Privacy policy

Protecting your data is important to us. This privacy policy explains how we collect, use, and protect your personal data. It applies to all services provided through HorseCompanion.

Data Controller

The operator of HorseCompanion is responsible for data processing. If you have questions about data protection, you can contact us at any time via the feedback function in the app.

What Data We Collect

We collect the data the app needs to work: email address and name at registration, information about your horses (name, breed, date of birth, photos), activities and calendar entries, health records and feeding plans, training entries and BCS assessments, expenses and receipts, emergency contacts and QR code emergency profiles. With GPS ride tracking switched on, location data is recorded and stored only during an active ride. Technically, the following also arises: IP address and browser identifier (user agent) on every request, details of your signed-in devices and sessions, logs of security-relevant actions including IP address and browser identifier, usage events with the page visited including its parameters and the referring source, metadata for your passkeys, the address of your push endpoint in the browser or the device identifier for notifications in the app, and logs of emails sent.

How We Use Your Data

Your data is used exclusively for providing and improving the service. This includes: coordinating riding partnerships between partners, displaying your horses, activities and health data, notifications and reminders, and usage statistics for troubleshooting and further development of the app. These usage events are linked to your account and are therefore not anonymous. Only the daily summaries derived from them are. We do not sell data to third parties and do not use it for advertising purposes.

Cookies & Tracking Technologies

HorseCompanion sets no cookies of its own. We use localStorage for functional purposes (authentication, language setting, theme preference) and sessionStorage for session management. Cloudflare, as our CDN and WAF provider, may set technically necessary security cookies. If you consent to the analytics category, we additionally use Sentry for session replay and performance tracking, along with usage statistics collected in the browser. Independently of that consent, the server logs actions you trigger in the app, such as creating or changing an entry. Your account identifier and browser identifier are recorded along with them. This server-side recording serves operations, troubleshooting and further development, and cannot be switched off. You can adjust your settings at any time via the cookie banner or under Security & Privacy in your profile.

Third-Party Services

We use the following third parties. Cloudflare provides CDN, WAF and DDoS protection. Every connection passes through it, including your IP address and browser identifier. Sentry monitors errors and receives error reports with technical details, among them your email address. Session replay and performance tracking run only with your consent. An error report you submit yourself additionally contains your name, email address and the name of the horse concerned. Brevo delivers our emails and receives the recipient address, the name and the full content of the message, along with its delivery events. For notifications in the browser, the push services of the browser makers (Google, Mozilla, Apple) receive the device-unique endpoint address. The content of the notification is end-to-end encrypted and unreadable to them. We delete the endpoint address when you turn notifications off, when you sign out in that browser, when the push service reports it as invalid, and at the latest together with your account. Notifications in the app are covered in their own section. OpenStreetMap supplies the map tiles. Your browser loads them directly, which transmits your IP address and the map section shown. ip-api.com locates your sessions in the security area and receives your shortened IP address for that. These services also process data outside Switzerland.

Notifications in the App

In the Android app, notifications are delivered by Firebase Cloud Messaging (FCM) from Google, and in the iOS app by the Apple Push Notification service (APNs) from Apple. This happens only if you switch on notifications in the app. The service then receives an identifier that your device assigns to the app, along with the content of every notification, meaning its title and text. This content may include the names of horses and other people. Unlike notifications in the browser, the content is not end-to-end encrypted here, although the transmission itself is encrypted. The sole purpose is delivering the notifications. The data is not used for advertising and is not passed on to any further third parties. Google and Apple also process it outside Switzerland. The legal basis is your consent, which you give by switching notifications on. You can withdraw it at any time by switching notifications off again. We store the device identifier for as long as it is valid. We delete it when you sign out of the app, when the service reports it as expired or invalid, and at the latest together with your account.

Program Updates for the App

The apps download program updates exclusively from our own domain (www.horsecompanion.ch/app-updates/) and not through a provider. The check for whether an update is available contains no identifier. When downloading an update, the app transmits a randomly generated device ID. This ID is derived neither from your account nor from characteristics of your device, and it is sent only to our domain. We neither store nor evaluate it.

Data Storage & Security

All data is transmitted encrypted (TLS/HTTPS). Our own database and the uploaded files are held on servers in Switzerland. The third parties named above also process data outside Switzerland. Access is protected by authentication with one-time codes. Regular backups protect your data against loss. Sessions can be reviewed and revoked at any time in the security area.

Your Rights

You have the right at any time to: access your stored data, export your data in JSON format (via Security & Privacy in your profile), delete your account and all associated data, withdraw your consent to analytics tracking. To exercise your rights, use the corresponding functions in the app or contact us via the feedback function.

Retention Periods

Your data is stored for as long as your account exists. If you delete your account yourself, your account and its associated content are removed immediately and irreversibly. Excluded from this are logs of emails already sent, which contain the recipient address and name, and any reason for deletion you volunteered. If an account goes unused for a longer period, we contact you after 90 days. If it remains unused, we announce the deletion by email at least 30 days in advance with a specific date and delete the account no later than 180 days after the last use. You can keep your account at any time by signing in or clicking the link in our email, or you can pause it. Backups already created are not covered by a deletion. They are overwritten automatically within three months at the latest as part of the retention cycle. Aggregated daily summaries without any personal reference may be kept longer.

Deleting your account

How to delete your account, what is erased and what remains is set out step by step on its own page: Go to the account deletion guide

Changes to This Privacy Policy

We may update this privacy policy from time to time. Significant changes will be communicated via the app. Continued use after an update constitutes acceptance of the amended policy.