Privacy Policy
108 Pranayama (108pranayama.com and the app you can add to your home screen) helps you care for your mind, body, heart and finances, one practice at a time. This policy explains, in plain words, what information is involved when you use it, where that information goes, how long it is kept, and the choices and rights you have wherever you live.
Your privacy choices
This box shows what you have agreed to on this device. You can change your choices, withdraw consent, or erase everything 108 Pranayama keeps on this device at any time.
Your choices appear here once the page has finished loading. If you do not see them, please make sure JavaScript is turned on, or write to us using the details in section 17.
1. Who we are
108 Pranayama is operated by Shri Anand LLC, 22 Robinson Road, Westford, MA 01886, United States (“we”, “us”, “our”). For the purposes of data protection laws such as the EU and UK General Data Protection Regulation (GDPR), India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and similar laws, Shri Anand LLC is the controller (or “data fiduciary”) of the personal information described here.
You can reach our privacy contact at jai.lalwani@thecloudpartner.com. This person also acts as our Privacy Officer and Grievance Officer (see section 17).
2. What this policy covers
Your use of 108 Pranayama is also governed by our Terms of Use. This policy covers 108pranayama.com, the home-screen app version of the site, and its features: My Day, Om Chanting, Digital Mala, Surya Namaskar, My Sadhana, Prana Plate (with Mitra, our AI guide), Calorie Meter, the Water Tracker with reminders, the Step Tracker, shareable badges, the feedback form and this site’s emails to you. It does not cover other websites we link to, or apps such as Instagram or WhatsApp that you choose to share badges or videos with; their own privacy policies apply.
3. Information involved and where it is kept
a) Information that stays on your device
Most of what you enter is saved only in your own browser’s local storage on the phone or computer you are using. We cannot see it, and it is not sent to our servers unless a feature below says so. This includes:
- your practice history: Om counts, mala rounds, Surya Namaskar progress, My Sadhana levels, gratitude notes and money check-ins;
- your Prana Plate profile: name or nickname, age, sex, height, weight, target weight, country, food choices, health conditions, medicines, blood pressure, blood sugar and HbA1c, if you enter them;
- your 30-day meal plan, meal log, calories and nutrients, and your chats with Mitra;
- your water glasses, step counts, walks, goals and badges;
- your privacy choices (see Your privacy choices) and a random device ID. This is a code such as
k3v9…that the app creates on your device. It does not contain your name or contact details.
Because this information lives on your device, clearing your browser data, using a private window, or using another device means it will not be there. You can erase all of it at any time with the button in Your privacy choices. My Sadhana and Prana Plate also let you download a backup file, which is saved on your device and is under your control.
b) Information sent through our server when you use AI features
When you check calories, build or rebuild a meal plan, get advice on a plate, or ask Mitra a question, the content needed for that answer is sent securely (encrypted with HTTPS) through our server to our AI engine. This can include the photo, your meal description, the meal it is for, and the parts of your Prana Plate profile needed to answer, such as age, sex, height, weight, goals, food choices, health conditions and readings. Our server passes it on and returns the answer to your device. We do not save the photo, description, health details or the answer on our server. See section 4 for how the AI engine handles it.
c) Information we keep on our server
- Consent records. When you accept this policy, change your choices, agree to AI use of health information, withdraw, or erase your device data, we record the choice, the policy version, the date and time, your random device ID, your device’s time zone (for example “Asia/Kolkata”), the language you chose, whether your browser sent a Global Privacy Control signal, and the page you were on. We keep these records as proof of your choices. We do not record your name, email or IP address with them.
- Water reminders. If you turn on reminders, we store the push address your browser gives us (a long web address issued by your browser’s push service), your random device ID, your time zone, your reminder hours, your daily glasses goal and today’s glass count, so we can remind you at the right time and stop once you reach your goal. We delete this when you turn reminders off, erase your device data, or when the push service tells us the address no longer works.
- Fair-use counters. To keep the AI features free and stop misuse, we count how many photos, plan steps and chat messages each device ID and each internet connection uses per day. The internet address (IP address) is stored only in a one-way coded (hashed) form, together with the date, and these counters expire after 24 hours.
