Privacy Policy

What we collect

We collect the following kinds of data to provide Butter and for the purposes described under How we use it.

Your account. You can use Butter without signing in. We still use device and session identifiers to keep your practice together and protect access. What you enter can identify you. If you use Sign in with Apple, Apple gives us a stable sign-in code. At your choice, Apple also gives us your name and email address. If you hide your email, Apple gives us a private relay address instead. We never see your Apple password.

Email and your choices. We keep contact addresses, subscription settings, address checks, and records of messages sent, delivery failures, complaints, and opt-outs. Confirming an address enables email delivery; it does not create sign-in credentials. Optional topics start and stop as described under Reminders, and what we send you.

Your profile basics. Your profile can hold your first name, your gender, your age range, your height, your weight, and the guide voice you chose. You choose these values in Butter. Older profiles may contain values you confirmed from Apple Health. Your exact date of birth stays on your phone. Our servers receive only your age range.

Notes to your guide. This is the heart of the product, and much of it is health data.

• Saved notes keep the words you type or confirm after voice input, so your guide can plan around your life. They describe things like injuries, pain, surgery, and limits.
• Guide messages are the notes you type or speak to your guide before or during a session.
• When you record a voice note, xAI turns it into text. xAI deletes the recording once it returns the text, under zero-retention terms. Only the text is saved to your profile.

Your guide draws conclusions from these notes, such as which areas to work gently. Those conclusions are health data too.

Setup health check. During setup we ask one question about injuries, recent surgery, pregnancy, and conditions that affect how you move. We keep your answer, whether your doctor has cleared you, and anything you tell us your doctor said to avoid, which we save as a note. Our health data policy explains how we use it.

Your practice history. The sessions you start and finish, the moves you hold and skip, and how long you hold them. Also your streaks, your favorites, your achievements, the settings you pick, and what you tell us about how a session felt.

Support and email messages. Messages you send in Chat with Concierge go to our support system. A person on our team reads and answers every one. You and our team can send photos in the chat. We keep a photo the way we keep the message it belongs to. A photo you pick but do not send is deleted within 24 hours. We record when each message was sent, seen, and answered, so we can measure our reply times. Messages to our support, privacy, or legal email addresses pass through Google Workspace. We keep the message, attachments, sender details, and our replies. Authorized team members handle them. Our active stores use encryption at rest. Our team can use an AI assistant to draft a reply, but a person reviews and sends every team reply.

Diagnostics you choose to send. If our team asks, Butter can send a log of what the app did on your phone in the last 7 days. Nothing is sent until you tap Send. The log holds technical records: which requests the app made, their results, and error codes. It can show which parts of Butter you used. It never holds your notes, your messages, or any health value. We keep each log for 30 days, then delete it.

Usage analytics. To see how the app performs and which features people use, we collect first-party usage data:

• app and feature events, such as sessions completed, screens viewed and buttons tapped;
• bounded measures such as session length and technical performance;
• app and device context, such as app version, device family, OS version, network type, battery level and thermal state.

The app sends random identifiers and timing information to deliver pending events. Before storing events for analysis, we remove account and session identifiers, event sequence numbers, links to your practice records, language, time zone and location. We reduce timestamps to the day and reduce device and measurement detail. A random code for each event prevents duplicate counting. We use the incoming IP address to distinguish hosting networks and Apple Private Relay, then discard it from the analytics event.

We do not collect precise location or advertising identifiers. We use no advertising SDKs. Apart from Sentry's crash and performance reports, we use no third-party analytics SDKs. Usage events use defined fields and do not include your note text. During setup, we ask whether to turn on usage analytics. Nothing is pre-selected. You can turn it on or off under Profile › Data & Privacy.

Service and security logs. Our hosting systems record requests, errors, and access events to operate and protect Butter. These records can include IP addresses, request paths, times, and device or account identifiers. They are separate from optional usage analytics. Our security logs keep the IP address you connect from, and its country, for up to 30 days to stop abuse. Our load-balancer and CDN logs also record IP addresses, and keep them for up to 90 days. We do not keep location with your analytics events, and we never use it to learn anything about your health.

Crash data. If the app or our servers crash, a report goes to Sentry, our error-tracking provider. It holds technical error codes, code locations, timing, device and app details, and random identifiers used to trace faults. These records can show which part of Butter you were using. We exclude your notes, message text, health readings, name, and email.

Consent records. When you agree to something in the app, we record what you agreed to, when, which text you saw, and how you agreed. This includes your health-data choices. If we have your email, the record can hold a matching code made from it. That code can match an address you later provide, so we treat it as personal data. These records do not contain your notes or health readings.

