Privacy Policy

Last updated 24 August 2026

This policy explains what Svayam collects when you use the platform, why we collect it, who else processes it, and how you can get it back or get it deleted. It covers svayam.yoga and the Svayam web application.

Svayam Yoga is a product of BNS Data, Sydney, Australia, which is the entity responsible for the personal information described here. If you have a question about anything on this page, or want to exercise any of the rights below, email privacy@svayam.yoga.

What we collect

Account information

Your name, email address and a securely hashed password. We never store your password in a form we can read.

Your practice profile

The experience level, goals, and any physical limitations or injuries you choose to tell us about. You provide this so teachers and the guidance engine can adapt to you. It is optional, and you can edit or clear it at any time from your profile.

Camera input and posture recordings

Posture assessment uses your device camera. This is the most sensitive thing we handle, so it is worth being precise about it:

Your camera is only accessed after you grant browser permission, and only during a posture assessment you started.
Your body position is read as a set of skeleton landmarks - joint coordinates - and those landmarks, plus the resulting alignment assessment, are stored against your account so you can see your progress over time.
If you consent to recording, the video and a still frame are encrypted in your browser with a key generated on your device before anything is uploaded. We store the encrypted blob only. The key is re-encrypted with a master key held in our server environment and stored separately from the video. Neither is readable on its own.
A teacher who has been approved on the platform can request access to a recording in order to review your alignment and give you feedback. They have the same 72 hours you do.
Video and still images are deleted within 72 hours of capture, whether or not you ask us to, and cannot be recovered afterwards. The skeleton landmark data survives as your practice history; the imagery does not.
You can withdraw consent for any recording at any time before then. Doing so deletes the stored blobs and clears the keys immediately, rather than waiting for the 72 hour sweep.
If you do not consent to recording, no video is retained - only the landmark data.

Practice and progress data

Sessions you attend, poses practised, drills completed, courses started, streaks, milestones, questions you ask teachers, and their answers.

Payment information

Payments are processed by Stripe. Card numbers never reach our servers. We store a Stripe customer reference, your subscription tier and status, and a record of each transaction - amount, currency, and Stripe's invoice reference - so we can show you your billing history and honour cancellations.

Communication preferences

Which emails you have opted into or out of, and any push notification subscriptions you have registered.

Why we collect it

To run the service - authenticate you, deliver classes, track progress.
To personalise guidance - adapt drills and pathways to your goals and limitations.
To enable teaching - let a teacher you are working with see the context they need.
To take payment - process subscriptions and issue receipts.
To communicate - booking confirmations, reminders, receipts, and account notices.

We do not sell your personal information, and we do not use your practice data or recordings for advertising.

Who else processes your data

We use the following processors. Each is bound by its own terms and handles only the data needed for its function.

Supabase - database and encrypted file storage.
Vercel - hosting for the web application.
Render - hosting for the application backend.
Stripe - payment processing and subscription billing.
Resend - delivery of transactional email.
Zoom - live class video, where a teacher runs a class over Zoom.

Our application database and file storage are hosted in Tokyo, Japan. Vercel serves the web application from a global edge network, and Stripe, Resend and Zoom each run their own infrastructure in several regions. Your information may therefore be processed or stored outside the country you are in. Wherever it is processed, it stays covered by this policy and by the Australian Privacy Principles.

How long we keep it

Account and practice data - while your account is open, and for a reasonable period afterwards.
Recordings - video and still images are deleted within 72 hours of capture and cannot be recovered afterwards, whether or not you withdraw consent. The skeleton data derived from them - joint coordinates, no image - is kept as your practice history so we can show you how your alignment changes over time. You can delete that too, at any time.
Payment records - for as long as tax and financial record-keeping law requires, which is typically seven years and is longer than we keep anything else.

Your rights

You can ask us to:

give you a copy of the personal information we hold about you;
correct anything that is wrong;
delete your account and the data associated with it;
stop sending you a particular kind of email, which you can also do yourself from your notification settings.

Email privacy@svayam.yoga and we will respond within 30 days. If you are in Australia and are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Security

Traffic is encrypted in transit with TLS. Passwords are hashed. Posture recordings are encrypted before they leave your device, and their keys are stored separately from the content. Access to teacher-visible material is restricted to teachers who have been reviewed and approved on the platform.

No system is perfectly secure. If a breach affects you, we will tell you and the relevant regulator as the law requires.

Children

Svayam is not intended for children under 16. We do not knowingly collect their information. If you believe a child has created an account, contact us and we will remove it.

Cookies

We use only what the application needs to function - a token that keeps you signed in and your interface preferences. We do not use advertising or cross-site tracking cookies.

Changes

If we change this policy materially we will update the date above and notify account holders by email before the change takes effect.