Privacy Policy

1. Scope and contact

Hypnotist Secrets LLC operates Hypnotist Secrets. This policy covers personal information handled for our free-training site, blog, sales website, course and workshop delivery, purchases, optional attempt reviews, and support. Send privacy questions or requests to tyler@hypnotistsecrets.com with “Privacy request” in the subject. Movement, Stripe and PayPal also handle information for their own platform, payment, security, and legal purposes; their notices apply to that processing.

2. Information involved

Depending on how you interact with us, information includes:

• Account and contact details: name, email address, account identifiers, and information you choose to provide.
• Purchase records: product, price, transaction identifiers, payment status, billing details supplied through checkout, refunds, disputes, and limited payment-method information available in merchant records.
• Course activity: access permissions and learning activity, such as saved lesson progress, watch positions and private notes in our member library, legacy activity recorded by Movement, or measured playback coverage in our workshop player. Playback records help deliver relevant workshop follow-up; they do not prove that a person paid attention.
• Personal reviews and account notifications: review allowances and purchased credits; submitted video links or authorized uploads; context, recordings, feedback links, follow-up conversations, work-start and delivery times; commercial-permission wording, version, choice, timestamp and participant releases; notification content, recipients, delivery state, read or unread state and read times visible to Tyler.
• Support communications: your message, attachments, and information needed to investigate your request.
• Technical information: IP address, browser/device information, request times, pages requested, referrer information when transmitted, and security or error logs processed by hosting and service providers.

Payment credentials are entered into the payment provider’s checkout, not a card form operated by this sales website. We do not request your full card number, security code, password, or authentication code by email. Please do not send health records or sensitive information about yourself or participants; it is not necessary to purchase the course.

3. Sources and purposes

Information comes from you, your browser, and providers involved in fulfilling your purchase. We use it to deliver orders, create or match accounts, grant correct access, supply receipts and login instructions, respond to support, investigate errors, prevent abuse, process refunds and disputes, maintain records, and comply with legal obligations. We may use aggregate or de-identified information to understand service performance, without attempting to re-identify it.

Where applicable law requires a legal basis, we rely on performance of our contract for delivery and support; legal obligations for required records; legitimate interests for proportionate security, troubleshooting, and dispute handling; and consent where required for optional marketing or non-essential tracking. We do not rely on this policy as blanket consent to unrelated uses.

4. Checkout, anonymous measurement, and browser preferences

Current full-course purchases use our members website to select a fixed package and then open hosted Stripe checkout. Course access, saved progress, private notes and protected workbook downloads are delivered through our member library. Some course videos use provider-hosted media, including Mux and YouTube; those providers receive normal playback requests when you open a lesson. Existing Movement deliveries remain available under their original purchase terms. The separate workshop checkout uses Stripe for card, wallet and supported local payments, or PayPal when you choose PayPal. PayPal sends us the payment status and transaction details needed to provide access, handle refunds and resolve disputes. Workshop email sign-in and private video playback use our members website. Checkout, authentication, fraud prevention and video delivery can require cookies or other platform storage. These service functions are separate from website analytics.

Across our main, members, free-training and blog websites, optional browser analytics follows the regional defaults and your saved choice described below. When enabled, page events measure page views, visible-page time, scroll milestones, training and offer-link activity. Events from the same page share a random identifier held only in that page’s memory. A new page has a new identifier: this module does not store a visitor or session identifier in cookies, local storage or session storage, and does not build a cross-page customer journey. We clear the older journey, session and workshop-attribution identifiers when this module loads.

We send only allowed event details, page paths, referring hostnames and four limited campaign labels—source, medium, campaign and ad variant—to PostHog. The browser module does not send email addresses, form contents, card details, full URL query strings or session recordings. Requests disable person-profile creation and geographic enrichment; connections still involve ordinary technical network processing. The random page identifier is not a count of distinct people and does not follow someone between pages.

Approved links to our workshop checkout can carry those four campaign labels, without a visitor identifier. With a recorded analytics setting that permits measurement, the workshop also records aggregate counts of validated checkout details, payment starts, email verification, training access, playback milestones and course-offer clicks. These stage events contain no buyer name or email. After Stripe confirms an actual $7 payment and a setting that permits analytics is recorded, our server can export a separate aggregate purchase event with an event-specific random identifier, amount, currency and the limited campaign labels. For this aggregate event measurement, a purchase event is not joined to a browser-page identity. A checkout open, thank-you visit or closed payment form is never counted as a purchase. Declining analytics or a supported browser privacy signal suppresses this anonymous measurement; it does not prevent checkout or delivery. For this anonymous measurement, we do not collect Google click IDs or upload these conversions to Google Ads.