Billing. If you subscribe on butter.yoga, Stripe handles checkout. Stripe collects your card details directly, along with device and browser information it uses to prevent fraud under its own privacy policy. If you confirmed an email with us, we give it to Stripe so you do not type it again. We never see or store your card number. On our side we keep your membership status, your renewal date, and Stripe's customer code, under a separate billing identifier. If you subscribe inside the app, Apple handles the purchase and your payment details. Apple sends us a receipt that says your membership is active and when it renews. The receipt does not include your name, your email, or your card.

Apple Health

With your permission, Butter saves each finished session to Apple Health as a yoga workout with an estimated calorie count. You can stop new saves under Profile › Apple Health › Save sessions to Apple Health. Change Apple's permissions in the Health app.

Butter can read back the workouts and energy records it added, so it can check, update, or remove them. It does not read other apps' workouts, your sleep, heart readings, or other Health data. It does not use Health readings to fill your profile or choose session settings.

When you delete a session on the phone in Butter, it also tries to remove that session's workout from Apple Health. Deleting your Butter account or signing out leaves workouts in Health. You can remove them in the Health app.

We do not sell Health data or use it for ads. Butter does not copy Health readings to its servers or store them in iCloud. Apple's own Health storage and sync settings remain under your control.

How we use it

We use the data above to:

• plan and personalize your sessions around your body, your history, and your goals, and speak to you about your practice;
• run the app: sync your practice across devices, play the right audio, and keep things working;
• answer your support messages, find your account when you write to us, and measure how fast we reply;
• handle billing: memberships and payments through Stripe or Apple;
• learn from usage analytics, if you turn it on, which features work and where the app fails;
• with Improve Butter on, improve how your guide plans and test new features, using your plans, profile details, notes and session feedback;
• send optional emails according to your topic settings, manage your choices, and handle delivery failures and opt-outs;
• keep Butter safe: prevent abuse, secure accounts, and meet our legal duties.

These uses are subject to your consent choices and the Consumer Health Data Privacy Policy. We ask for separate permission before using your data to develop a different product you are not using.

We do not sell your data or share it for cross-context behavioral advertising. There are no ad trackers in the app. With Improve Butter on, we improve the planner by testing results and changing its prompts. We do not use your data to train or fine-tune AI models. We do not permit our AI providers to train their models on the content we send them. We do not use your data to make decisions that have legal or similarly significant effects on you.

Reminders, and what we send you

Butter can send you notifications, such as practice reminders and account notices. To do this, your device gives us a notification token, and Apple delivers the notifications. Turn them off whenever you like, in iOS Settings under Notifications, or in the app.

Sign up in Profile › Email and confirm your address. The signup shows the three topics first: Learn to move, App updates, and Products & offers. You choose the ones you want. None is pre-selected. If you use Sign in with Apple, you get optional emails only after you sign up here. We keep your existing email choices and opt-outs. Apple relay addresses do not get optional emails. You can change each topic. Buying a membership does not sign you up.

We use your current email topic settings to choose optional emails. We do not use your notes, health readings, or session history to choose marketing emails. We record sends, deliveries, failures, complaints, and opt-outs to manage email delivery and your choices.

Manage these choices in the app or through the link in an email. You can stop one subscription or all optional emails without signing in. Essential account, billing, security, support, and privacy messages are separate. Unsubscribing from optional emails does not stop those messages.

We use AWS to send email and receive delivery reports. We send billing messages for web memberships; Apple sends them for Apple purchases.

The guide is AI

Your guide's session plans, notes, and spoken words are generated by AI. Your guide is not a person. The companies named below do this work for us under business agreements. Chat with Concierge is not AI: a person reads and answers every message.

Anthropic writes the guide's words. To plan and write, it receives your saved notes, your guide messages, your session settings, and your practice history. It can also receive the gender, age range, height, and weight saved in your profile. When our team drafts a support reply, Anthropic receives that thread. A person reviews and sends every team reply.

OpenAI does the same job as Anthropic when Anthropic is unavailable. It receives the same data, for that purpose only.

xAI turns the guide's words into speech. It receives the text to be spoken. That text can mention your body and your history. It also receives your first name, for greetings like "Good morning, Maya."

We use random request identifiers rather than account names or emails. xAI also receives your first name to speak it. Notes, support messages, and the guide's words can contain names or other details that identify you. We do not add your sign-in credentials or card details to AI requests.

