Privacy

Last updated 5 November 2026

EquiDiary is a private journal for your horse. We keep only what the app needs to work, and we don't sell it or track you. This page says who it reaches, and why.

What we store

• Your account — your first name, surname, and email, plus your password stored only as a salted hash (never in plain text).
• Your horse records — the horses, people, and events you enter: dates, categories, treatments, notes, and prices.
• Photos and documents (such as PDF vet reports) you upload for a horse, a person, or yourself. If the virus check described under Where your data lives matches one, the file is marked with what matched and when; if that turns out to be a false alarm and we give the file back, the name of what matched stays on it for as long as the file is stored, so that the same false alarm is not raised again.
• Videos you attach to events — a lesson, a lameness check — which can show people as well as horses, such as a rider or a groom.
• Messages you send us from the Help page — your question, idea, or problem report, and any replies in that conversation, kept so we can read them and answer you in the app. When we answer, we also email our answer to your account address, once you have confirmed it.
• Where your account came from — recorded once when you register, and only ever one short label: the tag on one of our own links (say a campaign we ran), or otherwise the name of the site you followed a link from, such as facebook.com. Never the page you were on, never anything about what you were reading, and nothing at all if you came here directly. We also note whether you signed up in our iOS app or on the web.
• A sign-in cookie so you stay logged in. It's the only cookie we set, and it exists purely to keep your session.
• The devices you’re signed in on — for each, the kind of browser and system it reported, such as “Safari · iPhone” (never the full description your browser sends), the country it signed in from, and when it was last used, so that you can see them under Account → Signed-in devices and sign any of them out. Each goes when that device signs out or its session ends: after 30 days unused, or 90 days at most.
• Two-step sign-in, if you turn it on — the key your authenticator app shares with us, stored encrypted with a key the database does not hold; the newest 30-second step a code was accepted for, so that no code works twice; and your 10 recovery codes, stored only as hashes. For each security key or passkey you add: the name you give it, its public key (which can check the key’s signature but cannot make one), the id it answers to, how many times it has been used, and when it was added and last used. All of it goes when you turn two-step off or delete your account, and a key’s when you remove it.
• A note that an account existed — one line when an account is created and one when it is deleted, holding the dates and a scrambled form of the email address, never the address itself. It is kept when the account is deleted, and it exists so we can answer "was there ever an account here?" when something looks wrong. The scrambling is one-way and uses a key only the app holds, so nobody who gets at the database can read an address out of it — we can only check it against an address someone already gives us.
• A security record — a line each time someone signs in to your account or fails to, a password is changed or reset, a horse is shared or a share link or the phone calendar link is made or removed, an administrator changes your account, the virus check withholds one of your files or gives it back, or the app refuses a request, such as a share link that no longer exists. Each line holds the time, the account's number, the number of the record the request was about, the country the request came from, and the network it came from and any email address typed (the address a horse is shared with included), both in the same one-way scrambled form — never the IP address or the email address itself. It is kept for 90 days, so we can see what happened when something looks wrong, and then deleted — and not sooner, even if you object or ask: a record that could be cut short could be cut short by whoever it is there to catch.
• A short error log — when something goes wrong, the app notes what failed and when, naming the account involved by its number, so we can fix it. Each line of the security record above is copied into it too, without the scrambled network or address, so that a record someone wiped from the database could still be read. Cloudflare keeps it for up to 7 days. It holds no email address, no IP address and none of your private links: share links, the phone calendar link, or the links we email you.

What we don't do

• No advertising, no ad networks.
• No analytics or third-party trackers — nothing follows you around the web.
• We never sell or rent your data. Beyond the people, the calendar and the records import you choose, it only reaches the few companies that host, email or bill for EquiDiary, named under Where your data lives — and only for that.

Photos, videos, documents & voice notes

Photos and documents are stored in Cloudflare's object storage and are private — a horse's files are visible only to its owner and the people that horse is shared with.

