Privacy Policy

Effective date: September 27, 2026 · Last updated: September 27, 2026

This Privacy Policy explains how Ariel Coaching (“we,” “us,” or “our”) collects, uses, discloses, protects, and deletes information when you use arielcoaching.com (the “Site”), the Ariel Coaching mobile app (the “App”), workshop reservation forms, optional account and encrypted-backup features, or paid program enrollment. We've written it in plain language, and we've tried to be thorough and honest. We do not sell personal information or use it for targeted advertising. By using the Site or App, submitting a reservation, or enrolling, you agree to the practices described here.

1. Information we collect

Workshop reservations. When you reserve a place, we collect your name, email address, and selected gathering. You may also provide a phone number, city or town, message, and how you heard about us. Those optional fields are not required. We do not store your IP address with the reservation.

Interest in paid offerings. If you use a “Share your interest” form, we collect your name, email, chosen offering, and any phone number or message you choose to provide so we can follow up. These forms do not collect payment information and do not complete a purchase.

App data stored locally. The App can store information you enter—such as your name, vision, reflections, check-ins, progress, choices, and practices—on your device. An account is not required. Photos and local photo references used by the vision board stay on the device and are not included in encrypted backup.

Paid program enrollment. If you enroll in the Vision Circle, we collect the name, email address, and any optional phone number, goal, or referral code you submit. We also keep the program, cohort, amount, payment status, consent timestamp, and identifiers Stripe provides so we can confirm enrollment, issue or record refunds, reconcile payments, and prevent duplicate processing.

Information we do not collect. We do not store your IP address with your reservation, and we do not use tracking cookies. We do not receive or store your complete card number, security code, or bank account and routing numbers. Those details are entered on Stripe's hosted checkout and processed under Stripe's privacy and security practices.

Optional account and sign-in data. If you request a sign-in link or turn on encrypted backup, we collect the email address you provide and create opaque account and session identifiers. A one-time link is sent by email. We store a cryptographic hash of that link's token, not the raw token. When a web sign-in succeeds, we set a necessaryHttpOnly, Secure, SameSite=Laxsession cookie so the browser can perform account actions without exposing the session token to page scripts.

Optional encrypted backup. If you enable backup, eligible saved writing, progress, and app choices are encrypted on your device before upload. Our servers receive ciphertext, an app storage-category key, and client/server update timestamps needed to sync changes and deletions. We do not receive the plaintext. Your recovery code is kept on your device and is not uploaded, so we cannot recover it or decrypt the backup for you.

Coarse analytics. The Site uses Cloudflare Web Analytics for aggregate traffic information. The App and Site may send a small, fixed set of coarse product events, such as reaching a screen or completing a step. Event properties are restricted to approved low-cardinality labels. They do not include your writing, photos, name, email address, phone number, or free-form messages. We do not store raw IP addresses with these events.

2. How we use information

We use information only as needed to:

• hold and manage reservations and respond to offering inquiries;
• communicate with you about the workshop or offering you asked about;
• send requested confirmations and one-time sign-in links;
• authenticate account actions and provide optional encrypted backup and sync;
• process and reconcile paid enrollment, refunds, and disputes;
• place confirmed participants in the correct program and cohort;
• send transactional enrollment and onboarding communications;
• operate, secure, troubleshoot, and improve the Site, App, and gatherings;
• comply with applicable law and protect participants and the service.

We do not use this information for targeted advertising or make automated decisions that produce legal or similarly significant effects.

3. How we share information

We do not sell, rent, or trade personal information and do not share it with advertisers. We use service providers only as needed to operate the service:

• Cloudflare hosts the Site and API, stores reservations, account metadata, and encrypted backup blobs, and provides aggregate web analytics and rate-limiting infrastructure.
• Resend — email delivery. When you reserve, we send you a confirmation email and notify Ariel. We may also send reminders for the workshop you reserved, with a link to stop those reminders; when you request a one-time sign-in link, or when a paid enrollment or refund is confirmed, we send transactional messages. Resend processes the recipient address and message contents needed to deliver them. Ariel's private admin message may contain the contact/intake details you supplied, cohort and payment status, referral, and Stripe reconciliation identifiers.
• Stripe, Inc. — secure hosted checkout, payment processing, fraud prevention, payouts, and refunds. Stripe receives the payment and billing details you enter on its checkout, along with the participant name, referral tag (if any), cohort/date, enrollment reference, and terms version/acceptance time needed to match a signed payment or refund to the enrollment. We do not send your optional goal or phone number as Stripe metadata. See Stripe's Privacy Policy.
• Twenty CRM — contact and cohort management. It stores and organizes reservation and offering-interest contact and logistics details so our team can manage attendance and follow up. After a paid enrollment is confirmed, we also sync the contact details, program, cohort, payment status, and the optional goal or referral information needed for onboarding. We do not sync card, bank, Checkout Session, or Payment Intent identifiers to the CRM.
• Pydantic Logfire processes the limited, first-party product and reliability events described above when app analytics are enabled in a release.

We may disclose information when required by law, valid legal process, or to protect the rights, safety, and security of participants or others.

4. Retention and deletion

We retain reservation, offering-interest, and enrollment information only as long as reasonably necessary to run the gathering, provide the program, support you, reconcile payments, prevent duplicate processing, follow up as requested, and meet accounting, tax, chargeback, or other legal obligations. When it is no longer needed, we delete it. You may request deletion at any time, subject to records we must retain (see Section 7).

An optional account's email, account identifiers, and encrypted backup remain until the account is deleted or they are no longer needed to provide the service. One-time sign-in links stop working after about 15 minutes and are single-use. Sessions stop working after up to 30 days; related expired records may remain until routine operational cleanup or account deletion.

You can delete the optional account and all of its server-side encrypted backup in the App's Settings screen or through our outside-the-app account-deletion page. Deletion also revokes server sessions and removes outstanding sign-in links for that email. It does not erase saved work or photos that remain locally on a device; those must be removed on that device. Deleting a backup cannot recover a lost recovery code.

5. Cookies and tracking

The Site uses Cloudflare Web Analytics, a privacy-first, first-party analytics service. Specifically:

• No cookies. Cloudflare Web Analytics does not set cookies and does not use them to track you.
• No personal information. It records only coarse, aggregate signals (such as which pages are visited and general region). It does not capture your name, email, phone, or anything you type, and it does not fingerprint you or track you across other websites.
• No third-party advertising or tracking SDKs. The analytics run on our own infrastructure and are not sold or shared with advertisers.

We do not use any tracking or advertising cookies anywhere on the Site. Stripe's separately hosted checkout may use security and fraud-prevention technologies under Stripe's own policy; Ariel Coaching does not use those technologies for advertising.

Website funnel analytics. The Site also records a small, fixed set of first-party, non-identifying events—for example, that the Vision Circle slide QR was scanned or secure checkout was started. These events contain only enumerated program/source tags and a coarse browser category. They never contain your name, email, phone, IP address, form answers, payment details, or free-form text, and are stored in our Cloudflare D1 database only to understand the aggregate enrollment path.

If you sign in on the Site for an account action, we use the strictly necessary secure session cookie described in Section 1. It is not an advertising or analytics cookie, page scripts cannot read it, and it is cleared when the account is deleted or the browser signs out.

6. Your choices and rights

An App account and encrypted backup are optional. You can leave backup off and keep saved work on your device, export the data available to you, turn backup off, or delete the optional account and server backup. Depending on where you live, you may also have rights to access, correct, delete, or restrict personal information and to object or appeal.

Use the account-deletion page for an optional App account, or contact us at the address below for another data request. We may need to verify that the email belongs to you before acting on a request.

7. Security

We use reasonable safeguards, including encrypted transport, secure passwordless sessions, one-time short-lived links, restricted access, and client-side encryption for optional App backup. No transmission or storage system is completely secure, so we cannot guarantee absolute security. Keep your recovery code private: anyone with both an encrypted export and that code may be able to read the backed-up content.

8. Children's privacy

The Site, App, and gatherings are intended for adults. We do not knowingly collect personal information from children under 13 (or the applicable minimum age in a person's jurisdiction). Contact us if you believe a child has provided information so we can address it.

9. Changes to this policy

We may update this Privacy Policy as the service changes. We will revise the “Last updated” date above and reflect significant changes on this page.

10. Contact us

For privacy questions or data requests, email [email protected].

This Privacy Policy is provided for general informational purposes and does not constitute legal advice.