When our service identifies your region as the United States, Canada or Australia, optional analytics and Ad measurement default to on unless you have turned them off. In other regions, or when your region is unavailable, they stay off unless you have explicitly turned them on. Saved rejections, Global Privacy Control, Do Not Track and owner or test exclusions take priority over these defaults. Automatic regional defaults are recorded separately from an affirmative choice. You can review or change both settings on this Privacy Policy page; email marketing has its own separate choice. We may store this privacy preference in local storage and a first-party preference cookie for up to one year so participating pages can respect it; the preference is not a visitor identifier. Participating pages respect the shared analytics preference and browser privacy signals. Necessary service records and separately permitted ad measurement follow their own rules described here. Signup, email confirmation and training delivery remain separate from anonymous measurement. Optional exports of provider-confirmed full-course purchase analytics to PostHog require a recorded analytics setting that permits measurement for the relevant purchase context, whether established by an eligible regional default or your explicit choice. A payment-provider notification alone does not establish that setting. Where we cannot verify that measurement is permitted, no new optional PostHog purchase event is exported. When permitted, aggregate purchase events contain a separate random event identifier, amount, currency and offer type, without buyer name, email, payment identifier or browser identity. Necessary financial and service records remain available for payment processing, fulfillment, refunds, disputes and recordkeeping even when optional analytics is off. New page analytics and the $7 workshop checkout do not create or reuse that former journey link. Payment and signup records needed to deliver a service are separate from anonymous analytics. Free-training signup sends the supplied email to Brevo for confirmation and the requested training sequence. When you submit your workshop checkout details, we save your name, email and checkout state in Brevo, including if payment is not completed. Confirmed payments update the purchased workshop and optional review records. Checkout capture does not enroll you in marketing email sequences; marketing enrollment uses a separate explicit choice.

Browser settings and separate provider controls can affect embedded content; blocking necessary platform content may prevent checkout or login from working. This implementation does not use Google Analytics, Meta Pixel, session recordings or advertising retargeting.

Owner and test traffic

Analytics and testing controls can exclude this browser from customer reports. This non-identifying preference is shared across our subdomains for up to one year. An authenticated owner session also sets an exclusion marker so routine site checks do not appear as customer activity. Known automated test visits are excluded. This preference does not change purchases, account access, email choices or advertising permission.

Optional funnel reports count browser contexts with permitted measurement, not verified individual people. Clearing cookies or using another browser can count again. Visits without an applicable optional measurement permission are not included in measured-browser reports. Necessary service and financial records remain separate.

Page tests and optional first-party funnel measurement

We compare alternate headlines on our workshop, course and Inner Circle offer pages. When analytics is off, a headline is selected only in page memory and no headline assignment cookie is stored or reused. When analytics is on under an eligible regional default or your saved choice, each page test may store a first-party cookie containing only A or B for up to 30 days so this browser sees a consistent headline when it returns. Turning analytics off clears these headline cookies, including when you change your choice on this privacy page. The assignment does not identify a person, change prices or alter purchased access. A separate Ad measurement choice does not by itself permit persistent headline cookies.

When analytics is on under an eligible regional default or your saved choice, free-training pages may also store first-touch and last-touch campaign context in this browser. When analytics is off, campaign context stays in page memory. Turning analytics off removes those optional browser-storage records; necessary signup, payment and access records remain separate.

When analytics is permitted by an eligible regional default or your current explicit choice, we may use a separate opaque, HttpOnly first-party context cookie for up to 30 days. A current, separately permitted Ad measurement context can also support first-party funnel reports. When permitted, we can recognize the same browser across return visits and our main, blog, free-training, course and members pages, and connect its headline assignment and page milestones to verified purchases, payment adjustments and video playback milestones within that period. These records support aggregate owner reports about measured browsers, conversion rates, revenue and playback, not counts of distinct people or proof of attention. Reports include only activity for which the required permission is present; they do not reconstruct past activity.

The optional first-party context and internal purchase or account references stay in our own service. We do not send that context identifier, customer identifiers, names, email addresses, card details or lesson content to PostHog. Playback activity is not sent to Google through this feature. Permitted page-only PostHog events use a separate in-memory identifier. Google ad revenue measurement has its own choice and disclosure below.