Anthropic normally deletes what we send within 30 days. Safety reviews or legal duties can require it to keep data longer. We use xAI with zero data retention enabled. Its terms require it to delete our request text and audio when it returns the result, or one hour after processing ends, whichever comes first. OpenAI, our backup when Anthropic is unavailable, normally deletes what we send within 30 days. Safety reviews or legal duties can require it to keep data longer. We do not permit these providers to train their models on your content.

Who we share it with

These companies receive data for the jobs below. Our hosting, AI, email, and crash-report services work for us under contracts. Apple and our payment providers have their own privacy policies. They also have their own legal duties.

If you buy a membership inside the app, Apple also handles that purchase under its own privacy policy.

We also disclose data when law or valid legal process requires it. We can disclose it to protect your rights, safety, or property, or those of others, as law permits. If Gregarious merges with another company or sells its assets, this policy still applies to your data. We tell you before any change to how your data is used.

Apart from the companies in the table and the disclosures above, no other company receives your data. We do not sell personal data, and we never have. We do not share it for cross-context behavioral advertising.

How we protect it

• Encryption at rest. Our active databases and file stores use storage encryption. Some fields, such as profile details, saved notes, and support messages, have an extra layer of encryption. AWS Key Management Service controls the keys for that layer. The backup exceptions are described below.
• Encryption in transit. All traffic between the app and our servers uses TLS.
• Separate identifiers. Sessions, billing, analytics, crash reports, and support use different identifiers. Our identity system can link them while your account is active. The content itself can also identify you. These identifiers reduce routine linking; they do not make the data anonymous.
• Access controls. We restrict access to people and service providers who need it to operate Butter, handle support and security, or review how well the guide plans.

No system is perfectly secure. Encryption and access controls reduce risk but do not remove it.

Butter is not a HIPAA covered entity or business associate. HIPAA does not apply to what you give Butter. Your rights here come from the FTC Act. They also come from the FTC Health Breach Notification Rule, and from state health-privacy laws such as Washington's My Health My Data Act.

How long we keep it

We keep completed sessions for the life of your account, unless you delete them. This includes a free account and an account you keep after cancelling membership. Other records follow the periods below.

With Improve Butter on, we can retain examples to test and improve the existing planner, including after account deletion, only after verifying they are de-identified. They must not reasonably identify you or a device linked to you. We keep them in that form and do not try to identify people from them. Any recipient must agree to the same limits.

The 90-day limit below applies to extra copies we keep to debug AI results. Your saved notes and sessions have their own periods. We keep an older debugging example only in the de-identified form described above. Copying the data does not restart the 90 days.

Your guide reads your notes and health details to plan your sessions, once you allow it. You can turn this off under Profile › Data & Privacy. Your saved notes and health details then stay in your profile, unused, until you turn it back on or delete them. Deleting your account removes them.

What deletion does

Delete your account in the app under Profile › Delete account, or email privacy@butter.yoga. If your account has an email, use it to help us verify the request. If you use Butter without signing in, you can still ask; no new account is required. We verify the request before deleting data. Account closure starts the deletion process. We track the work still needed on our systems and at our providers.

• We revoke your Apple sign-in token.
• We scrub your account, profile, health details, saved notes, guide messages, support messages and photos, diagnostics, favorites, and achievements.
• We remove the links used to connect your account to your practice data. We treat any retained record that can still identify you as personal data.
• We delete your Stripe customer record. That removes your saved card and cancels a membership bought on butter.yoga at once. Stripe keeps transaction and invoice records, with the email you gave it at checkout, for as long as tax and payments law requires.
• A membership bought through Apple is not cancelled by deleting your account. Cancel it in iOS Settings › your name › Subscriptions.
• Analytics events still waiting on your phone are discarded.
• Your workouts stay in your Health app. They are yours, and we do not reach in to delete them. We delete a workout only when you delete that session inside Butter.

What remains, and why:

• properly de-identified planner examples and usage statistics. Removing names or account links alone is not enough; the retained data must not reasonably identify you;
• consent records and necessary legal notices, including arbitration opt-outs. These preserve your choices and let you or us resolve a legal claim. They can include identifiers, such as an email matching code or the reply address on a legal notice;
• if you bought a membership on butter.yoga, proof that you accepted the auto-renewal terms, including the offer and the Stripe checkout session. We keep it for at least three years from consent or one year after the contract ends, whichever is longer;
• a final consent-ledger row that records the date your account was deleted;
• records we must keep by law.

Our database backups have a 30-day retention setting. Deleted records can stay in old backups until they expire. Our host may take more time to remove them. We restrict backup access to recovery.