- Error notes. If the AI engine reports an error, we keep a short technical note (the time, an error code and the engine’s error message) so we can fix it. It does not include your photo, health details or questions.
- Feedback. If you use the feedback form, we receive what you type, including any name and email address you choose to give, as an email to us.
d) Information collected automatically
- Server logs. Like almost every website, our web server automatically records technical details of each request: your IP address, the date and time, the page or file requested, your browser and device type, and the page you came from. We use these logs only for security, preventing abuse and fixing problems. They are deleted automatically, normally within 14 days.
- Fonts. Our pages load fonts from Google Fonts, so your browser connects to Google’s servers and Google receives your IP address and browser details when you visit.
- Visit statistics, only if you allow them. See below and section 7.
Google Analytics. If you allow visit statistics, we use Google Analytics, provided by Google LLC, to understand how many people visit, which pages are used and roughly where visitors are from (country and city). Google Analytics uses cookies and similar identifiers. We have set it not to use your information for advertising. If you do not allow statistics, or your browser sends a Global Privacy Control signal, Google Analytics is told not to store analytics cookies.
Jetpack Stats. We use Jetpack Stats, provided by Automattic Inc., to count visits and see which pages are popular. It processes your IP address, browser details and the pages you view to produce totals that we see only in summary form.
e) Information we do not collect
We do not ask you to create an account, and we do not collect payment details, government ID numbers, precise GPS location, contacts, or your microphone or camera feed. The Step Tracker uses your phone’s motion sensor only on your device while you walk, to count steps, and that data is not sent to us. The camera is used only when you choose to take a photo, and the photo goes only where described in section 4.
4. AI features and your health information
Prana Plate, Mitra and Calorie Meter use an AI model provided by Anthropic PBC (USA), which acts as our service provider and processor. It processes the content we send only to produce the answer for you, under a contract with us.
- We ask first. The first time a feature would send a photo, meal details or health information, we ask for your explicit consent. If you say no, nothing is sent and the rest of 108 Pranayama keeps working. You can withdraw this consent at any time in Your privacy choices, and we will ask again before the next use.
- Kept briefly by Anthropic. Under Anthropic’s published policy, it automatically deletes the inputs and outputs it receives through its service within 30 days. It may keep them longer only where the law requires it or to enforce its usage policy, for example to investigate misuse.
- Not used to train AI. Anthropic’s commercial terms do not allow it to train its models on the content we send.
- No automated decisions about you. The AI produces suggestions, such as calorie estimates, meal ideas and general advice, for you alone. They do not produce legal or similarly significant effects on you, and no person or company uses them to make decisions about you.
- AI can be wrong. Estimates from a photo can be off, often by 20% or more, and advice is general. Please read section 15.
Health details such as conditions, medicines, blood pressure and blood sugar are “sensitive” or “special category” information under many laws (for example GDPR Article 9, India’s DPDP Act, and US state consumer health data laws). We process them only with your explicit consent, only to give you the answer you asked for, and we never sell them or use them for advertising.
5. Why we use information, and our legal bases
Some laws, such as the GDPR, require us to state a legal basis for each use. Where other laws apply, we use information only for the same purposes.
| Purpose | Information | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Providing the features you choose (practice tools, trackers, badges) | Information on your device | Performance of our service at your request (Art. 6(1)(b)). It stays on your device. |
| AI calorie checks, meal plans, plate advice and chat | Photos, meal details, health profile, questions | Your explicit consent (Art. 6(1)(a) and Art. 9(2)(a)) |
| Sending water reminders | Push address, time zone, hours, goal, daily count | Your consent, given when you turn reminders on (Art. 6(1)(a)); permission is also asked by your browser |
| Recording your privacy choices | Consent records | Legal obligation to be able to show consent (Art. 6(1)(c) and Art. 7(1)) and our legitimate interest in keeping accurate records (Art. 6(1)(f)) |
| Fair-use limits, security and fixing errors | Hashed IP counters, device ID, server logs, error notes | Our legitimate interests in keeping the service safe, available and free (Art. 6(1)(f)) |
| Visit statistics | Analytics data | Your consent (Art. 6(1)(a)); you can change it at any time |
| Answering feedback and requests | What you send us | Our legitimate interest in replying to you (Art. 6(1)(f)), and legal obligation for rights requests (Art. 6(1)(c)) |
| Complying with law and protecting rights | Any information we hold, as needed | Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, we have weighed them against your rights, and you may object (see section 11). Where we rely on consent, you may withdraw it at any time; this does not affect anything done before you withdrew.