Global Privacy Control, Do Not Track, an analytics-off setting and an analytics rejection suppress optional funnel measurement. Turn off withdraws this permission and stops future collection associated with that first-party context. Necessary purchase, sign-in, access and saved-progress records remain available for service delivery. The measurement context expires after 30 days. Reports cover only the latest 30 days and exclude expired or withdrawn contexts. Necessary financial records follow their separate retention requirements. You can use the analytics controls above or contact tyler@hypnotistsecrets.com for a privacy request.

Optional Google Ads revenue measurement

Optional Ad measurement has a separate control on our Privacy Policy page. When our service identifies your region as the United States, Canada or Australia, it defaults to on unless you have turned it off. In other regions, or when your region is unavailable, it stays off unless you have explicitly turned it on under the current notice. Automatic regional defaults are recorded separately from an affirmative choice. Global Privacy Control, Do Not Track, a saved analytics rejection, analytics-off and owner or test exclusions keep it off. An Ad measurement rejection does not turn off separately permitted analytics. Email marketing permission is separate. Checkout and purchased access work either way.

When Ad measurement is on under the rules above, we retain an eligible Google ad-click identifier in private first-party measurement records and link its context to verified payments across our offers. This can include the initial workshop and optional add-ons, courses, later purchases and paid subscription renewals within the retained context and Google’s eligible matching window. We send Google the click identifier, actual paid amount, currency, payment time and an opaque transaction code, and use refund or dispute adjustments to correct previously reported revenue. A choice without an eligible click does not create a Google-attributed purchase. We do not upload your name, email, payment credentials, lesson content or playback activity through this feature, and do not enable enhanced conversions, Google Analytics, ad personalization or retargeting.

Google may also use first-party advertising cookies when Ad measurement is on; its requests involve ordinary technical information such as IP address and browser details. See How Google uses your information and Google’s Privacy Policy. The separate preference and notice version are stored in first-party cookies shared between hypnotistsecrets.com and members.hypnotistsecrets.com for up to one year. A separate opaque, HttpOnly context cookie connects permitted measurement across those subdomains for up to 90 days. Our code does not put click identifiers in browser local storage or add them to checkout links. We configure Google’s first-party advertising cookies for 90 days without extending that period on each page load. We delete raw click identifiers 90 days after capture. Private payment and adjustment measurement rows are retained for 90 days after payment; opaque context references remain only while needed to reconcile those rows. Service maintenance removes expired measurement records, separately from necessary financial records.

You can turn Ad measurement off using the control on this Privacy Policy page. Withdrawal stops future uploads associated with the revoked context, clears its context cookie and accessible Google ad cookies, and reloads an active tag page. A privacy signal overriding an existing permission also turns that permission off; allowing measurement again requires a fresh choice. A failed first-party withdrawal request is retried on a later page visit. Withdrawal does not undo processing already completed by Google, remove necessary financial records, change email choices or affect purchased access. For privacy requests, contact tyler@hypnotistsecrets.com.

5. Service providers and other disclosures

We disclose information as needed to providers supporting the service: Movement for existing course deliveries and upstream media; Mux and YouTube for provider-hosted course playback; Stripe, PayPal and participating financial providers for payments; OpenAI Sites infrastructure using Cloudflare Workers, D1 and R2 for our member library and workshop website, accounts, private notes, progress, private resources and video storage; Brevo for sign-up, authentication, service and separately permitted marketing email; PostHog for optional page analytics and confirmed-purchase measurement only with a recorded setting that permits analytics as described above; Google for separately permitted ad revenue measurement; website hosting and measurement providers, and email providers for support and service messages. They may process information in their role as our provider and, where applicable, for their own disclosed obligations and services.

We may share relevant records with professional advisers, banks, payment networks, or authorities to resolve disputes, meet a legal obligation, or protect rights and security. If the business is reorganized or transferred, relevant information may transfer subject to applicable law and appropriate notice. We do not authorize public disclosure of your support messages or participant material simply because you submit them. We do not sell customer contact lists or use this website to share personal information for cross-context behavioral advertising.

See Stripe’s Privacy Policy and PayPal’s Privacy Statement. Movement’s current privacy notice is available through its platform and checkout. Independent sites reached through links have their own practices.

6. Retention and security

We retain information for the purposes described here, considering account access, support needs, transaction and tax record obligations, fraud prevention, and unresolved disputes. Different records may need different retention periods; a deletion request does not require us to delete records we must lawfully retain. Information no longer needed should be deleted or de-identified, subject to provider backup and retention processes.

