendors are. We store your data in Canada and Europe by choice. Several of the services above are United States companies, and some process data there — RevenueCat, Expo, and our mailboxes at GoDaddy. We are telling you this rather than leaving it out. Each is bound by contract to process your information only on our instructions.
7.3 Legal and protective disclosures
We may disclose information where required by law, court order, subpoena, or other lawful process; where necessary to establish, exercise, or defend legal claims; or where necessary to protect someone's safety.
Where we are legally permitted to, we will tell you before disclosing your information in response to a legal demand.
7.4 Business transfer
If we are involved in a merger, acquisition, financing, or sale of assets, personal information may transfer as part of it. Any recipient will be bound to honour this policy for information collected before the transfer, or we will notify you and give you a real opportunity to delete your account first.
8. Where your information is stored
Your account data, posts, comments, favourites, and viewing history are stored with Supabase in Canada. Videos are hosted and delivered by Bunny.net, a Slovenian company, from Frankfurt, Germany.
We choose Canadian hosting wherever a provider offers it, and European hosting where it does not. Bunny.net has no Canadian storage region, so our video library sits in Germany — a jurisdiction with among the strongest data protection standards in the world. Several smaller services listed in section 7.2 are United States companies; section 7.2 says which.
One limit we would rather state than imply away. Supabase, the company that runs our database, is incorporated in the United States even though our data sits in Canada. In some circumstances US legal process can reach data held by US companies wherever the servers are. We think that risk is remote for a small yoga community, and we are telling you about it rather than making a guarantee we cannot fully keep.
Canadian users: personal information stored or processed outside Canada is subject to the laws of that country and may be accessible to its courts, law enforcement, and national security authorities. Canada and the European Union each recognise the other's data protection standards as adequate, and our vendors are contractually required to protect your information to a standard comparable to Canadian law.
Quebec residents: we do not currently have subscribers in Quebec. If we do, Quebec's Law 25 requires us to complete a privacy impact assessment before transferring personal information outside the province, and we will do so.
European Union: the app is not available for download in any European Union country, on either the App Store or Google Play, and we do not offer or market the Services there.
United Kingdom and elsewhere: we do not market or direct the Services to people in the United Kingdom, and prices shown in local currency on App Store storefronts are Apple's automatic conversion rather than pricing we have set. Our business, our language, and our marketing are Canadian and American. That some of our video content is stored on servers in Germany does not change this — where data sits is not where a business operates.
If you are outside Canada and the United States and choose to subscribe anyway, we will honour the rights in section 11.4 and handle your information under the same terms as everyone else.
9. How long we keep information
Category: Account data (name, email)
Retention: Deleted immediately when you ask us to. Otherwise deleted automatically after 24 months of inactivity
Category: Posts, comments, reactions
Retention: Kept while your account is open; deleted with your account
Category: Favourites and playlists
Retention: Same as account data
Category: Which videos you watched
Retention: Never recorded — see section 3.5
Category: Push notification tokens
Retention: Deleted when you sign out, or when the token stops working
Category: Moderation reports and records
Retention: 12 months, then anonymised
Category: Support correspondence
Retention: 24 months
Category: Subscription and transaction records
Retention: 7 years, as Canadian tax law requires
Category: Server and delivery logs (including IP)
Retention: 7 days at our database provider; 3 days at our video delivery network
Category: Aggregate, de-identified statistics
Retention: Indefinitely — these cannot identify you
Category: Records of privacy breaches
Retention: 24 months from the day we conclude a breach occurred — required by Canadian federal law
Deleting your account. When you ask us to delete your account, we delete it and everything connected to it straight away, not on a queue.
One honest detail: we take a database backup every day and keep each one for seven days, so that a technical failure doesn't destroy the community. A copy of your data may therefore sit in a backup for up to seven days after you delete your account. Those backups are encrypted, nobody reads them in the ordinary course, and each is overwritten automatically on its seventh day.
If you stop using the app. We do not delete your account the moment a subscription lapses — your posts, favourites, and playlists stay where they are. If you have not signed in for 24 months, we delete the account and its contents. We will email you before that happens.
10. How we protect information
Access is limited to one person. A single named administrator can reach member data, and only where necessary to run the service or moderate the community.
Every administrative account is protected by multi-factor authentication — our database, developer, video hosting, and email accounts.
Data is encrypted in transit and at rest by our hosting providers.
Our database enforces row-level security. Each member's records are technically walled off from every other member's at the database level, rather than merely hidden by the app. This is the control that matters most in a community app, and we have it switched on.
We never see your password, because there isn't one — sign-in is handled entirely by Apple and Google.
We never see your payment details, because Apple and Google process every transaction.
No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will notify you and the relevant regulators as the law requires.
11. Your rights and choices
11.1 Everyone
Wherever you live, you can:
- Access the personal information we hold about you
- Correct anything inaccurate or incomplete
- Delete your posts and comments, or your whole account — there is a Delete Account option in the app's settings, and you can also write to us
- Export your account data, posts, favourites, and playlists in a portable format
- Turn off push notifications at any time
- Complain to us and, if we do not resolve it, to a regulator
Email privacy@everybodyyoga.app. We respond within 30 days. We may verify your identity first — usually by confirming you control the account email. There is no fee.