6. Who receives information
We share information only with the service providers below, who process it for us under contract and are not allowed to use it for their own purposes, except where stated.
| Who | What for | Information | Where |
|---|---|---|---|
| Amazon Web Services, Inc. | Hosts our website and server | Everything that passes through or is kept on our server (sections 3b to 3d) | United States |
| Anthropic PBC | AI engine for Prana Plate, Mitra and Calorie Meter | Photos, meal details, health details and questions you choose to send | United States |
| Google LLC | Google Fonts; Google Analytics if you allow statistics; Chrome and Android push delivery | IP address and browser details; analytics data; push address | United States and other countries |
| Automattic Inc. (if we use Jetpack) | Visit statistics | IP address, browser details, pages viewed | United States |
| Apple, Mozilla and Microsoft | Deliver water reminders to Safari, Firefox and Edge, depending on your browser | Push address and a content-free “wake up” signal | United States and other countries |
| Our email delivery provider | Delivers feedback and site emails to us | What you put in the feedback form | United States |
We may also disclose information if required by law, court order or a valid government request; to protect the rights, safety or property of our users, the public or us; or as part of a merger, sale or transfer of our business, in which case this policy will continue to apply to that information or you will be told of any change.
We do not sell personal information, and we do not “share” it for cross-context behavioral advertising (as those terms are used in California and other US state laws). We have not done so in the past 12 months.
7. Cookies, local storage and statistics
108 Pranayama itself uses your browser’s local storage (similar to cookies, but it stays on your device) to save your practice, plans and settings. This is strictly necessary for the features you ask for, so it does not need separate consent, but you can delete it at any time.
WordPress, the system our site runs on, sets cookies only for our own administrators when they sign in. Visitors do not get WordPress cookies.
Visit statistics cookies are used only if you tick “Help improve 108 Pranayama with visit statistics”. We honor the Global Privacy Control (GPC) signal: if your browser sends it, statistics stay off and the choice cannot be switched on. You can change your choice at any time with the “Privacy choices” link at the bottom of every page.
8. How long we keep information
| Information | How long |
|---|---|
| Information on your device | Until you delete it, clear your browser data or use “Erase all my 108 Pranayama data on this device” |
| AI requests (photos, meal and health details, questions) | Not stored by us. Deleted by Anthropic within 30 days, except as described in section 4 |
| Water reminder details | Until you turn reminders off or erase your device data, or until the push address stops working |
| Consent records | 6 years from the date of each record, as proof of consent, then deleted automatically |
| Fair-use counters (hashed IP and device ID) | 24 hours |
| Server logs | Normally about 14 days |
| Error notes | Until the next successful request replaces them |
| Feedback emails | Up to 2 years, or less if you ask us to delete them |
| Analytics data | No more than 14 months, then deleted automatically by the statistics provider |
9. How we protect information
We keep most information off our servers, which is the strongest protection of all. All traffic to and from our site is encrypted with HTTPS. Our AI key is kept on our server and never sent to your device. Access to our server and records is limited to our administrators and protected by strong credentials. Our service providers maintain their own security programs.
No method of storage or transmission is completely secure, so we cannot guarantee absolute security. Anyone who uses your unlocked device can see what is stored on it, so please protect it with a screen lock. If a security incident affects your personal information, we will notify you and the authorities where the law requires it.
10. International transfers
We are based in the United States, and our server and main service providers are in the United States. If you use 108 Pranayama from another country, information you send through our service is transferred to and processed in the United States, where data protection laws may differ from yours.
