---
title: "Privacy — Palaestral"
description: "What Palaestral holds about instructors and their clients, how long each record is kept, who else sees it, and how to ask for it to be deleted."
canonical: "https://palaestral.com/privacy"
---

# Privacy

This page states what is held, for how long, and what happens when somebody asks for it to be deleted. The retention periods below are not a description of the policy — they are the same numbers the deletion job enforces.

1. [What is held](https://palaestral.com/privacy#what-is-held)
2. [How long it is kept](https://palaestral.com/privacy#how-long-it-is-kept)
3. [Taking your records with you](https://palaestral.com/privacy#taking-your-records-with-you)
4. [Closing an instructor account](https://palaestral.com/privacy#closing-an-instructor-account)
5. [Asking for deletion](https://palaestral.com/privacy#asking-for-deletion)
6. [Who else sees it](https://palaestral.com/privacy#who-else-sees-it)
7. [Email and texts](https://palaestral.com/privacy#email-and-texts)
8. [Changes](https://palaestral.com/privacy#changes)

## What is held

Brick Sofa, LLC operates Palaestral and is the business responsible for the records this page describes.

An instructor's account holds the sessions they teach, the clients who book them, and what those clients paid. A client who books gives a name, an email address and the details their instructor needs to teach them safely — which may include health information they choose to share, and a signed waiver.

Card numbers are never held here. Payments run through Stripe, which collects the card directly; the instructor is the merchant of record for their own sessions. What is kept is a record that a payment happened and for how much, and Stripe's fingerprint of the card it was made with — which tells whether one card paid an instructor before, and never the number. A client's record erased at a place takes their name off the fingerprints of the payments made there.

A client can keep a card on file with an instructor they have booked with. It is saved on Stripe's own page, on the instructor's Stripe account, and what is held here is what a person recognises it by — the brand, the last four digits, the expiry — and Stripe's fingerprint of it, never the number. Each thing a saved card may be used for is agreed to separately, and each agreement is kept with what was shown, when, and the address and browser it came from. A card removed, or replaced by a newer one, is detached from the instructor's Stripe account.

A client who joins an instructor's membership is held as a member of it: the price, the visits and the lessons it covered when they joined, each month's dates and whether and when it was paid, the bookings its visits paid for, each pause, resume or cancellation asked for and who asked, and the agreement to be charged each month, kept as every agreement to use a card is. The card it charges is saved on the instructor's Stripe account as above, and the monthly payments are Stripe's to take there.

A client who makes a lesson weekly is held as holding a weekly booking: the lesson, its weekday and hour, the booking it was made from, the most a week may be charged to their card where they allowed it, the fees they agreed to, each week booked for them and what paid for it or why its seat went back, and who ended it, with the agreement they gave, kept as every agreement to use a card is. The signature on the booking it was made from stands for each week's while the waiver's text is unchanged.

There are no passwords. Signing in sends a one-time link to an email address, and the link is stored only as a hash.

A lesson pack bought as a gift holds the name and email address of the person it was bought for, and any message sent with it. Both are kept with the purchase, and the message is removed when either person asks for their data to be deleted. The instructor the pack is from sees who it was for, and never the message.

Anyone signed in can make a calendar address, which lets Google Calendar, Apple Calendar, Outlook or another calendar app show the lessons they booked — or, for an instructor, the schedule they teach at every place they teach. Only a fingerprint of the address is kept, with when it was made, when a calendar last read it and when it was turned off. A lessons calendar shows each lesson, where and when it is, and who teaches it. A teaching calendar shows each lesson, where and when it is, and how many seats are taken — never a client's name, notes, waiver or payment.

An instructor who moves to Palaestral can bring their client list with them. What is then held about a person in it is what the instructor's own records gave: a name, an email address, a phone number, when they last came, the instructor's notes about them and the lessons they had left. Nobody in a list brought over is sent anything because of it, unless the instructor asks for the one email that says they are here. A phone number from such a list is kept for the instructor to read and is never used to text anybody.

