Privacy Policy

What we collect

We collect the following kinds of data to provide Butter and for the purposes described under How we use it.

Your account. You can use Butter without signing in. We still use device and session identifiers to keep your practice together and protect access. What you enter can identify you. If you use Sign in with Apple, Apple gives us a stable sign-in code. At your choice, Apple also gives us your name and email address. If you hide your email, Apple gives us a private relay address instead. We never see your Apple password.

Email and your choices. We keep contact addresses, subscription settings, address checks, and records of messages sent, delivery failures, complaints, and opt-outs. Confirming an address enables email delivery; it does not create sign-in credentials. Optional topics start and stop as described under Reminders, and what we send you.

Your profile basics. Your profile can hold your first name, your gender, your age range, your height, your weight, and the guide voice you chose. You choose these values in Butter. Older profiles may contain values you confirmed from Apple Health. Your exact date of birth stays on your phone. Our servers receive only your age range.

Notes to your guide. This is the heart of the product, and much of it is health data.

• Saved notes keep the words you type or confirm after voice input, so your guide can plan around your life. They describe things like injuries, pain, surgery, and limits.
• Guide messages are the notes you type or speak to your guide before or during a session.
• Voice notes are turned into text on your phone. The recording never leaves your phone. Only the text reaches us.

Your guide draws conclusions from these notes, such as which areas to work gently. Those conclusions are health data too.

Your practice history. The sessions you start and finish, the moves you hold and skip, and how long you hold them. Also your streaks, your favorites, your achievements, the settings you pick, and what you tell us about how a session felt.

Ask Butter questions. Ask Butter answers questions about Butter, our policies, and your account. When you ask, we send your question and a short snapshot of your account. The snapshot holds counts such as sessions completed, your consent choices, and your membership status and renewal date. It also says whether you pay through Stripe or Apple, whether Apple Health is connected, and whether usage analytics are on. It never holds your notes, your saved notes, or any health value. We keep each question and answer, encrypted, the way we keep support messages.

Support and email messages. In-app support messages go to our support system. Messages to our support, privacy, or legal email addresses pass through Google Workspace. We keep the message, attachments, sender details, and our replies. Authorized team members handle them. Our active stores use encryption at rest. Our team can use an AI assistant to draft a reply, but a person reviews and sends every team reply. Inside the support thread, Ask Butter answers first and is labeled "Butter AI". Tap "Ask a human" and a person takes over.

Usage analytics. To see how the app performs and which features people use, we collect first-party usage data:

• app and feature events, such as sessions completed, screens viewed and buttons tapped;
• bounded measures such as duration, move counts, reported effort and technical performance;
• app and device context, such as app version, device family, OS version, network type, battery level and thermal state.

The app sends random identifiers and timing information to deliver pending events. Before storing events for analysis, we remove account and session identifiers, event sequence numbers, links to your practice records, language, time zone and location. We reduce timestamps to the day and reduce device and measurement detail. A random code for each event prevents duplicate counting. We use the incoming IP address to distinguish hosting networks and Apple Private Relay, then discard it from the analytics event.

We do not collect precise location or advertising identifiers. We do not use third-party advertising or analytics SDKs. Usage events use defined fields and do not include your note text. You can turn usage analytics off under Profile › Data & Privacy.

Service and security logs. Our hosting systems record requests, errors, and access events to operate and protect Butter. These records can include IP addresses, request paths, times, and device or account identifiers. They are separate from optional usage analytics.

Crash data. If the app or our servers crash, a report goes to Sentry, our error-tracking provider. It holds technical error codes, code locations, timing, device and app details, and random identifiers used to trace faults. These records can show which part of Butter you were using. We exclude your notes, message text, health readings, name, and email.

Consent records. When you agree to something in the app, we record what you agreed to, when, which text you saw, and how you agreed. This includes your health-data choices. If we have your email, the record can hold a matching code made from it. That code can match an address you later provide, so we treat it as personal data. These records do not contain your notes or health readings.

