Privacy Policy
What this site collects, what it does not, and what you can ask for.
The short version
This site does not track you. There are no analytics, no advertising pixels, and no cookies set by Move Breathe Play. The only personal information collected is what you deliberately type into a form and send.
Who is responsible
Move Breathe Play is operated by Varun Das, trading as Move Breathe Play. For any question about this policy, or to exercise any of the rights below, write to varun@movebreatheplay.com.
What is collected, and when
When you send a message
The contact form asks for your name, email address, a subject line and your message. That information is used to reply to you and to keep a record of the conversation. Nothing further is inferred from it, and it is never sold or shared for marketing.
When you join the email list
Only your email address. It is used to send occasional updates about classes, the book, retreats and new tools. Every email includes a one-click unsubscribe, and leaving removes your address from the list.
Automatically
The site is served by Netlify, which keeps standard server logs including IP address, browser type and the pages requested. These are produced by the act of serving a web page and are used for security and troubleshooting.
Cookies
This site sets no cookies of its own. Two embedded features may set their own once loaded:
- Class videos. Videos are click-to-play. Until you press play, nothing is loaded from YouTube and no cookies are set. Playback uses youtube-nocookie.com, which limits but does not entirely eliminate tracking.
- Instagram. The Work With Me page embeds three Instagram posts, which load from Meta when you scroll to them and may set cookies.
Because no analytics or advertising cookies are used, there is no consent banner to dismiss.
Third parties that may receive data
- Netlify — hosting, server logs and form submissions.
- An email delivery service — stores list subscribers and sends the emails. The current provider can be named on request.
- Google — fonts and video thumbnails load from Google servers, so your IP address is visible to Google when a page loads.
- YouTube (Google) — only once you press play on a class.
- Meta, through the three Instagram embeds described above.
Each operates under its own privacy policy. Move Breathe Play does not sell personal information to anyone, and does not share it with advertisers.
Why we are allowed to hold it
Where data protection law requires a legal basis: enquiries are handled because it is necessary to respond to your request and because there is a legitimate interest in running the business; newsletter emails are sent on the basis of your consent, which you may withdraw at any time by unsubscribing or by writing to us.
Where your information goes
These providers operate internationally, so information may be processed outside your country, including in the United States. Where required, transfers rely on the providers' standard contractual clauses or equivalent safeguards.
How long it is kept
Enquiries are kept for two years after the last message, then deleted. Newsletter subscriptions are kept until you unsubscribe. Server logs are kept according to Netlify's own retention schedule.
Keeping it safe
The site is served over HTTPS, form submissions travel encrypted, and access to stored enquiries and subscriber lists is limited to Varun and protected by strong authentication. No system is perfectly secure, but nothing is stored that is not needed. If a breach ever occurred that put your rights at risk, affected people and any relevant supervisory authority would be notified without undue delay.
No profiling
There is no automated decision-making and no profiling. Nobody is scored, segmented by behaviour, or targeted based on what they read here.
Your rights
Depending on where you live, you may have the right to ask for a copy of your information, correct it, delete it, restrict or object to how it is used, withdraw consent, or receive it in a portable form. Write to varun@movebreatheplay.com and it will be handled within 30 days. There is no charge for a reasonable request.
If you are in the UK or EU and are unhappy with the response, you may complain to your national data protection authority.
Do Not Track
Since no tracking takes place, Do Not Track and Global Privacy Control signals require no separate action — the outcome is the same either way.
Children
This site is not directed at children under 16, and information is not knowingly collected from them. If you believe a child has sent us their details, write to us and it will be deleted.
GOODNIGHT JAR
GOODNIGHT JAR is a separate mobile application with its own privacy policy covering what you write into it. That policy will be published alongside the app, and it is the one that governs data you enter in the app. This policy covers the website only.
In outline: GOODNIGHT JAR uses AI to shape reflections; reviewed text or voice transcripts are sent securely for that purpose and are not used to train models; raw audio is not saved or sent to the reflection AI; bounded remembered patterns stay on the device; and GOODNIGHT JAR data can be cleared from within the app.
Changes
If this policy changes, the date below changes with it. Material changes will be flagged on the site.
Last updated 19 August 2026.