We keep a legal, security, billing, or opt-out record after deletion only for a documented need or legal requirement. We limit access and use to that purpose and review when it can be removed. These records are not de-identified merely because they use a code in place of a name.

Your rights and choices

You do not need to ask us for most of this. The app does it.

• Get a copy. Profile › Data & Privacy builds one file of what we hold about you. It covers your profile, your notes, your sessions, your progress, your favorites, your membership, your support messages, your agreements, and who received your data. You save or share it from your phone. Extra AI debugging copies are not in it; ask us and we send them. Apple Health data lives on your phone, so export it from the Health app.
• Correct. Edit your profile basics and your saved notes in the app at any time.
• Delete. Profile › Delete account. The app offers you a copy of your data first. See What deletion does.
• Say no to the optional uses. Usage analytics and Improve Butter each have their own switch under Profile › Data & Privacy. During setup, you answer each one, Turn on or Not now. Neither is pre-selected. Saying no does not change what you get from Butter. Your guide reading your notes and health details has its own switch there, Use my personal data to plan my sessions. It is on once you allow it. Turn it off and your guide gives you general sessions.
• Ask by email. Write to privacy@butter.yoga. If your account has an email, use it to help us verify the request. You do not need to create an account to ask. We use reasonable checks to protect your data and ask only for details needed for those checks. We act without undue delay and respond within 45 days of receiving your request. Verification does not restart that clock. If we reasonably need more time, we tell you why within those 45 days and take at most 45 more. This does not extend an earlier deadline for deletion or stopping a use of your data. You can use an authorized agent, and we check their authority.

For Nevada health-data deletion requests, we delete our active copies and notify recipients within 30 days of verifying the request. Backup copies follow the limits described above. We follow any shorter deadline that applies. You do not have to wait for our reply to use the app's deletion or withdrawal controls.

We do not discriminate against you for using a privacy right. If you delete data, features that need it can no longer use it. For example, your guide can no longer plan from a note you deleted.

Tracking and Do Not Track. We do not track you across other companies' apps or websites, and we do not let other companies do so through Butter. Because we do no such tracking, browser Do Not Track signals do not change how we handle your data.

Appeals. If we refuse a request, we tell you why. To appeal, reply to our answer, or email privacy@butter.yoga with "Appeal" in the subject line. We review your appeal and give you a written decision, with reasons, within 45 days. If we still say no, you can contact your state Attorney General: Washington at atg.wa.gov/file-complaint, Nevada at ag.nv.gov, Connecticut at portal.ct.gov/ag. Residents of other states can contact their own Attorney General.

California residents

You can ask to see, correct, or delete your data. The choices above apply here too. We do not sell your data. We do not share it for cross-context behavioral advertising. These practices stay the same when we receive a Global Privacy Control signal. You can manage optional email choices separately. We use health details only to provide Butter, keep it secure, and, if you turn on Improve Butter, to improve the planner you already use and to design and test new Butter features.

Washington, Nevada, and Connecticut residents

State law gives you extra rights over consumer health data. Those rights, and how to appeal, are in our separate Consumer Health Data Privacy Policy. It is its own document with its own terms.

Children

Butter is for adults. You must be 18 or older. During setup, we ask Apple to confirm your age range. If Apple can't tell us, or you choose not to share it, the app asks for your date of birth. If Apple says you are under 18, or you confirm a date of birth under 18, setup ends and we delete everything collected so far, including your first name, birthday and any Apple sign-in. We use Apple's answer only to check that you are an adult, and we don't keep it. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, email privacy@butter.yoga. We review reports promptly. When we learn we hold a child's personal data, we stop collecting it and delete it.

Changes to this policy

When we change this policy, we tell you in the app. We tell you by email too, if we have your address. Whenever the words change, we ask you to review the new version in the app. We ask even for a small fix. You can close the request and keep using Butter, including sessions. Your data choices, membership cancellation, and account deletion stay available. Every version stays available at its own address, with its date, such as butter.yoga/legal/privacy/1.0.0. We never ask you to check back for changes yourself.

Contact

• Privacy questions, requests, and appeals: privacy@butter.yoga
• Help with Butter or your membership: support@butter.yoga, or Profile › Chat with Concierge in the app
• Legal notices: legal@butter.yoga

You can also write to us by post:

Gregarious, Inc., a Delaware corporation. 2261 Market Street STE 85362 San Francisco, CA 94114

Related policy: Consumer Health Data Privacy Policy. It is our separate policy for your health data. It follows Washington's My Health My Data Act and similar state laws.

Portions adapted from Common Paper standard agreements (CC BY 4.0) and the Basecamp open-source policies archive (CC BY 4.0).