Privacy
What we keep, and why
ashtanga.yoga is run by Ashtanga Yoga Denver. We keep as little as the site needs to work, and we never sell it.
Reading the site
You can read everything open on the site without an account. We count visits with Vercel Web Analytics, which sets no cookies and reports anonymous totals; it tells visits apart with a short-lived hash of the request, not with anything stored on your device.
The tools keep their settings and tallies in your own browser and do not send them to us. One exception: if you set a place on the moon days page and subscribe to a feed set to your local time or to sunrise, the feed address carries that place (its city and time zone, and for sunrise its coordinates). The Mysore-time feed carries no place. Your calendar app fetches that address from us, and if you add it to Google Calendar, Google sees it too.
If you make an account
An account holds:
- your email address, and a name if you give one;
- if you use a password, a one-way hash of it, never the password itself;
- if you sign in with Google: the name, email address and picture Google shares, your Google account ID, and the sign-in tokens Google issues. We use them only to sign you in; we do not read anything else from your Google account;
- if you add a passkey: its public key and the technical details that go with it (an ID, a name, the device type, a counter, when you added it). The private key is never sent to us; your device or passkey manager keeps it, and may sync it between your devices;
- your sign-in sessions, with the browser and network address each came from, so you stay signed in and we can stop abuse.
We use this to sign you in and to open the talks for members. We do not send newsletters or marketing from it.
Security records
While a sign-in is under way we keep temporary records of it: the one-time sign-in links we email (they work for fifteen minutes) and password-reset links (one hour), and the in-progress state of a Google sign-in or of setting up a passkey. For each network address that tries to sign in we also keep a count of recent attempts and when the last one was, so repeated guessing can be slowed down. These exist whether or not the attempt belongs to an account.
Cookies
Signing in sets a session cookie that keeps you signed in for up to sixty days, renewed while you use the site. While you are signing in, short-lived security cookies hold the state of a Google sign-in or a passkey check for a few minutes. That is all: no advertising or tracking cookies.
How long we keep it
Account details stay until you ask us to delete the account. Sessions end when you sign out or after sixty days unused.
Who handles it
- Vercel hosts the site and counts visits.
- Neon stores the account database.
- Mailgun delivers sign-in and password emails, with open and click tracking turned off.
- Google, if you choose to sign in with it, or add a moon calendar to Google Calendar.
- Stripe takes payments on the support page. Your card details go to Stripe, not to us.
Your choices
You can ask for a copy of what we hold about you, have it corrected, or have your account and everything it holds deleted: write to hello@ayd.yoga from the address on the account. Deleting the account removes its details, sessions and passkeys. If you are in the UK or the EU and are unhappy with how we handle your data, you can also complain to your data protection authority.
Updated 11 November 2026.