We use reasonable safeguards appropriate to the information and rely on providers for their platform security. No online service can guarantee absolute security. Keep your account and email secure, do not forward login links, and tell us promptly about suspected unauthorized access. Where a security incident requires notice, we will provide it in accordance with applicable law.

7. Your choices and privacy requests

You may contact us to request access to, correction of, or deletion of your information. Depending on your location and applicable law, you may also have rights to a copy or portability, restriction of processing, objection to certain uses, withdrawal of consent, appeal of a denied request, and complaint to a privacy regulator. These rights may have lawful exceptions.

Send your request from the email used for your account if possible, specify what you are requesting, and do not include passwords or payment credentials. We may need proportionate verification or proof of an authorized representative’s authority. We respond within the timeframe required by applicable law and explain applicable limitations. To appeal our response, reply with “Privacy appeal.” We will not penalize you for exercising protected rights. Deleting information necessary to maintain an account can prevent continued access; we will explain that consequence when applicable. Providers may require separate requests for information they independently control.

8. Messages and marketing choices

Purchase confirmations, authentication links, security notices, support replies, review receipts and corrections, feedback-ready notices, follow-up replies, available-review reminders and essential account updates are service communications. An unused paid-credit reminder does not imply that the credit expires. Account notification read/unread actions and read times are visible to Tyler for managing service communication; they do not prove attention or understanding. This feature does not add email-open tracking. If we send optional promotional emails, you can use the unsubscribe instructions or email us to stop them. Opting out of marketing does not cancel a purchase or prevent necessary service messages. We will obtain marketing consent where required; purchase alone is not universal consent to every future promotion.

9. International processing and children

We operate in the United States and our providers may process information in the United States and other countries. Privacy laws may differ between countries. Where applicable law requires safeguards for an international transfer, appropriate safeguards or a permitted legal mechanism are required; contact us for information relevant to your account.

The courses and purchases are intended for adults 18 and older, not children. We do not knowingly seek children’s personal information for these services. If you believe a child has supplied information, contact us so we can investigate and take appropriate action.

10. Updates

The effective date appears above. We may revise this policy to reflect changes in the service or requirements. Material changes will be identified on the website or communicated through appropriate account channels, and consent will be sought when required. A revised policy does not authorize a use that requires permission we have not obtained.

Workshop & personal video reviews

Workshop accounts at members.hypnotistsecrets.com and the course library use verified email sign-in. Older Movement accounts remain separate. For personal reviews we process account and purchase references, membership eligibility, 30-day allowance and paid-credit records, the submitted recording or hosted link, context and questions, recorded feedback or its link, follow-up comments, work-start and delivery times, service notifications and permission records. These records deliver the service, prevent duplicate entitlement use, support corrections and conversations, administer refunds and document permission.

Stored review links and conversations are restricted to the customer and authorized administrators. To limit ongoing storage costs, new submissions and feedback may use externally hosted links such as YouTube, Google Drive or Dropbox. Account protection does not add access restrictions to the external video: unlisted and anyone-with-the-link files can be viewed or reshared by anyone holding the link. The uploader controls the source file’s sharing and deletion settings. Opening a provider link or loading a player connects to that provider under its privacy terms. Do not submit footage unless the participants agreed to its recording, private review and selected sharing method.

Original attempt videos in our private hosted storage and private downloaded working copies are deleted 90 days after feedback delivery. That schedule does not delete a source hosted by the uploader. Feedback links and review conversations remain available in the account after membership ends while needed to provide review history, unless deleted under an applicable request. We retain only the entitlement information needed to preserve an unused purchased credit; we do not need an indefinite original-video copy to preserve that credit. Necessary payment, support, work-start and permission records follow their separate support, dispute and legal retention needs. Contact us about deletion of an abandoned, inactive or unusable submission.

The optional commercial-use checkbox starts unchecked for both members and paid customers. Its exact wording, version, choice, account, submission and timestamp are recorded. It covers only rights the submitter can grant; every other identifiable participant must provide a separate verified release before public or commercial reuse. Approved uses include promotional content, paid advertising, monetized videos and paid training, including permitted editing and excerpts. You retain ownership. A separately authorized commercial copy may be retained while permission remains effective. Withdrawing permission stops future uses as described in the release and does not affect an otherwise eligible review or purchased credit. Earlier interest-only records are not converted to commercial licenses. Read the review privacy information and optional media release.

Choosing optional promotional emails is separate from purchases, service messages and footage permission. Where offered, the optional email choice requires an affirmative request and email confirmation before marketing begins. You can unsubscribe without losing purchased access. Account notification read records stay in our service; this feature does not add email-open tracking.