Billing. If you subscribe on butter.yoga, Stripe handles checkout. Stripe collects your email address and your card details directly. We never see or store your card number. On our side we keep your membership status, your renewal date, your trial dates, and Stripe's customer code, under a separate billing identifier. If you subscribe inside the app, Apple handles the purchase and your payment details. Apple sends us a receipt that says your membership is active and when it renews. The receipt does not include your name, your email, or your card.

Apple Health

With your permission, Butter saves each finished session to Apple Health as a yoga workout with an estimated calorie count. You can stop new saves under Profile › Apple Health › Save sessions to Apple Health. Change Apple's permissions in the Health app.

Butter can read back the workouts and energy records it added, so it can check, update, or remove them. It does not read other apps' workouts, your sleep, heart readings, or other Health data. It does not use Health readings to fill your profile or choose session settings.

When you delete a session on the phone in Butter, it also tries to remove that session's workout from Apple Health. Deleting your Butter account or signing out leaves workouts in Health. You can remove them in the Health app.

We do not sell Health data or use it for ads. Butter does not copy Health readings to its servers or store them in iCloud. Apple's own Health storage and sync settings remain under your control.

How we use it

We use the data above to:

• plan and personalize your sessions around your body, your history, and your goals, and speak to you about your practice;
• run the app: sync your practice across devices, play the right audio, and keep things working;
• answer your support messages and your Ask Butter questions;
• handle billing: memberships, trials, and payments through Stripe or Apple;
• learn from usage analytics which features work and where the app fails;
• find bugs and improve the performance and accuracy of the existing planner, using relevant inputs, plans, and session results;
• send optional emails according to your topic settings, manage your choices, and handle delivery failures and opt-outs;
• keep Butter safe: prevent abuse, secure accounts, and meet our legal duties.

These uses are subject to your consent choices and the Consumer Health Data Privacy Policy. We ask for separate permission before using your data to develop a different product you are not using.

We do not sell your data or share it for cross-context behavioral advertising. There are no ad trackers in the app. We improve the planner by testing results and changing its prompts. We do not use your data to train or fine-tune AI models. We do not permit our AI providers to train their models on the content we send them.

Reminders, and what we send you

Butter can send you notifications, such as practice reminders and account notices. To do this, your device gives us a notification token, and Apple delivers the notifications. Turn them off whenever you like, in iOS Settings under Notifications, or in the app.

Sign up in Profile › Email and confirm your address. These topics start on: Learn & practice, App updates, and Products & offers. They also start on for a new personal address from Sign in with Apple. We keep your existing email choices and opt-outs. Apple relay addresses do not get optional emails. You can change each topic. Buying a membership does not sign you up.

We use your current email topic settings to choose optional emails. We do not use your notes, health readings, or session history to choose marketing emails. We record sends, deliveries, failures, complaints, and opt-outs to manage email delivery and your choices.

Manage these choices in the app or through the link in an email. You can stop one subscription or all optional emails without signing in. Essential account, billing, security, support, and privacy messages are separate. Unsubscribing from optional emails does not stop those messages.

We use AWS to send email and receive delivery reports. Stripe sends billing messages for web memberships; Apple sends them for Apple purchases.

The guide and Ask Butter are AI

Your guide's session plans, notes, and spoken words are generated by AI. Your guide is not a person. Ask Butter's answers are generated by AI too. Two companies do this work for us under business agreements.

Anthropic writes the guide's words. To plan and write, it receives your saved notes, your guide messages, your session settings, and your practice history. It can also receive the gender, age range, height, and weight saved in your profile. It also receives your Ask Butter questions with the account snapshot described above. When our team drafts a support reply, Anthropic receives that thread. A person reviews and sends every team reply.

xAI turns the guide's words into speech. It receives the text to be spoken. That text can mention your body and your history. It also receives your first name, for greetings like "Good morning, Maya."

We use random request identifiers rather than account names or emails. xAI also receives your first name to speak it. Notes, questions, and the guide's words can contain names or other details that identify you. We do not add your sign-in credentials or card details to AI requests.

Anthropic normally deletes what we send within 30 days. Safety reviews or legal duties can require it to keep data longer. We use xAI with zero data retention enabled. Its terms require it to delete our request text and audio when it returns the result, or one hour after processing ends, whichever comes first. We do not permit these providers to train their models on your content.