Arriving at an instructor's page from their Book on Google listing, or from their lessons on Things to do on Google, sets one cookie on Palaestral's API: a random identifier, kept 30 days, that records which listing the visit came from — and, from Things to do, whether it was found on Google Search or Maps; arriving again from the same Things to do listing within 24 hours is the same visit. Nothing else is held about the visit — no address, browser or account — and the cookie is cleared by any link or QR code Palaestral gives an instructor to hand out. A booking made in that browser is marked as one Google brought. Once a booking a Book on Google listing led to is confirmed, Palaestral tells Google that a booking happened, with Google's own reference and nothing about the person; Google's reference is deleted after the same 30 days. Where the instructor pays Palaestral a fee on a new client Google brought, the payment page asks the client how they heard of the instructor, and the answer is kept with the payment until the client's record is erased.

A client who asks to be texted about an instructor's lessons gives a United States mobile number, which is checked with a one-time code before any other text is sent to it. What is held is the number, when it was checked, each agreement to be texted about one instructor's lessons — with the words that were shown, when, and the address and browser it came from — and a record of each text: what it was about, when it left, and whether the carrier delivered it. An instructor is shown whether a client's texts are on, and never the number. A reply to the texting number is read by software for a request to stop, and its words are not kept.

An instructor or a front desk can sign in to the Palaestral app on a phone, with a code emailed to their address. If they turn notifications on, what is held about the phone is the address the notification service issued for that install of the app, whether it is an iPhone or an Android phone, the app's version, and which kinds of notification they chose. It is kept for as long as that sign-in lasts and is removed when they sign out, once the sign-out reaches Palaestral: a phone signed out without signal asks again each time the app is opened until it does, and as it signs out it asks the phone's notification service to stop sending to that install. A notification says a lesson's title, its day and time and a count of seats, and names no client. So that a lesson can be run without signal, the app keeps on the instructor's own phone the register of their lessons for today and tomorrow: the names of the people booked, whether each is a minor, whether each has signed, and whether each turned up. It holds no address, age, payment or note, and it is removed from the phone when the instructor signs out.

Anybody can join the list for instructor signups from [Get started](https://palaestral.com/start). It asks for an email address first, which puts the address on the list, and then, one question at a time and only if you choose to answer, what you teach, how you work, how many clients you teach, how they book and pay you today and what that costs, what you would change, where you teach, and whether you would take a call, with a phone number only if you ask to be called. It does not ask your name. The answers you give within an hour of joining are kept with the address's entry, rewritten with every answer so far each time you answer; answers given later, or after joining with an address already on the list, are not kept. Nothing else is kept with the answers: no network address, browser or page you came from. Each entry is filed under a keyed fingerprint of the address, so a listing of the list's storage, or a line the list writes about what it did, names nobody without the key. The entry itself holds the address and the answers as given, because the list mails the address and copies it over when signups open, and nobody but Brick Sofa, LLC can read it. One email is sent to the address, with a link to confirm it and a link to take it off, while the list is sending them; where it could not be sent — confirmations paused, or the address's mail service not answering — joining again with the address sends it then. An address nobody confirms is sent nothing more. A confirmed address is sent one email when instructor signups open, and a call is arranged only where you asked for one. Nothing on the list is sold or shared.

