Privacy Policy

1. Introduction

This Privacy Policy describes how the Yoga for Back Pain Relief iOS application ("the App", "we", "us", "our") collects, uses, and shares information when you use the App.

We've designed the App to collect as little personal information as possible. You do not need to create an account. We do not ask for your name, email address, phone number, or any other personally identifying information. This document explains exactly what we do collect, why we collect it, and the choices you have.

2. Apple Privacy Nutrition Label

The table below summarizes the data the App collects, in the same categories Apple uses on the App Store privacy "nutrition label". None of this data is linked to your real identity, and none of it is used to track you across apps or websites owned by other companies.

Data Used to Track You: None. The App does not request App Tracking Transparency permission, does not use the IDFA, and does not run any advertising or cross-app tracking SDKs.

3. Information We Collect

Anonymous Identifier

When you first open the App, our backend (Google Firebase Authentication) generates a random anonymous user ID for your installation. This ID is not linked to your real identity, your Apple ID, or any other personal information you've shared with Apple. The ID exists so the App can sync your subscription status, onboarding preferences, and session history across launches on the same device.

The App also stores a locally generated UUID in your device's UserDefaults to identify your installation between launches. This UUID never leaves your device.

Onboarding Answers (Wellness Preferences)

During the first-launch onboarding flow, you answer five short multiple-choice questions:

• Where you primarily feel back pain (e.g., lower back, upper back, neck, shoulders)
• How severe your discomfort generally is (mild, moderate, severe)
• How often you experience it (rarely, weekly, daily)
• Your prior yoga experience (none, beginner, intermediate, advanced)
• Your primary goal (relief, flexibility, strength, relaxation)

These answers are stored under your anonymous user ID and used solely to recommend the most relevant yoga programs. We do not share your onboarding answers with anyone, do not link them to your Apple ID, and do not use them to advertise to you. See section 4 below for our additional treatment of these health-adjacent preferences.

Session and Streak Data

The App stores the number of yoga sessions you complete, your current daily streak, the date of your most recent session, and your reminder time (if you set one). This information is used to display your progress on the home screen and to optionally remind you to practice. It is stored under your anonymous user ID.

Subscription and Purchase Data

When you purchase a subscription, the transaction is processed entirely by Apple. We use a service called RevenueCat to verify and sync your subscription status. We receive only:

• The product identifier you purchased
• The purchase status (active, expired, cancelled, refunded)
• The expiration date for active subscriptions

We do not see your Apple ID, your credit card number, your billing address, or any other payment information. All payment processing is handled by Apple.

Push Notifications (Optional)

If you grant the App permission to send push notifications, Apple provides us with a push token used to deliver the daily yoga reminder you've optionally set. We use the token solely to send the reminder. You can revoke notification permission at any time in your iOS Settings.

What We Do Not Collect

For absolute clarity, we do not collect:

• Your name, email address, phone number, or postal address
• Your contacts, calendar, photos, microphone, or messages
• Your location or GPS data
• HealthKit data (we do not read or write to Apple Health)
• Biometric data, heart rate, sleep, weight, or any quantitative health measurement
• Diagnoses, prescriptions, or any clinical medical information
• Your Apple ID or any account credentials
• Your IDFA or any advertising tracker data
• Browsing history or activity outside the App

4. Health-Adjacent Information

The onboarding answers described above (pain location, severity, and frequency) relate to your physical wellness. We treat them with extra care:

• We collect the minimum amount of preference data needed to recommend a program — multiple-choice categories only, no free-text descriptions or clinical detail.
• The data is stored under a random anonymous identifier and is not linked to your name, email, or Apple ID.
• The data is used exclusively for in-App program recommendation. We do not sell it, do not share it with advertisers, and do not use it for any secondary purpose.
• You can change your answers or wipe them at any time by emailing the address in section 13.

5. How We Use Your Information

We use the limited information we collect for the following purposes only:

• To deliver the App's features (program recommendations, streak tracking, session history)
• To sync your subscription and preferences across launches on your device
• To send the optional daily yoga reminder you've configured
• To prevent fraud, abuse, and violations of our Terms of Service
• To comply with legal obligations
• To improve App performance and reliability through aggregated, anonymous analytics

We do not sell your personal information. We do not share your personal information with advertisers. We do not use your data to train AI models. The App contains no advertising of any kind.

6. Legal Basis for Processing (GDPR / UK GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your information under the following legal bases:

• Performance of a contract — to deliver the App and any subscription you purchase (Article 6(1)(b) GDPR).
• Legitimate interests — to operate, secure, and improve the App, and to prevent fraud (Article 6(1)(f) GDPR), balanced against your fundamental rights.
• Your consent — for optional features such as push notifications (Article 6(1)(a) GDPR). You can withdraw consent at any time in iOS Settings without affecting prior processing.
• Compliance with legal obligations — to satisfy tax, accounting, or law-enforcement obligations (Article 6(1)(c) GDPR).

