Privacy

Who the controller is

The controller is not named in this draft. Before launch it must state the legal entity, address, and a contact email. The mailbox reserved for that is privacy@yogappia.com.

Yogappia is the name of the service: a yoga application for iOS and Android, plus this introductory site.

What the service expects to process

Account: email, password (an Argon2id hash only, never the raw password), Google or Apple identifiers if you use them, and language.

Practice profile: goals, self-reported level, flexibility, preferred duration, and limitations you write (knee, back, pregnancy, or others). That is health data under the GDPR and needs separate consent.

Activity: finished sessions, an indicative pose score, and accumulated experience.

Payments: we do not store card numbers. Store purchases arrive as entitlements and technical receipts (product id, store, expiry) through RevenueCat.

Waitlist on this site: email, language, and the date. Also the IP address, to limit abuse.

The camera

Live correction is meant to be computed on the device. This phase has no endpoint that receives video or frames. If that changed, the reviewed policy would have to say so beforehand, with a specific legal basis.

Why

To create the account, show a plan compatible with what you told us, keep the level, and apply what you bought in the store.

To tell you, if you joined the waitlist, that the app can be installed. There is no newsletter.

Account security: sessions, password reset, and an audit log of signups, deletions, and entitlement changes.

How long

The account, while it stays open. If you delete it, the profile, limitations, and practice history are removed, and the email is replaced with an anonymous id.

Consent is kept without an IP address, tied to that id, as a record that it existed. A lawyer still has to confirm this retention choice.

The waitlist is deleted when the launch notice no longer matters, or sooner if you ask.

Processors and transfers

The plan is to use an email provider (SMTP), the Apple and Google stores, and RevenueCat for subscription state. Each one will need a country and a safeguard if data leaves the EEA. This draft does not treat that list as final.

Your rights

Access, rectification, erasure, objection, restriction, and portability, and the right to withdraw health-data consent. You can also complain to the Spanish Data Protection Agency (aepd.es).

Write to privacy@yogappia.com. Account deletion is also in the API, inside the session.

Children

The service is not directed at anyone under 16. This phase does not ask for a date of birth; the reviewed text has to decide how that is checked.