Where the law requires a safeguard for such transfers (for example from the European Economic Area, the United Kingdom or Switzerland), we rely on our providers’ data processing terms that include the European Commission’s Standard Contractual Clauses and the UK Addendum, or on a provider’s certification under the EU-US Data Privacy Framework and its UK and Swiss extensions, where available. For the AI features, the transfer also happens with your explicit consent. You can ask us for more details about these safeguards.
11. Your rights, wherever you live
Whatever country you live in, you can ask us to:
- tell you what personal information we hold about you and how we use it, and give you a copy;
- correct information that is wrong;
- delete your information;
- withdraw consent you have given, at any time;
- object to or restrict how we use it, and opt out of statistics;
- move your information to another service (data portability).
Most of this you can do yourself, instantly. Your practice, profile, plans and logs are on your device: view and change them in the app, download a backup in My Sadhana or Prana Plate, and erase everything with the button in Your privacy choices. Erasing also deletes your water reminder details from our server.
For anything we hold on our server, write to us using section 17. Because we do not know your name, please include the device ID shown in Your privacy choices so we can find the right records. We may ask for reasonable information to confirm the request is genuine. We will reply within one month (or within the time your local law sets, for example 45 days in California). If a request is complex we may extend that time as the law allows, and we will tell you why. We do not charge for requests unless they are clearly excessive, and we will never treat you differently for using your rights.
If we decline a request, we will explain why. You can ask us to reconsider (an appeal) by replying to our answer; we will respond to an appeal within 45 days (60 days where local law allows). You can also complain to your data protection authority (see section 12).
12. Extra information for your region
European Economic Area, United Kingdom and Switzerland
Your rights under the GDPR, the UK GDPR and the Swiss Federal Act on Data Protection include all the rights in section 11, including the right to object at any time to processing based on our legitimate interests. You have the right to lodge a complaint with the supervisory authority where you live or work, or where you believe a breach happened; a list is at edpb.europa.eu, and in the UK it is the Information Commissioner’s Office (ico.org.uk). We would appreciate the chance to resolve your concern first.
United States
California. Under the California Consumer Privacy Act as amended by the CPRA, California residents have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of its sale or sharing (we do not sell or share it); to limit the use of sensitive personal information (we use it only to provide the services you ask for, which the law permits); and not to be discriminated against for exercising these rights. You may use an authorized agent; we may ask the agent for proof of authority and ask you to confirm your identity. In the past 12 months we have collected the categories described in section 3: identifiers (random device ID, IP address), internet activity (server logs, statistics if allowed), approximate location (time zone), sensitive personal information (health details sent to the AI engine with your consent), and audio or visual information (meal photos you take). We disclosed them for business purposes only to the service providers in section 6. We obtained them from you and your device. “Shine the Light”: we do not disclose personal information to third parties for their direct marketing.
Other states. Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, Nebraska and other states with comprehensive privacy laws have rights to confirm, access, correct, delete and obtain a copy of their personal data, to opt out of targeted advertising, sale and certain profiling (we do none of these), and to appeal our decision. If we deny your appeal, you may contact your state Attorney General. We process sensitive data, including health data, only with your consent.
Washington, Nevada, Connecticut and other consumer health data laws. See our Consumer Health Data Privacy Policy below.
Massachusetts. We take reasonable steps to protect personal information of Massachusetts residents consistent with Massachusetts data security rules.
Canada
Under PIPEDA and provincial laws, including Quebec’s Law 25, you may access and correct your personal information and withdraw consent. Our person in charge of the protection of personal information is our Privacy Officer, reachable at the contact in section 17. Your information may be processed in the United States as described in section 10. You may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the Commission d’accès à l’information du Québec.
India
Under the Digital Personal Data Protection Act, 2023 and its rules, you (the “data principal”) have the right to a summary of the personal data we process and of whom we share it with, to correction, completion, updating and erasure, to withdraw consent as easily as you gave it, to grievance redressal, and to nominate another person to exercise your rights in the event of your death or incapacity. Our Grievance Officer is listed in section 17, and we will respond within the time the law requires. If you are not satisfied, you may complain to the Data Protection Board of India. 108 Pranayama is not intended for anyone under 18, and we do not knowingly process children’s data.
