What we collect, and what we don't.

Cookies

One, and only for measurement. A cookie named sid holds a random identifier so that several page views in one visit can be counted as one visit rather than several. It expires after 30 minutes, is first-party (SameSite=Lax), and contains nothing about you, no name, no email, no account, nothing carried over from a previous visit.

It is not set at all if your browser asks us not to. We honour Do Not Track and Global Privacy Control: with either enabled, the measurement script stops before it runs, so no cookie is written and no request is made. Enabling GPC in your browser is the switch, we do not need a banner to ask you, because we would rather read the signal you already set.

No advertising cookie, no social widget and no cross-site identifier is set by any part of this site.

What stays on your device

A few small values are kept in your browser. Except where noted, they never leave your device and we cannot read them:

• theme, whether you chose light or dark.
• mly.pose3d.v1, which pose models you have opened, so the viewer knows when to ask for an email.
• mly.pose3d.force, a development flag, unset for readers.
• mla-optout, only if you opened a link containing ?mla-optout. It switches visit measurement off in that browser, and ?mla-optout=0 removes it.
• mly-attr, on retreat pages, kept until you close the tab: how you arrived here (see the retreat forms below). It is sent to us only if you submit a retreat enquiry or booking.
• mly-receipt, after you pay a retreat deposit, kept until you close the tab so the thank-you page can show your receipt.

Clearing your browser data removes all of them, and nothing breaks.

What the forms collect

Each form collects only the fields it shows you:

• Newsletter, your email address and where you signed up. The same signup sits behind the first-timer checklist on studio pages and the 3D pose library, which asks for an email once you have opened a couple of poses.
• Contact, name, email, topic and your message.
• A question for a studio, name, email and your question. It comes to us, and we pass the question on to that studio so it can be answered.
• Retreat enquiry, name, email, the room or stay you want, how many of you are travelling, and a phone number and message if you add them. We pass it to the retreat's host, who holds the places. From the retreats page you can instead ask us to match you: the same fields, with when you would go in place of a room, plus the filters and search you had set.
• Retreat booking, your name, email, phone, country and any notes, the names and email addresses of anyone travelling with you, and the package you chose. The booking is saved when you start paying, so an unfinished payment still leaves a record. A completed one also emails you a receipt. The payment itself goes to PayPal, see below.
• Private events (the sound bath, corporate wellness, package and event-builder pages), name, email, phone, the date, number of guests, area and the options you chose, plus your message.
• Submit a studio, studio name, your name and email, neighbourhood, website, styles and a short description.
• Submit an event, the event's name, date, time, venue, neighbourhood, link and details, plus your name and email.

The retreat enquiry and booking forms also send how you arrived: the campaign tag on the address (?utm_source=…), an ad click ID if there was one, the site that linked you here, the first page you landed on, and whether you are on a phone, tablet or desktop. It tells us which links bring people who go on to enquire, and it is kept with that enquiry or booking only.

Each submission does two things: it emails us, and it is stored in a database on our own server so that an enquiry cannot be lost in an inbox and we can see whether we have already replied. The record holds the fields you filled in, the page you sent it from, the time, and a one-way hash of your IP address rather than the address itself. The email to us does include the address, see below.

The database runs on the same hosting as this site. The database itself is not shared with anyone, no profile is built from it, and it is never combined with the measurement data described above. What leaves it is only what a form tells you: a studio question goes to that studio, a retreat enquiry to that retreat's host. For a submitted studio or event, its details are what we may publish; your name and email are not. Records are archived after 12 months.

Who can see what you send

At MyLAyoga, two people: the site owner, and the yoga therapist you would be writing to. They sign in to a private dashboard on this domain with individual accounts, and every change made there is recorded against the person who made it. There is no shared login and no third-party CRM. Outside MyLAyoga, a studio question or retreat enquiry also goes to that studio or host, as described above.

Measuring visits

We count visits ourselves rather than handing the job to Google Analytics or similar. The script is served from this domain, sends its data to this domain, and records how a page was used, never what you typed, and never anything that follows you to another site.

Specifically, it records:

• which pages were opened, in what order, and how far down each was scrolled;
• roughly how long each was read, and whether the visit came from a phone or a desktop;
• where on the page a click landed, a position, plus the kind of element (a link, a heading) and its name in the page's own markup. Never the text you clicked, and never anything you typed;
• which links took you off this site, so we can tell which recommendations are actually useful, the destination address only;
• that a form was submitted, the fact and which form, never the contents. What you actually wrote is covered under What the forms collect above;
• the campaign tag on the address you arrived by, if it had one, the ?utm_source=… that tells us a newsletter link brought you rather than a search.

None of it is joined to a name, an email or an address, and none of it leaves this domain. Because the identifier behind it changes every day, we cannot tell a returning visitor from a new one, that is a deliberate trade, and it is why there is no "returning visitors" number anywhere in what we look at.

As of this revision the storage is on: what the script sends is written down, in a database on this same server. Nothing is shared with anyone, none of it is sold, and none of it leaves this domain. There is no automatic deletion date yet, when we set one, this paragraph will say what it is. Either way, DNT or GPC stops the whole thing: with either switched on the script never loads, so there is nothing to write.

Your IP address

Two things touch it. The notification email each form sends us, apart from a retreat booking's, includes your IP address, so a wave of spam can be traced. And the anti-spam rate limiter counts recent submissions per visitor, it stores a one-way hash of the address rather than the address itself, so its file never holds the address.

Your web host also keeps ordinary server access logs, as every web server does.

Third parties that see your request

Loading a page here causes your browser to contact a small number of other services:

• Google Fonts, typefaces load from fonts.googleapis.com and fonts.gstatic.com, so Google receives your IP address as part of that request.
• The studios and retreat hosts we list, through their photographs. Many photos of studios and retreats load straight from the studio's or host's own website, or from the image service it uses (Squarespace, Wix, Contentful, Webflow and others). Each of those hosts sees your IP address when a page showing its photo loads: most studio, neighbourhood and style pages and guides, and some retreat pages. Your browser is asked not to tell them which page you were reading.
• OpenStreetMap, only if you load the map on a studio page. Until you click it, the map is a plain link and nothing is sent.
• PayPal, only on a retreat's booking page, where its payment script loads as the page opens. Card details go straight to PayPal and never reach this site. We see that a payment succeeded, not how you paid.

There are no advertising networks, no social widgets and no embedded trackers.

Email you have given us

If you joined the newsletter, we use your address to send the newsletter. Nothing else. We do not sell, rent or share lists.

Asking us to delete it

Email through the contact form and ask. Since the only thing we hold is what you sent us, removing it is straightforward, and we will confirm when it is done. If you are in California, the CCPA gives you these rights explicitly; we apply them to everyone regardless of where you live.

Children

This site is not directed at children under 13 and we do not knowingly collect their information.

When this page changes

If the site starts collecting something new, this page is updated in the same change, not afterwards. The date at the top tells you when it last moved. The 3 September 2026 revision added the measurement cookie and the enquiry database, both of which shipped that day.