## How long it is kept

- **Client notes**: **24 months** from when they were written. Long enough that a seasonal client's history survives an off-season, short enough to be a promise worth making. A note an instructor brought from another system is kept 24 months from the date their records gave it, and one already older than that is not brought over at all.
- **Signed waivers**: **5 years** from signing. A waiver is evidence in exactly the situation it exists for, so it is kept past the last moment a claim could be brought rather than up to it.
- **A waiver signed for a minor**: Until their **20th birthday**, or 5 years, whichever is later. California pauses the clock on a claim until someone turns 18, so a guardian's signature for a nine-year-old stays relevant for about eleven years.
- **A waiver that covers weekly lessons**: **5 years** from the last weekly lesson it covered. One signature covers every week of a weekly booking while the waiver's text is unchanged, so it is evidence for the latest of those lessons, and is kept five years past it.
- **Names on an offer that was never booked**: **30 days** after the offer is answered. Asking about a time is not booking it, so the names and ages on a request stop being kept shortly after it is settled — whether it became a booking, which keeps its own record, or came to nothing.
- **An address that asked about signing up before signups were open**: **180 days** from the day it first asked. While signups are closed we record the address, when it asked, how many times, and whether it already had an account here, so we can tell you when they open — and no name. After that the address is deleted, and what stays — the dates and the count — names nobody.
- **An answer to the list for instructor signups**: **180 days** from the day it was given, and then deleted whole, the address with it. The storage the list is kept in deletes it on its own schedule, which runs whether or not anything else here does. Taking the address off, from the link in its email or by asking, deletes it from the list at once. When signups open, the address is copied over to be told so, and that copy is deleted the next time the list is read, which is always before that email goes, or when you ask at [hello@palaestral.com](mailto:hello@palaestral.com).
- **A note an instructor sent a client**: **24 months** for its words, the same as a note about them. The record that a note went — when, from whom, the instructor's postal address it printed, and how it ended — stays, with nothing in it about what it said.
- **An unsubscribe**: Kept for good, so that it goes on being honoured — as a keyed fingerprint of the address rather than the address, which cannot be read back into it.
- **A copy you download**: **7 days** after it is ready. A copy of your records waits for you on Palaestral for a week and is then deleted. A copy you saved to your own device is yours.
- **An instructor account that is closed**: Client notes, lesson plans, credentials and profile text are deleted **30 days** after the account closes, unless it is reopened first. Signed waivers and payment records are kept for their own periods here.
- **A calendar address**: Until it is turned off or replaced. The last **20** turned off are kept per person, so a calendar still reading one empties rather than keeping old lessons, and every one goes with the person's own account record.
- **A draft an assistant saved**: Its words until the instructor uses or discards it, and at most **30 days**; that it existed, and what became of it, for **a year**.
- **What an assistant read**: Which assistant read which person's record, and when, but never what it read: **a year**.
- **A connected assistant**: Until it is disconnected or reaches **90 days**, and its record for **a year** after.
- **A mobile number given for texts**: Until its holder removes or replaces it, or asks for their record to be deleted. A request for a code, with the number it was sent to, is deleted after **24 hours**.
- **A text's words**: **30 days**. After that the record says that a text went, what it was about and whether it arrived, without what it said.
- **The record of a text, and the agreement it was sent under**: **4 years** — a text from when it was written, an agreement from when it ended — which is the time within which a claim about an unwanted text can be brought. An agreement is kept against a keyed fingerprint of the number, never the number.
- **A request to stop texts**: Kept for good, as a keyed fingerprint of the number, so that it goes on being honoured whoever gives that number next.
- **Payment records**: Kept as long as tax and accounting rules require. This is the instructor's own record of what they earned.

Deletion is a scheduled job, not a manual pass. While the app is running it runs daily and is alarmed on *not* running, because a purge that quietly stops looks exactly like one that has nothing to do. While the app is asleep, its database does not exist, so there is nothing for the job to delete from.

## Taking your records with you

Anyone with an account can download everything Palaestral holds about them, from [Your account](https://app.palaestral.com/account), as one file. It holds their bookings, payments, cards on file (the brand and last four digits; no card number is ever held), memberships, weekly bookings, credits and the waivers they signed, each as a document showing the text they signed and when.

An instructor's copy also holds their schedule, clients, client notes, lesson plans, signed waivers with who signed and from where, every payment and refund, and what Palaestral and any studio took. A studio owner's copy holds the studio's roster, page, places, terms and payouts.

A copy holds what its owner can already see here and nothing more. A client's copy does not include the notes an instructor keeps about them; the instructor can hand those over from their own copy. Each person can ask for **3** copies a day.

We email you when your copy is ready. The email links to your account rather than to the file, so a forwarded email opens nothing. The file waits for **7 days** and is then deleted.