Videos are kept by Cloudflare Stream, Cloudflare's video service, which also converts them to play on any device. They are private too, but protected differently from photos: a video plays only through a signed link, which is given only to people who can see the event it belongs to, lasts at most 12 hours, and until then plays for anyone who has it. So when you remove someone's access or revoke a share link, they get no new links, and the videos stop playing for them once the ones they have expire — though a copy they already downloaded stays with them.

When you dictate a note, the short audio clip is sent to Cloudflare's on-platform AI to turn it into text and is not kept afterwards; only the text you save stays in your journal.

Sharing is yours to control

A horse's owner decides who can see it. When you invite a rider, coach, vet, or farrier, you choose whether they can view only, or also add and edit events. You can remove anyone's access at any time, and doing so leaves the horse's record intact.

Turning on Account → Phone calendar gives you a private link to the care that comes due and the dated tasks on the horses you can see: horse names, types, dates, task instructions and, for a task someone else set, that person's name. The calendar you add it to — Google Calendar, Apple's Calendar, Outlook or another — reads it from then on and keeps its own copy, under that company's privacy terms rather than ours. Anyone who has the link can read the same, so keep it to yourself. Making a new link or turning it off stops the old one working at once; what a calendar already copied stays there until you remove the EquiDiary calendar from it.

If you ask us to import your records

This applies only if you send us records under Help & feedback → Import your records. If you never do, nothing here concerns you.

• What we receive — the photos, scans or files you send, and what you tell us about them.
• Who reads them — a member of our staff, with the help of Claude, an AI assistant made by Anthropic in the United States. The files are sent to Claude from that person’s computer to prepare the entries, which they check before anything is added to your account. Besides the files, it sees only the names of your horses, people and types, so that the entries land in the right places — never your entries or your email address. We use Anthropic’s API under its commercial terms and do not allow this data to be used to train its models. Its standard retention period is 30 days at most. There are exceptions, including complying with the law and enforcing its usage policies, set out in its retention policy.
• What we add — the entries go into your account in your name, each marked as coming from that import, so that you can take the whole import back out under Help & feedback at any time.
• How long the files stay — they are deleted when the import is finished, declined or withdrawn, after 2 days if you never send the request, and with your account if you delete it. The copy on our staff member’s computer goes when the import is finished, and the one in our backups within 30 days. We keep the request itself — when you sent it, your note and our answer — with your account. The short email that tells us a request has arrived carries your name, email address and note, and stays in our mailbox even if you delete your account, like the notices under Deleting your data; ask, and we’ll delete it too.
• Why we may — because you ask us to (GDPR Art. 6(1)(b)). The box you tick when you send the files is not consent in the law’s sense: it confirms what you are asking us to do, and who will read the files to do it.

Where your data lives

EquiDiary runs on Cloudflare — the app, the database, the photo and document storage, and the video service. Staging and admin areas are additionally protected behind Cloudflare Access. A few other companies each handle one part:

• Backups — once a day, a copy of the database, photos, documents and videos goes to a server we rent from OVHcloud in Canada, so your records survive even if something goes wrong at Cloudflare. The copy is encrypted before it is stored, and the key that opens it is not on that server, so the server itself cannot read it. It is used only to restore EquiDiary, and anything you delete leaves it within 30 days. The same server also checks each new photo and document for known viruses: it reads the file from Cloudflare and checks it without keeping a copy, and a file that matches is withheld from everyone, not deleted, while we look into it and write to its owner, and to whoever added it if someone else did.
• Email — address confirmations, password resets, care reminders, invitations to the people you share a horse with, and our answers to your messages from the Help page are sent through Cloudflare's email service. Our support mailbox is at Zoho Mail: emails you write to us arrive there, and we answer them from there.
• Payments — subscriptions bought on the web are sold by Polar, which takes your card details on its own checkout page; we give it your email address and an account number, so it can tell us when your subscription is active, and the IP address you open its checkout from, so it can charge the price and tax for your country. In the iOS app, Apple sells the subscription through the App Store instead, and tells us whether it is active.