Who we share it with

These companies receive data for the jobs below. Our hosting, AI, email, and crash-report services work for us under contracts. Apple and our payment providers have their own privacy policies. They also have their own legal duties.

If you buy a membership inside the app, Apple also handles that purchase under its own privacy policy.

We also disclose data when law or valid legal process requires it. We can disclose it to protect your rights, safety, or property, or those of others, as law permits. If Gregarious merges with another company or sells its assets, this policy still applies to your data. We tell you before any change to how your data is used.

Apart from the companies in the table and the disclosures above, no other company receives your data. We do not sell personal data, and we never have. We do not share it for cross-context behavioral advertising.

How we protect it

• Encryption at rest. Our active databases and file stores use storage encryption. Some fields, such as profile details, saved notes, and support messages, have an extra layer of encryption. AWS Key Management Service controls the keys for that layer. The backup exceptions are described below.
• Encryption in transit. All traffic between the app and our servers uses TLS.
• Separate identifiers. Sessions, billing, analytics, crash reports, and support use different identifiers. Our identity system can link them while your account is active. The content itself can also identify you. These identifiers reduce routine linking; they do not make the data anonymous.
• Access controls. We restrict access to people and service providers who need it to operate Butter, handle support and security, or review how well the guide plans.

No system is perfectly secure. Encryption and access controls reduce risk but do not remove it.

Butter is not a HIPAA covered entity or business associate. HIPAA does not apply to what you give Butter. Your rights here come from the FTC Act. They also come from the FTC Health Breach Notification Rule, and from state health-privacy laws such as Washington's My Health My Data Act.

How long we keep it

We keep completed sessions for the life of your account, unless you delete them. This includes a free account and an account you keep after cancelling membership. Other records follow the periods below.

We can retain examples to test and improve the existing planner, including after account deletion, only after verifying they are de-identified. They must not reasonably identify you or a device linked to you. We keep them in that form and do not try to identify people from them. Any recipient must agree to the same limits.

The 90-day limit below applies to extra copies we keep to debug AI results. Your saved notes and sessions have their own periods. We keep an older debugging example only in the de-identified form described above. Copying the data does not restart the 90 days.

Your guide reads your notes and health details to plan your sessions. That is what Butter does, so there is no switch for it; deleting your account is how it stops, and it removes them.

What deletion does

Delete your account in the app under Profile › Account › Delete account, or email privacy@butter.yoga. If your account has an email, use it to help us verify the request. If you use Butter without signing in, you can still ask; no new account is required. We verify the request before deleting data. Account closure starts the deletion process. We track the work still needed on our systems and at our providers.

• We revoke your Apple sign-in token.
• We scrub your account, profile, health details, saved notes, guide messages, support messages, favorites, and achievements.
• We remove the links used to connect your account to your practice data. We treat any retained record that can still identify you as personal data.
• We delete your Stripe customer record. That removes your saved card and cancels a membership bought on butter.yoga at once. Stripe keeps transaction and invoice records, with the email you gave it at checkout, for as long as tax and payments law requires.
• A membership bought through Apple is not cancelled by deleting your account. Cancel it in iOS Settings › Apple Account › Subscriptions.
• Analytics events still waiting on your phone are discarded.
• Your workouts stay in your Health app. They are yours, and we do not reach in to delete them. We delete a workout only when you delete that session inside Butter.

What remains, and why:

• properly de-identified planner examples and usage statistics. Removing names or account links alone is not enough; the retained data must not reasonably identify you;
• consent records and necessary legal notices, including arbitration opt-outs. These preserve your choices and let you or us resolve a legal claim. They can include identifiers, such as an email matching code or the reply address on a legal notice;
• if you bought a membership on butter.yoga, proof that you accepted the auto-renewal terms, including the offer and the Stripe checkout session. We keep it for at least three years from consent or one year after the contract ends, whichever is longer;
• a final consent-ledger row that records the date your account was deleted;
• records we must keep by law.

Our database backups have a 30-day retention setting. Deleted records can stay in old backups until they expire. Our host may take more time to remove them. We restrict backup access to recovery.

