Privacy Policy
Last updated: September 9, 2026
The short version
We collect the minimum data needed to run a directory: your email if you sign in or claim a listing, a hashed IP for basic analytics, and nothing else that isn't strictly required. We don't sell data, we don't run advertising trackers, and we don't share your info with third parties except the services listed below that make the site work.
Who we are
YogaRetreats.ca is an independent Canadian directory of yoga retreats, sanctuaries, and retreat centres. For questions about this policy, email dan@yogaretreats.ca.
What we collect and why
If you only browse the site
- A one-way SHA-256 hash of your IP address (rotated daily) so we can count unique visitors without storing your address.
- Your browser's User-Agent family (mobile / tablet / desktop) for aggregate stats.
- Country, when your CDN forwards it, for aggregate stats.
- Which pages you loaded and which booking links you clicked — used to show operators how their listings perform.
We do not set advertising cookies, track you across other sites, or share this data with third parties.
If you claim or list a studio
- Your email address (to send you a sign-in link).
- Any studio information you submit (name, website, address, description, photos, retreats).
- A signed session cookie (yr_session, valid 30 days) so you don't have to sign in every time. It contains only your user ID and role.
If you submit a review
- Your display name and review text — shown publicly on the centre's page after admin moderation.
- Your email address (optional, never displayed) so we can contact you about your review if needed.
Who we share it with
We use these third-party services to run the site:
- Gmail (Google) — outbound email delivery for sign-in links and moderation notices.
- Google Maps — displays maps and geocodes addresses. Google may set its own cookies on pages that embed a map; see Google's Privacy Policy.
- Google Fonts — serves the site's fonts.
- Anthropic (Claude API) — powers the optional AI assistant inside the operator dashboard. Data sent only when an operator explicitly clicks an AI button. Anthropic does not train on API data (see their policy).
- Vercel — hosts the public website; may collect standard access logs (IP, User-Agent, URL).
- Independent VPS (Contabo Inc.) — hosts the API and database in the United States (Seattle, WA data centre). Access logs limited to what the web server records.
We do not sell your data. We do not share it for advertising. We do not have partnerships that transfer your data.
How long we keep it
- Session cookies: 30 days.
- Sign-in link tokens: 15 minutes, then deleted.
- Hashed-IP + page-view records: 12 months, then aggregated and deleted.
- Account + listing data: as long as your listing is active, plus 30 days after account closure.
Your rights (PIPEDA)
Under Canada's Personal Information Protection and Electronic Documents Act, you can:
- Access the personal data we hold about you.
- Correct anything inaccurate.
- Delete your account and personal data.
- Withdraw consent — email us and we'll remove your account and any data linked to it within 30 days.
Email dan@yogaretreats.ca for any of the above and we'll respond within 30 days.
Cookies
We use exactly one first-party cookie (yr_session) — set only after you sign in, valid 30 days, used to keep you signed in. It contains no personal data beyond your user ID.
Google may set its own cookies on pages that embed a Google Map or use Google Fonts. You can disable these in your browser settings; the site remains usable.
Children
The site is not directed at children under 13. We don't knowingly collect data from anyone under 13.
Changes to this policy
If we materially change what data we collect or how we use it, we'll update the "Last updated" date above and, for anyone with an account, email a summary of the change.
Contact
Questions or requests: dan@yogaretreats.ca