Middle East
If you live in the United Arab Emirates, Saudi Arabia, Qatar, Bahrain, Oman or elsewhere in the region, you have the rights given by your local data protection law (for example the UAE Personal Data Protection Law and Saudi Arabia’s Personal Data Protection Law), including access, correction, deletion and withdrawal of consent. We process your health information only with your explicit consent and transfer it to the United States as described in section 10. You may complain to your national data protection authority.
Asia-Pacific
Residents of Singapore (PDPA), Australia (Privacy Act 1988 and the Australian Privacy Principles), New Zealand (Privacy Act 2020), Japan (APPI), South Korea (PIPA), Malaysia, the Philippines, Indonesia, Thailand, Vietnam and other countries have the rights in section 11 under their local laws. Your information is processed in the United States as described in section 10. You may complain to your local authority, for example Singapore’s PDPC, the Office of the Australian Information Commissioner (OAIC), or New Zealand’s Office of the Privacy Commissioner.
Brazil and elsewhere
Residents of Brazil have the rights under the LGPD, including confirmation, access, correction, anonymization, deletion, portability, information about sharing and withdrawal of consent, and may complain to the ANPD. If your country is not listed, you still have every right in section 11, and any further rights your local law gives you.
13. Consumer Health Data Privacy Policy (United States)
This section applies to “consumer health data” as defined by the Washington My Health My Data Act, Nevada SB 370, the Connecticut Data Privacy Act and similar state laws.
- Categories we collect: health conditions, medicines, blood pressure, blood sugar and HbA1c, age, sex, height, weight and goals that you enter in Prana Plate; meal photos and descriptions; water and step counts.
- Where it is kept: on your device. We collect it on our server only to send it to our AI engine when you use an AI feature, and we do not keep it.
- Why: only to give you the calorie estimates, meal plans, advice and answers you ask for.
- Sources: you, and your device’s motion sensor for steps (which stays on your device).
- Who receives it: Anthropic PBC, our AI service provider (processor), and Amazon Web Services, our hosting provider, only as it passes through our server. No one else.
- Consent: we collect and share consumer health data only with your consent, given separately before the first use. We never sell it.
- Your rights: to confirm whether we collect, share or sell your consumer health data; to access it, including a list of everyone it was shared with; to withdraw consent; and to have it deleted. Use Your privacy choices or contact us (section 17). You may appeal a refusal as described in section 11, and if the appeal is denied you may contact your state Attorney General.
14. Children
108 Pranayama is for adults aged 18 and over, and everyone must confirm this before using it. It is not directed at children, and we do not knowingly collect personal information from anyone under 18 (or under 13 for the purposes of the US Children’s Online Privacy Protection Act). If you believe a child has used our AI features or contacted us, please tell us and we will delete any information we hold.
15. Wellness, not medical advice
108 Pranayama, Prana Plate, Mitra and Calorie Meter offer general wellness information and estimates. They are not medical advice, diagnosis or treatment, and they do not replace a doctor, dietitian or other qualified professional. Always ask your doctor before changing your diet, exercise or medicines, especially if you have a health condition, are pregnant or breastfeeding, or take medicines for sugar, blood pressure or the heart. In an emergency, call your local emergency number straight away. Please also read the health and safety section of our Terms of Use.
16. Changes to this policy
We may update this policy as our services or the law change. The version and effective date at the top will change, and if the change matters, everyone will be asked to read and accept the new version the next time they open 108 Pranayama. Earlier versions are available on request.
17. How to contact us
Shri Anand LLC (operator of 108 Pranayama)
22 Robinson Road, Westford, MA 01886, United States
Privacy Officer and Grievance Officer: jai.lalwani@thecloudpartner.com
Please put “Privacy request” in the subject and include your device ID from Your privacy choices.
You can also use our feedback form.