How we keep your records safe

Last updated 25 October 2026

A horse’s journal holds vet reports, passports, what you paid and who looks after it. Here is what we do to protect it, in plain words — and how you can check.

Private by design

• No advertising, no analytics, no trackers. Nothing follows you around the web, and we never sell or rent your data.
• One cookie, and only to keep you signed in.
• Beyond the people you invite and the calendar you connect, your data reaches only the few companies that host, email or bill for EquiDiary, each for that one job. The privacy notice names every one of them.

Your account

• Your password is stored only as a salted hash made with a deliberately slow algorithm (PBKDF2) — never in a form anyone, us included, can read back.
• When you choose a password, we refuse the 5,000 most common ones. There are no rules about symbols or capitals: a long phrase you can remember is better than a short one you can’t.
• Signing in, creating an account and asking for a reset link each pass a bot check first. After 10 wrong passwords in 15 minutes, signing in to that address pauses — counted per network, so someone guessing elsewhere can’t lock you out. Changing your password or deleting your account asks for your current one again, and allows the same 10 wrong tries in 15 minutes.
• Your sign-in cookie is sent only over HTTPS, only to the app, and can’t be read by scripts on the page. Every sign-in starts a fresh session, and changing your password signs out every other device.
• The app only accepts changes made from its own pages: a request sent from any other website is refused.
• If we ever set a password for you — when you’re locked out and ask us to — it only lets you choose your own, and stops working after 3 days. We also email your confirmed address to say so, unless it has already had its daily limit of account emails.

Your horse’s records

• A horse is seen only by its owner and the people the owner invites. That is checked on our server for every request, inside the database query itself; the app hiding a button is never what protects your data. Anyone else is told the record doesn’t exist.
• Photos and documents sit in private storage and are handed only to people allowed to see them. Every upload is checked to be what it says it is — a photo has to really be a photo — and a file is only ever served as a picture, a video or a download, never into a frame on another website or as a script.
• Videos play through signed links, each for one video and valid for at most 12 hours. When you revoke a share or remove someone’s access, they get no new links, and the ones they already have stop working within those 12 hours. Videos added before we moved to a dedicated video service are kept and served like photos.
• Share links are read-only and never show prices or account details. You can limit one to some categories or a start date, give it an expiry date, and revoke it at any moment.
• The links we email you — to confirm your address, reset your password or accept an invitation — keep their secret part where your browser never sends it to a server, so it can’t end up in a log.

On the way, and in storage

• Connections are encrypted (HTTPS, TLS 1.2 or newer), and browsers are told never to connect without it. One exception: when a calendar app subscribes to your phone-calendar link with one tap, its very first request can arrive over plain http. We send it on to HTTPS before reading it, but that first request, link included, has already crossed the network unencrypted (details).
• The app, the database and your files run on Cloudflare.
• Once a day a backup copy goes to a server we rent in Canada. It is encrypted before it is stored, and the key that opens it is kept offline, not on that server. Anything you delete leaves the backups within 30 days.
• Our error log holds no email address, no IP address and none of your private links, and is kept for at most 7 days.

On your phone or computer

• The app keeps a copy of your journal on the device so it works at the barn without signal. Logging out deletes that copy first — and if you’re offline at the time, your session is ended the next time the app connects.
• Your data stays yours: Account → Download my data gives you a copy of your records, photos, documents and videos — up to 100 minutes of video in one download, the whole of a standard account’s allowance, and the dialog names any video it leaves out. Account → Delete my account removes your data; the privacy notice lists the few things that stay, such as the entries you logged on someone else’s horse.

Checked against a published standard

We check EquiDiary against the OWASP Application Security Verification Standard (ASVS), version 5.0 — an open list of security requirements for web applications, written by the security community, not by us. Its Level 1 is the baseline it asks of every application.

Our latest check, completed on 25 October 2026, went through all 70 Level 1 requirements. Each one is met, or concerns something EquiDiary doesn’t have — operating-system commands, rich-text input, XML, WebSockets, signing in other companies’ users. Two are met by a different route than the requirement describes, and we explain why.

We repeat it whenever something it relies on changes, and at least once a year.

Not there yet

Some protections belong to the standard’s Level 2, which we haven’t assessed against. Three you might expect and won’t find yet:

• No second step at sign-in, such as a code or a passkey on top of your password.
• A session lasts 90 days unless you log out; it doesn’t end early when left unused.
• No list of the devices you’re signed in on. Changing your password signs out all of them.

Found a problem?

If you think you’ve found a security weakness, write to support@equidiary.com with what you found and how to reproduce it — the same address our security.txt gives. Please keep it private until it’s fixed; we’ll tell you when it is, and thank you by name if you’d like.

OWASP is a trademark of the OWASP Foundation, Inc. EquiDiary is not affiliated with or endorsed by the OWASP Foundation.