We keep a legal, security, billing, or opt-out record after deletion only for a documented need or legal requirement. We limit access and use to that purpose and review when it can be removed. These records are not de-identified merely because they use a code in place of a name.

Your rights and choices

You do not need to ask us for most of this. The app does it.

• Get a copy. Profile › Data & Privacy builds one file of what we hold about you. It covers your profile, your notes, your sessions, your progress, your favorites, your membership, your support messages, your agreements, and who received your data. You save or share it from your phone. Extra AI debugging copies are not in it; ask us and we send them. Apple Health data lives on your phone, so export it from the Health app.
• Correct. Edit your profile basics and your saved notes in the app at any time.
• Delete. Profile › Account › Delete account. The app offers you a copy of your data first. See What deletion does.
• Say no to the optional uses. Usage analytics has its own switch under Profile › Data & Privacy. Saying no never costs you Butter. Your guide reading your notes and health details is not optional in this sense: it is the session you asked for, and deleting your account is how it stops.
• Ask by email. Write to privacy@butter.yoga. If your account has an email, use it to help us verify the request. You do not need to create an account to ask. We use reasonable checks to protect your data and ask only for details needed for those checks. We act without undue delay and respond within 45 days of receiving your request. Verification does not restart that clock. If we reasonably need more time, we tell you why within those 45 days and take at most 45 more. This does not extend an earlier deadline for deletion or stopping a use of your data. You can use an authorized agent, and we check their authority.

For Nevada health-data deletion requests, we delete our active copies and notify recipients within 30 days of verifying the request. Backup copies follow the limits described above. We follow any shorter deadline that applies. You do not have to wait for our reply to use the app's deletion or withdrawal controls.

We do not discriminate against you for using a privacy right. If you delete data, features that need it can no longer use it. For example, your guide can no longer plan from a note you deleted.

Appeals. If we refuse a request, we tell you why. To appeal, reply to our answer, or email privacy@butter.yoga with "Appeal" in the subject line. We review your appeal and give you a written decision, with reasons, within 45 days. If we still say no, you can contact your state Attorney General: Washington at atg.wa.gov/file-complaint, Nevada at ag.nv.gov, Connecticut at portal.ct.gov/ag. Residents of other states can contact their own Attorney General.

California residents

You can ask to see, correct, or delete your data. The choices above apply here too. We do not sell your data. We do not share it for cross-context behavioral advertising. These practices stay the same when we receive a Global Privacy Control signal. You can manage optional email choices separately. We use health details only to provide Butter, keep it secure, and improve the planner you already use.

Washington, Nevada, and Connecticut residents

State law gives you extra rights over consumer health data. Those rights, and how to appeal, are in our separate Consumer Health Data Privacy Policy. It is its own document with its own terms.

Children

Butter is for adults. You must be 18 or older. The app asks for your date of birth during setup. An under-18 date locks the app on that device. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, email privacy@butter.yoga. We review reports promptly. When we learn we hold a child's personal data, we stop collecting it and delete it.

Changes to this policy

When we change this policy, we tell you in the app. We tell you by email too, if we have your address. Whenever the words change, we ask you to agree again in the app. We ask even for a small fix. You can close the request and keep using Butter, including sessions. Closing it records no agreement. Your data choices, membership cancellation, and account deletion stay available. Every version stays available at its own address, with its date, such as butter.yoga/legal/privacy/1.0.0 for this one. We never ask you to check back for changes yourself.

Contact

• Privacy questions, requests, and appeals: privacy@butter.yoga
• Help with Butter or your membership: support@butter.yoga, or Profile › Chat with Concierge in the app
• Legal notices: legal@butter.yoga

You can also write to us by post:

Gregarious, Inc., a Delaware corporation. 2261 Market Street STE 85362 San Francisco, CA 94114

Related policy: Consumer Health Data Privacy Policy. It is our separate policy for your health data. It follows Washington's My Health My Data Act and similar state laws.

Portions adapted from Common Paper standard agreements (CC BY 4.0) and the Basecamp open-source policies archive (CC BY 4.0).