## Closing an instructor account

An instructor can close their account from [Your account](https://app.palaestral.com/account). Closing stops all new bookings at once and takes their pages and Google listings down. Their upcoming lessons are called off and refunded in full. Memberships end, with the unused part of the month refunded. Weekly bookings end. Unused lessons from a pack are refunded, and a gift's go back to whoever paid for it. Cards clients kept on file with them are removed. Each client is told what it meant for them.

For **30 days** the account can be reopened with its notes, plans and settings as they were. After that, client notes, lesson plans, credentials and profile text are deleted, and reopening starts fresh under the same name. Kept, and why:

- **Signed waivers**: A waiver is evidence in exactly the situation it was signed for, so it is kept for its own period — 5 years, or longer for a minor — and then deleted.
- **Payment and sales records**: Every payment, refund, fee and sale is a completed transaction and part of the instructor's tax record.
- **Consents to use a card**: What a client agreed to before a card was charged is the record the charge was made under.
- **The Stripe account**: It is the instructor's own and stays open. Palaestral goes on acting on it only to finish refunds, fees and disputes already under way.
- **Page names**: A name stays the instructor's, so a link already printed on a flyer never passes to somebody else.

A closed account can still sign in and download what is kept.

## Asking for deletion

Email [hello@palaestral.com](mailto:hello@palaestral.com), or ask your instructor directly — they carry it out from their own console, and the request reaches them either way. It removes client notes, the personal details attached to bookings, what an instructor brought over about them from another system, the words of any note an instructor sent them, any message sent with a gift they bought or were given, any card they kept on file with the instructors there, and the person's own account record. A card stays on file only where a membership, a weekly booking or a fee not yet charged with the same instructor at another place still charges it, since the request is not about that place. It also ends, at once, any membership and any weekly booking they hold there, so nothing more is charged for either, and takes down any copy of that place's records made for download before the request. Where nobody owns the place any more — its instructor has closed their account — Palaestral carries the request out.

An address on the list for instructor signups is deleted, with its answers, from the link in the email it was sent, or when you ask at [hello@palaestral.com](mailto:hello@palaestral.com).

**The account record is shared.** One record covers a person across every instructor they book with, so it is replaced once the last instructor holding a booking, a lesson pack or a membership of theirs, or who brought them over in a client list, has carried out the request. Until then each instructor's own records go as they act, and the response says which happened.

Calendar addresses are deleted with the account record, and lessons at a place that has carried out the request leave the person's calendar at once. A calendar app that subscribed keeps its last copy until the subscription is removed there.

Ten things are **kept**, and the response says so rather than implying everything went:

- **Signed waivers**, because deleting one would destroy the instructor's defence in precisely the scenario the waiver was signed for. They are kept for the periods above and then deleted.
- **Lesson credits**, because a credit is the unused part of a payment and is kept for the same reason the payment is. Once the account record goes, the balance names nobody.
- **Payment records**, because they are a completed transaction and the instructor's tax record.
- **Consents to use a card**, because what was agreed to before a card was saved or charged is the record the charge was made under, and is kept as the payment is. The card itself is removed.
- **Memberships**: each membership here is ended at once, so it renews and charges nothing again, and one whose first month was never paid is cancelled. What was paid for them stays as a payment record.
- **Late-cancel and no-show fees**: a fee here not yet charged is withdrawn, so nothing more is charged for a lesson here. One already charged stays as a payment record, and one being charged finishes on its own.
- **Weekly bookings**: each weekly booking here is ended, so no lesson is booked or charged for this person again, and weeks nothing had paid for are released. A week already paid for stays booked, and one being charged finishes on its own.
- **An unsubscribe**, where the address asked for no promotional email, so that it goes on being honoured if the person books again later. It is kept as a keyed fingerprint of the address, which cannot be read back into it.
- **Agreements to be texted**: each agreement to texts about lessons here is ended, so no text is sent again. What was agreed to, when and from where is the record each text was sent under, so it is kept for four years after it ended, against a keyed fingerprint of the number, which cannot be read back into it.
- **A request to stop texts**, where a number asked for no more texts, so that it goes on being honoured. It is kept as a keyed fingerprint of the number, which cannot be read back into it.

