What we collect, and what we don't.

Cookies

One, and only for measurement. A cookie named sid holds a random identifier so that several page views in one visit can be counted as one visit rather than several. It expires after 30 minutes, is first-party (SameSite=Lax), and contains nothing about you — no name, no email, no account, nothing carried over from a previous visit.

It is not set at all if your browser asks us not to. We honour Do Not Track and Global Privacy Control: with either enabled, the measurement script stops before it runs, so no cookie is written and no request is made. Enabling GPC in your browser is the switch — we do not need a banner to ask you, because we would rather read the signal you already set.

No advertising cookie, no social widget and no cross-site identifier is set by any part of this site.

What stays on your device

Three small values are kept in your browser's local storage. They never leave your device and we cannot read them:

• theme — whether you chose light or dark.
• mly.pose3d.v1 — which pose models you have opened, so the viewer knows when to ask for an email.
• mly.pose3d.force — a development flag, unset for readers.

Clearing your browser data removes all three, and nothing breaks.

What the forms collect

Each form collects only the fields it shows you, and sends them to us by email:

• Newsletter — your email address, and a name if you give one.
• Contact — name, email, topic and your message.
• Submit a studio — studio name, your name and email, neighbourhood, website, styles and a short description.

Each submission does two things: it emails us, and it is stored in a database on our own server so that an enquiry cannot be lost in an inbox and we can see whether we have already replied. The record holds the fields you filled in, the page you sent it from, the time, and a one-way hash of your IP address — never the address itself.

The database runs on the same hosting as this site. It is not shared with anyone, no profile is built from it, and it is never combined with the measurement data described above. Records are archived after 12 months.

Who can see what you send

Two people: the site owner, and the yoga therapist you would be writing to. They sign in to a private dashboard on this domain with individual accounts, and every change made there is recorded against the person who made it. There is no shared login and no third-party CRM.

Measuring visits

We count visits ourselves rather than handing the job to Google Analytics or similar. The script is served from this domain, sends its data to this domain, and records how a page was used — never what you typed, and never anything that follows you to another site.

Specifically, it records:

• which pages were opened, in what order, and how far down each was scrolled;
• roughly how long each was read, and whether the visit came from a phone or a desktop;
• where on the page a click landed — a position, plus the kind of element (a link, a heading) and its name in the page's own markup. Never the text you clicked, and never anything you typed;
• which links took you off this site, so we can tell which recommendations are actually useful — the destination address only;
• that a form was submitted — the fact and which form, never the contents. What you actually wrote is covered under Enquiries above;
• the campaign tag on the address you arrived by, if it had one — the ?utm_source=… that tells us a newsletter link brought you rather than a search.

None of it is joined to a name, an email or an address, and none of it leaves this domain. Because the identifier behind it changes every day, we cannot tell a returning visitor from a new one — that is a deliberate trade, and it is why there is no "returning visitors" number anywhere in what we look at.

As of this revision the storage is on: what the script sends is written down, in a database on this same server. Nothing is shared with anyone, none of it is sold, and none of it leaves this domain. There is no automatic deletion date yet — when we set one, this paragraph will say what it is. Either way, DNT or GPC stops the whole thing: with either switched on the script never loads, so there is nothing to write.

Your IP address

Two things touch it. Your IP is included in the notification email a newsletter signup generates, so a wave of spam can be traced. And the anti-spam rate limiter counts recent submissions per visitor — it stores a one-way hash of the address rather than the address itself, so the file it writes cannot be read back into an IP.

Your web host also keeps ordinary server access logs, as every web server does.

Third parties that see your request

Loading a page here causes your browser to contact a small number of other services:

• Google Fonts — typefaces load from fonts.googleapis.com and fonts.gstatic.com, so Google receives your IP address as part of that request.
• Two retreat photographs are hosted elsewhere (i0.wp.com and theranchlife.com), so those hosts see your IP when a retreat page loads.
• PayPal — only if you pay a retreat deposit. Card details go straight to PayPal and never reach this site. We see that a payment succeeded, not how you paid.

There are no advertising networks, no social widgets and no embedded trackers.

Email you have given us

If you joined the newsletter, we use your address to send the newsletter. Nothing else. We do not sell, rent or share lists.

Asking us to delete it

Email through the contact form and ask. Since the only thing we hold is what you sent us, removing it is straightforward, and we will confirm when it is done. If you are in California, the CCPA gives you these rights explicitly; we apply them to everyone regardless of where you live.

Children

This site is not directed at children under 13 and we do not knowingly collect their information.

When this page changes

If the site starts collecting something new, this page is updated in the same change, not afterwards. The date at the top tells you when it last moved. The 3 September 2026 revision added the measurement cookie and the enquiry database, both of which shipped that day.