Privacy Policy
This policy explains what Retreat Companion ("we", "us"), operated by Five Parks Yoga, collects, why, and the choices you have. We keep it plain on purpose.
What we collect
- Account info — your name, email, and organization name when you sign up.
- Guest data you upload — guest names, the last four digits of phone numbers (the full number is stored only as a one-way salted hash, never in readable form), and optional details you add such as dietary needs, allergies, injuries, and room assignments.
- Payment info — when a guest pays for an activity by card, payment is handled by Stripe. We receive a payment status and reference, not full card numbers. We never see or store card details.
- Usage data — basic logs and analytics (e.g. survey ratings, activity sign-ups) needed to run and improve the Service.
How we use it
- To provide the Service — show schedules, coordinate activities and shuttles, send invites, and process payments through Stripe.
- To secure accounts and prevent abuse (for example, rate-limiting guest logins).
- To communicate with you about your account and important changes.
We do not sell your data or your guests' data, and we don't use it for advertising.
Who we share it with
We share data only with service providers that help us run the Service — for example Supabase (database and authentication), Cloudflare R2 (file storage), Resend (email delivery), and Stripe (payments). Each processes data on our behalf under their own terms. We may also disclose information if required by law.
Your rights (including GDPR)
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Retreat organizers act as the "controller" for their guests' data; we act as a "processor" on their behalf. If you're a guest, contact your retreat organizer first, or reach us and we'll help route your request.
Data deletion
You can delete individual guests from within the app at any time, which removes their roster record and linked login identity. To delete your whole account and associated data, email us at hello@fiveparksyoga.com and we'll process the request promptly.
Data retention
We keep data for as long as your account is active or as needed to provide the Service, then delete or anonymize it within a reasonable period, unless a longer period is required by law.
Security
We use encryption in transit, hashed phone numbers, database row-level security for tenant isolation, and access controls. No system is perfectly secure, but we work to protect your data and to notify you of significant incidents where required.
Changes
We may update this policy. We'll change the date above and, for material changes, take reasonable steps to notify you.
Contact
Questions or requests? Email hello@fiveparksyoga.com.