The wellness preferences described in section 4 are categorical and not stored together with personally identifying information; we do not consider them "special category" health data under Article 9 GDPR. To the extent any local regulator views them differently, we rely on your explicit consent given when you complete the onboarding flow (Article 9(2)(a) GDPR), which you may withdraw at any time by contacting us.

7. Third-Party Services

The App relies on a small number of trusted third-party processors. Each is bound by its own privacy policy and the limited purpose for which we use it.

Google Firebase

We use Firebase Authentication for anonymous account creation and Cloud Firestore to store your subscription state, onboarding preferences, and session history under your anonymous user ID. Firebase is operated by Google LLC.

Google privacy policy: https://policies.google.com/privacy

RevenueCat

We use RevenueCat to handle subscription validation and entitlement synchronization. RevenueCat receives the anonymous user ID and the App Store transaction details only.

RevenueCat privacy policy: https://www.revenuecat.com/privacy

Apple

The App is distributed through Apple's App Store. Apple processes all payments and handles push notification delivery (APNs).

Apple privacy policy: https://www.apple.com/legal/privacy/

8. Data Retention

We retain the limited information we collect for as long as your installation is active, plus a reasonable period thereafter to comply with our legal obligations.

• Anonymous user ID, onboarding answers, session and streak data: Retained while your installation is active. Deleted on request (see Your Rights below).
• Subscription records: Retained for the duration of your subscription plus the period required by tax and accounting laws (typically 7 years).
• Push notification token: Retained for as long as the App can deliver reminders to your device. Removed when you revoke notification permission or uninstall.

Uninstalling the App removes locally cached data from your device but does not automatically delete your server-side records. To erase your server-side data, please email us as described in section 9.

9. Your Rights

Depending on where you live, you may have the following rights regarding your personal information:

European Union and United Kingdom (GDPR / UK GDPR)

• Right to access the personal data we hold about you
• Right to rectification of inaccurate data
• Right to erasure (the "right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object to processing
• Right not to be subject to solely automated decision-making
• Right to withdraw consent at any time
• Right to lodge a complaint with a supervisory authority

California, USA (CCPA / CPRA)

• Right to know what personal information is collected
• Right to delete personal information
• Right to correct inaccurate personal information
• Right to opt out of the sale or sharing of personal information (we do not sell or share)
• Right to limit use of sensitive personal information
• Right to non-discrimination for exercising your privacy rights

Other Jurisdictions

Brazil (LGPD), Canada (PIPEDA), Australia (Privacy Act), and other jurisdictions provide similar rights. You may exercise them through the same channel below.

How to Exercise Your Rights

To exercise any of these rights, contact us at [email protected] with the subject line "Privacy Request". Because we use anonymous identifiers, please include your anonymous user ID (visible in the App's Settings → Support) so we can locate your data. We will respond within the timeframe required by applicable law (typically within 30 days for GDPR).

10. Children's Privacy

The App is not directed at children under 13 years of age (or under the minimum digital consent age in your jurisdiction, which may be 14 or 16 in some EU member states). We do not knowingly collect personal information from children.

If you are a parent or guardian and believe a child has provided personal information to us, please contact us at [email protected] and we will delete it promptly.

The App's content rating in the App Store is set in accordance with Apple's age rating guidelines.

11. International Data Transfers

The App's backend services (Google Firebase, RevenueCat) operate from data centers located in the United States and the European Union. By using the App, you consent to the transfer of your information to these regions for processing.

For transfers of personal data from the European Union or United Kingdom to countries outside the EEA, we and our processors rely on Standard Contractual Clauses approved by the European Commission and other appropriate safeguards.

12. Security

We protect the limited information we collect using industry-standard measures, including:

• TLS 1.2+ encryption for all data in transit
• Encryption at rest provided by Google Cloud and our other infrastructure providers
• Anonymous identifiers — no real-name linkage
• Limited backend access restricted to authorized personnel
• Regular security review of third-party providers

No system is perfectly secure. If you become aware of a security incident affecting your data, please contact us immediately at [email protected].

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this policy
• Notify users via in-app message or push notification (if granted)
• For significant changes, provide a plain-language summary of what changed

Continued use of the App after changes are posted constitutes acceptance of the updated policy.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your data, contact us at:

Email: [email protected]
Subject: Yoga for Back Pain — Privacy Inquiry

We will respond as soon as possible, typically within 7 business days.