What we hold, and what we will not do with it.

Your account

Your email address, the name you choose to show, and your password stored only as a scrypt hash with a separate secret mixed in. We never hold your password and we cannot read it. If you turn on two-factor authentication we hold the secret for it, encrypted.

The records you make

Horses and their identity details, health entries, medicines, worming, vaccinations, farrier visits, weights and condition scores, documents you upload, costs, rides, feed charts, care notes, contacts for your vet and farrier, yards, fields, tack and vehicles. Anything you type into a note.

Identifiers belonging to a horse

Microchip numbers, passport numbers and freeze marks, where you enter them. These are held as restricted: never shown on a shared view, never printed on a stable door label, and never included in anything a scanned code opens. They identify an animal and, through it, often you.

Where a horse is kept

The yard you name, and the layout of fields and stables you draw. This is location data about a valuable animal, so it is treated as sensitive even though the law does not class it that way.

Photographs

Photographs you upload. Location and camera data embedded in the file is stripped before the image is stored, on everything except a scan of paperwork, where the capture date can be part of the evidence. A photograph of a horse standing in a field otherwise carries the coordinates of that field.

Technical records

Server logs needed to run and secure the service, and a record of sign-in attempts in which the IP address is stored hashed rather than in the clear. None of it is used to build a profile of you.

We do not collect contacts, advertising identifiers, browsing history, or anything for tracking you across other sites or apps.

• Running your account and storing your records, to perform our contract with you.
• Syncing between your devices so the offline companion works, to perform our contract with you.
• Sending reminders you have asked for, to perform our contract with you.
• Sending account emails such as a password reset or a security alert, to perform our contract with you.
• Keeping the service secure and preventing abuse, our legitimate interests.
• Answering your support requests, our legitimate interests.
• Weather at your yard, your consent, and only if you ask for it.

There is no line on that list for advertising, for profiling, or for analytics, because we do none of them.

One cookie, called sid. It keeps you signed in. It is strictly necessary for the service to work, so it needs no consent, and that is why you are not asked to dismiss a banner before reading anything.

There is no analytics, no advertising and no third-party script on any page. The cookies page sets out the detail and what would change if that were ever to alter.

Only the suppliers we need to run the service, each under contract, and each limited to what the job requires:

• HOSTING PROVIDER, which holds the database and the uploaded files.
• EMAIL PROVIDER, to send account and reminder emails.
• WEATHER PROVIDER, if you ask for weather. An approximate location is sent and nothing about your account goes with it.

We do not sell your data, we do not rent it, and we do not share it for anybody else's marketing.

This is different from the clause above, and it is the part of this notice most worth reading.

When you share a horse with a sharer, a yard or a vet, you are deciding to show your records to another person. We carry that out; we do not decide it. What they see is set by you, permission by permission, and you can withdraw it at any time.

Two things follow that people find surprising later:

• Entries somebody else made remain on the record after their access ends, attributed to them, because a care history with gaps in it is not a care history.
• Access granted to a yard resolves to whoever that yard currently says its members are. When somebody leaves the yard their access ends without you doing anything, and when somebody joins they gain whatever the yard grants them within the limit you set. You are always able to see the current list.

A livery client at a yard is never shown anything about another client's horse.

To investigate a fault you have reported, an administrator may open your account in a read-only support view. We see what you see and we cannot add, change or delete anything.

Every one of those sessions is time limited and written to an access log: who looked, at which account, when, and why. That log is kept even if the account is later deleted, because a record of who looked at your data is worth nothing if it can be erased by the person who looked.

We do this to answer a problem, never to browse. Ask us at SUPPORT EMAIL whether your account has ever been opened this way and we will tell you.

Data is held on servers in the UK or the EEA. Connections are encrypted in transit. Passwords are hashed with scrypt and a separate secret, two-factor secrets are encrypted at rest, and photographs have their location data stripped on upload.

We keep your records while your account is open. When you delete your account your sign-in is removed and your records are purged from the live systems. Copies inside encrypted backups are gone within BACKUP RETENTION.

Two things outlive the account, and both are deliberate: the support access log described above, and entries you made on somebody else's horse, which belong to that horse's record. Those entries can be reduced to your first name at your request.

Under the UK GDPR you can ask to see your data, correct it, erase it, take it elsewhere, restrict what we do with it, or object. You can withdraw consent for anything you gave it for.

You do not have to ask us for the first two. Export and delete are both buttons on the settings page and neither needs our permission. For anything else, write to SUPPORT EMAIL.

If we get it wrong you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first, but it is your right either way.

Accounts are for people aged MINIMUM AGE and over. Plenty of people who look after a horse are younger than that, and the honest reason for the line is that a product holding a child's name, their yard and their daily routine carries obligations under the Children's Code that we have not yet worked through properly.

Until we have, an adult holds the account. A young rider can be recorded as the person who rode or did the care, under a first name, without an account of their own.

We may update this notice. The date at the top will change, and anything material will be told to you in the product. We will not quietly widen what we collect and hope you do not notice.