11.2 Canada
Your rights come from PIPEDA and, depending on where you live, Quebec's Law 25 or the Alberta or British Columbia Personal Information Protection Act.
You may complain to the Office of the Privacy Commissioner of Canada — priv.gc.ca, 1-800-282-1376.
Quebec residents additionally have the right to be informed of any automated decision-making (we use none — see section 3.6), to request de-indexing in certain circumstances, to receive your computerised personal information in a structured, commonly used technological format, and to complain to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).
11.3 United States
Twenty states now have comprehensive consumer privacy laws in effect. Most set thresholds we do not currently meet — but we extend these rights to all US residents regardless of state:
- Know what we collect, from where, why, and who we disclose it to
- Delete personal information we hold
- Correct inaccurate information
- Obtain a portable copy
- Opt out of sale, of sharing for cross-context behavioural advertising, and of profiling for significant decisions — we do none of these, so there is nothing to opt out of
- Limit use of sensitive personal information — we use it only to provide the Services you asked for
- Non-discrimination — exercising a right will never cost you service or money
CCPA/CPRA notice at collection (California). In the past twelve months we collected: identifiers (name, email, display name, device identifiers, IP address); commercial information (subscription status); internet or network activity (app usage, device and connection data); user-generated content (posts, comments, reactions); and sensitive personal information limited to health-related inferences that could be drawn from viewing and community activity. Sources, purposes, and recipients are in sections 3, 6, and 7. We have not sold or shared personal information in the preceding twelve months, and we do not sell or share the personal information of consumers under 16.
You may use an authorised agent; we will require written proof of authorisation.
Shine the Light (Cal. Civ. Code §1798.83). We do not disclose personal information to third parties for their own direct marketing.
You may complain to your state Attorney General.
11.4 United Kingdom, Switzerland, and elsewhere
You have rights of access, rectification, erasure, restriction, portability, and objection to processing based on legitimate interests, and the right not to be subject to solely automated decision-making. We do not carry out automated decision-making at all.
Complain to your national data protection authority, or to the UK Information Commissioner's Office (ico.org.uk).
12. Age
EveryBody Yoga is for adults. You must be 18 or over to create an account, and we do not knowingly collect personal information from anyone under 18. The app is rated accordingly on the App Store and on Google Play.
If you believe someone under 18 has an account, email privacy@everybodyyoga.app and we will delete it and its data promptly.
We do not sell or share anyone's personal information, and we do not use it for targeted advertising or profiling.
13. Cookies and the website
No videos and no community content are available on our website. Everything is in the app, behind the subscription. The site at everybodyyoga.app is a marketing page built on GoDaddy's website builder, and it sets four cookies.
Cookie: scc_session
What it does: Keeps your browsing session working while you're on the page
Lifetime: 20 minutes
Type: Necessary
Cookie: dps_site_id
What it does: Tells GoDaddy which server region should deliver the page
Lifetime: Until you close your browser
Type: Necessary
Cookie: _tccl_visit
What it does: Groups your page views together so a single visit is counted once
Lifetime: 30 minutes
Type: Analytics
Cookie: _tccl_visitor
What it does: Gives your browser a random identifier, so someone returning next week is counted as the same visitor rather than a new one
Lifetime: 1 year
Type: Analytics
The two analytics cookies are part of GoDaddy's built-in traffic measurement. They tell us how many people visited and which pages they looked at. They do not tell us who you are, they are not linked to your app account, they are not used for advertising, and nothing from them is sold or shared.
You can clear or block cookies at any time through your browser settings, and a banner on your first visit lets you record a preference.
This page is part of that website. Opening our privacy policy, terms, or consumer health data policy sets the same cookies described above, because all three are hosted alongside our marketing site.
The app itself uses no cookies and contains no advertising or cross-app tracking SDKs.
14. Email from us
We do not send marketing email. We do not run a newsletter, we do not promote anything by email, and we do not use your address for anything beyond running your account.
The only email you will receive from us is a service message — a notice about your account, a security alert, a response to something you asked us, or notice of a change to this policy. You cannot unsubscribe from these while you hold an account, because they are how we reach you about the service itself.
If that changes and we start sending anything promotional, we will ask you to opt in first. We will not add you to a list because you happen to be a subscriber.
15. Privacy breaches
If a breach of security safeguards creates a real risk of significant harm to you, we will notify you as soon as feasible and report it to the Office of the Privacy Commissioner of Canada, and to any other regulator whose law requires it.
We keep a record of every breach of security safeguards, whether or not it triggers notification, for 24 months.
16. Changes to this policy
We post changes here with a new "Last updated" date.
If a change materially affects how we handle your information — a new category collected, a new purpose, a new class of recipient — we will notify you in the app or by email before it takes effect, and where the change needs your consent we will ask for it rather than infer it from continued use.
17. Contact us
13251314 Canada, Inc., trading as EveryBody Yoga Saskatchewan business name registration 102214886 Dartmouth, Nova Scotia, Canada
Privacy Officer: N. Moser
If our response does not satisfy you, you may contact the Office of the Privacy Commissioner of Canada, your state Attorney General, or your national data protection authority.