## Who else sees it

An instructor sees their own clients and nobody else's, and the person a lesson pack of theirs was given to. Stripe processes payments and Amazon Web Services hosts the system and delivers its email. Google receives what an instructor chooses to list there about their own business and lessons, and word that a booking a Book on Google listing led to was confirmed, by Google's own reference. A calendar app somebody adds their calendar address to receives what that address shows, as they chose, and keeps its own copy. Nothing is sold, and nothing is shared for advertising.

Searching for a place while adding one sends what is typed, with the point the map is centred on, to Amazon Web Services. Its Amazon Location Service answers the search from map data that HERE Technologies provides, ranking places near that point first, and may handle both outside the AWS region Palaestral runs in. Palaestral keeps nothing typed into the search: it keeps the position and address of the place chosen, as that location's own. Amazon lists the [sources of its map data](https://docs.aws.amazon.com/location/latest/developerguide/data-attribution.html). The map a location's pin is placed on is drawn from OpenStreetMap data, © OpenStreetMap contributors, and is served from Palaestral's own address, so drawing it tells no map provider anything.

Notifications to an instructor's phone are relayed by Expo and delivered by Apple or Google. Each receives the notification's words and the phone's address for the app, and nothing about a client.

Amazon Web Services delivers texts, and mobile carriers carry them. A mobile number and an agreement to be texted are never shared with anybody for their own marketing, and no number is sold.

An instructor can connect their own AI assistant, such as Claude, ChatGPT or Gemini, to their Palaestral account. The assistant can then read the instructor's sessions, the names of the people who book them and their lessons with that instructor, and the instructor's plans, programs, offerings and locations, and it can save drafts for the instructor to review. Somebody booked by someone else is named to it only when their age shows they are an adult, and no one's age is shared. Only if the instructor allows it, and only for clients who have not opted out, it can also read the notes the instructor keeps about clients, which can include health details. It never reads your email address, your phone number, anything you paid, your waiver, or a note you added for your instructor when you booked or made an offer. Names typed when booking reach it only for the person who booked, and for others whose age shows they are adults. An instructor's own notes and plans are their words, and may mention anyone.

What an assistant reads goes to the instructor's account with that assistant's provider, under the provider's terms and the instructor's settings there. That provider may keep it, and may use it to train its models, as its terms allow. Palaestral's retention periods and a deletion request reach what Palaestral holds, and cannot reach a copy the provider holds. You can stop your instructors' assistants from reading the notes kept about you, and see each time one read your record, under "Your instructors' AI assistants" on [your bookings page](https://app.palaestral.com/me).

## Email and texts

A text is sent only to somebody who asked for texts about an instructor's lessons: a reminder the day before a lesson, and word that a lesson was called off close to its start. Each is also sent by email, and none is an offer or an advertisement. Replying STOP ends every text from Palaestral to that number; the [terms](https://palaestral.com/terms#texts) set out the rest.

Every message sent from here is about the recipient's own business here: a sign-in link or code, a booking, a cancellation, a refund, a lesson pack, a roster seat, a payout, one email asking an address given to the list for instructor signups to confirm it, and one email when signups open to an address that asked to hear. Two messages are promotional, each from an instructor: a note they may write to somebody who has come to their lessons and stopped, and one email telling the clients they brought to Palaestral that they are here. Each prints the instructor's postal address, and its unsubscribe link stops both from every instructor here. Ask at [hello@palaestral.com](mailto:hello@palaestral.com) to stop receiving any of it.

An address that bounces, and an address whose owner marks a message as spam, are both suppressed — nothing further is sent to that address until it is reinstated, which under a passwordless sign-in also means that address can no longer sign in. The [full list of what is sent](https://palaestral.com/messages) names each message and who receives it.

## Changes

If a retention period changes, this page changes with it — a test fails when the numbers here and the numbers the deletion job uses disagree.

[Terms and refunds](https://palaestral.com/terms)