Privacy Policy

Last updated: July 22, 2026

We wrote this the way we teach: plainly, without filler. Sophia Selene Yoga keeps the data you share with the studio so we can schedule your classes, remember what works for your practice, and send the things you asked us to send. Every category below has a way out — a link, a toggle, or a button you can find without emailing us. If any of this feels off, write to booking@sophiaseleneyoga.com and we’ll make it right.

1. Who we are

Sophia Selene Yoga, a small studio based in Rockville, Maryland. The owner reads every privacy email personally. Reach us at booking@sophiaseleneyoga.com.

2. What we collect

• Account & booking. Your name, email, optional phone number, and a record of the classes you’ve booked or attended.
• Payments. Card payments run through Stripe. Stripe holds the full card number; we keep only the amount, status, and last four digits so your receipts and refunds line up.
• Newsletter. If you subscribe, we store your email and first name. Nothing else.
• Quizzes. Your answers and the outcome we returned, tied to your account so you can see your history.
• Reflections. Private journal entries you write after class. Only you and the studio owner can see them.
• Referrals. Who invited whom, so we can thank the person who sent you and credit their class pack.
• Testimonials. Only if you submit one. We treat it as opt-in and keep it until you ask us to take it down.
• Contact form. The message you send and the email you want us to reply to.
• Push & SMS tokens. A device token if you turn on push notifications, and your phone number if you opt in to SMS reminders.
• Analytics. Aggregate page and session counts. No third-party ad trackers, no cross-site fingerprinting.

3. What we do with it

Scheduling, class reminders, transactional emails (confirmations, receipts, password resets), fraud prevention, and improving the studio. We do not sell, rent, or trade your information. We use these named sub-processors, each under contract:

• Stripe — card processing.
• Resend — transactional and newsletter email delivery.
• Mux — on-demand video hosting and playback.
• Twilio — SMS class reminders, only if you opt in.

We are also previewing a few AI-assisted features (like the website chat helper): anything you type into one of those may be processed by an AI service to draft the reply, and we review how those features perform before rolling them out more widely.

4. Your rights and opt-outs

One clear path for each category:

• Newsletter. Click the Unsubscribe link at the bottom of any newsletter email, or visit the preferences tab in your profile. Takes effect immediately.
• Marketing SMS. Off by default. Toggle it on or off any time in your profile preferences.
• Quiz history. Delete individual quiz responses from your profile, or clear them all when you delete your account.
• Reflections. Delete per-reflection from the reflections tab, or all at once via account deletion.
• Referral participation. Opt out in your profile — you’ll stop appearing in the referral graph from that point forward.
• Testimonials. Email us and we’ll remove yours within a week.
• Push notifications. Unregister the device in the app, or disable them in your phone settings.
• Full account deletion. Delete Account lives in your profile settings. It removes your account, quiz responses, reflections, referral edges, and push tokens.
• CCPA / GDPR requests. Email booking@sophiaseleneyoga.com and we’ll respond within 30 days.

5. How long we keep it

Bookings and payment records are retained for seven years to meet tax and accounting rules. Everything else — quizzes, reflections, newsletter subscriptions, referrals, push tokens — stays until you delete it or close your account.

6. Cookies & session storage

We set no third-party advertising or cross-site tracking cookies — only what the site needs to keep you signed in and secure:

• ssysession. Keeps you signed in to your portal. It’s HttpOnly (page scripts can’t read it) and lasts up to 30 days, or until you sign out.
• sessionid. Signs studio staff in to the administration area. Regular members won’t normally receive it. Lasts up to two weeks.
• csrftoken. A security cookie that stops other websites from submitting forms as you. Lasts up to one year.

The site also keeps a few small notes in your browser’s local storage. These never leave your device on their own and disappear if you clear your browser data:

• Sign-in state (ss_token, ss_user) — your portal session and a cached copy of your profile, removed when you sign out.
• Picking up where you left off (sophia_pending_checkout, sophia_moon_join_event, sophia_target_class, ss_pending_checkin) — remembers a checkout, event join, or check-in you started so an interruption doesn’t lose it.
• Invite & offer links (ss_referral_code, ss_referral_session, ss_class_share_code, ss_guest_pass, ss_drop_in_offer, ss_attribution) — remembers the referral, share, or offer link you arrived with so the right friend gets credit; cleared once it’s used.
• Small preferences — a handful of keys for things like dismissed cards, chat settings, and notification registration, so the site remembers your choices between visits.

7. Children

The studio is for adults 18 and over. Younger students practice through a guardian-linked account managed by their parent.

8. Changes to this policy

If we change anything meaningful, we’ll announce it in the newsletter and post a banner on the landing page for at least two weeks. The date at the top of this page always reflects the latest version.

9. Contact

Any privacy question, concern, or request: booking@sophiaseleneyoga.com. A real person answers.