Like any host, Cloudflare sees the IP address your device connects from: it needs it to deliver the app and to fend off attacks, and its security tools keep a short record of the requests they block. EquiDiary itself keeps your IP address only in scrambled form, in the sign-in and sign-up counters described under Why we're allowed to use it and in the security record.

Why we're allowed to use it

Data protection law — the GDPR in the EU and the UK, and its counterparts in Switzerland and Mexico — asks us to say on what grounds we use your data. For EquiDiary there are three:

• To give you the service you signed up for (GDPR Art. 6(1)(b)) — your account and horse records, photos, videos and documents, sharing with the people you invite, dictation, the phone calendar, the emails the app sends you, our answers to your messages from the Help page, and your subscription.
• To keep EquiDiary safe and working, our legitimate interest (Art. 6(1)(f)) — the daily backups; checking photos and documents for viruses; protecting sign-in, through Cloudflare's bot check and a count of wrong passwords, which ties each attempt to the address typed and the IP address it came from, keeps both only in scrambled form, and clears them within a day; a count of the accounts created from each network, which keeps the network only in scrambled form and clears it the next day; the note that an account existed; the security record, kept 90 days; where your account came from, so we know which of our efforts bring people in; and the one personal email we may write after you sign up, to ask how it's going. You can object to any of these — see Your rights — but the security record keeps its 90 days even then, for the reason given above.
• When the law requires it (Art. 6(1)(c)) — if a law obliges us to keep or hand over something, that obligation is the ground.

We never ask for your consent to anything, because we do nothing that would need it: no ads, no tracking, no newsletters. The sign-in cookie is the kind the law counts as strictly necessary.

Deleting your data

You can delete your account yourself under Account → Delete my account. It removes your horses, events, people, custom categories, photos, videos and documents, the messages you sent us and our answers to them, and sessions from EquiDiary at once, and what remains of them in our backups — Cloudflare's own and the daily copy described above — expires within 30 days, after which it is gone for good. Six things stay:

• the one-line note described above, with the address kept only in the scrambled form that can't be read back;
• the security record's lines about your account, each until it is 90 days old, and in the backups for up to 30 days after that;
• the events you logged on someone else's horse, with their photos and videos — they remain part of that horse's history, without your name attached;
• what a calendar you connected under Phone calendar already copied: deleting the account stops the link at once, but the calendar keeps its copy until you remove the EquiDiary calendar from it;
• the emails in our mailbox: anything we wrote to each other, and the short notices EquiDiary sends us when an account is created or a message comes in from the Help page, which carry your name and email address and, for a message, what you wrote. Ask, and we'll delete those emails too.
• what Cloudflare's email service keeps about the emails it sent you: a record of each one — the address, the subject and whether it arrived — for about 30 days, and, if an email to you bounced because the address does not exist, or you reported one as spam, your address on its list of addresses not to write to, until we take it off. Ask, and we'll take it off.

Prefer we do all of it? Email support@equidiary.com from your account address.

Your rights

Wherever you live, you can ask any of these of us. It costs nothing, and we answer within 20 days.

• Get a copy — Account → Download my data gives you, at any time, your full record in a machine-readable format (JSON) that you can take to another app, with your photos, documents and videos. To know what else we hold about you — the emails in our mailbox, say — just ask.
• Correct it — you can edit your horses, people and entries yourself, and your name under Account. To change the email address on your account, write to us.
• Delete it — see Deleting your data above.
• Object, or ask us to pause — you can object to the uses that rest on our legitimate interest, and ask us to stop using some of your data while a question about it is being settled.

Nothing about you is decided by a machine alone. To ask for any of this, email support@equidiary.com from your account address, which is how we know the request is yours; from another address, we may first ask you to confirm it.

If you think we've handled your data wrongly, tell us and we'll put it right. You can also complain, at any time, to the data protection authority where you live or work: in the EU, your country's authority — the European Data Protection Board lists them all; in the UK, the ICO; in Switzerland, the FDPIC; in Mexico, the Secretaría Anticorrupción y Buen Gobierno.