Privacy policy
Effective from 6 September 2026. Previous versions: 18 August, 12 August and 7 August 2026.
Paddoco is an app for riders and yards. This policy explains exactly what data it keeps, why, where, for how long and what you can do about it. It is written to be understood.
At a glance.
- We do not sell or rent your personal data, and there is no advertising. We may one day publish anonymous statistics about our users as a whole: section 4 explains exactly where the boundary lies.
- At present, there are no trackers or audience analytics. There are no advertising cookies, so there is no consent banner to click. If this changes, this page will say so and you will be informed through the app beforehand.
- Your data is hosted in the European Union: the database in Ireland and email delivery in France. Only the delivery of notifications to your phone passes outside Europe, and this requires your permission.
- Nobody reads your private messages, not even a yard administrator.
- You decide what you share, section by section.
- Since 12 August 2026, friends can see your horses' profiles even if they belong to another yard. Three sections are shared by default, seven remain private, and you can make everything “Only me”.
1. Who is responsible
Clément Faure, 156 avenue Jean Jaurès, 47000 Agen, France.
For any question about your data: [email protected].
2. What we collect, and why
We only ask for information that serves a purpose. Most fields below are optional, and the app works without them.
For your account
| Data | Purpose | Required |
|---|---|---|
| Email address | Signing in and resetting your password | Yes |
| Password | Signing in. We never see it: our hosting provider stores it as a hash | Yes |
| First and last name | Identifying you within your yard | No |
| Date of birth | Determining whether you are a minor, applying guardianship and calculating a price where the yard uses age-based pricing | No |
| Phone number, emergency contact | Contacting you, and contacting someone if something happens to you while riding | No |
| Profile photo | Identifying you | No |
| Riding level, federation licence | Yard activities and lesson bookings | No |
For your horses
Name, breed, coat colour, date of birth, SIRE number, photos, care records, shoeing, vaccination and worming reminders, exercise sessions, feed and observations. These concern an animal, but also reveal who looks after them and when, so they relate to you too.
For life at the yard
Your lesson bookings, rides, posts, replies, private messages and the photos you send in them, groups, friends, listings and payment records (paid or unpaid, never bank details).
What your device sends
| Data | When | Where it goes |
|---|---|---|
| Notification identifier | If you allow notifications | To Google, which delivers them to your phone. This is the only way to receive them. |
| Approximate location | Only when you tap “Near me” in the directories for yards, riders, listings, riding clinics or livery | To our database to calculate a distance. It is not stored or sent to anyone else. |
| A ride's GPS track | Only if you upload a GPX file to a ride or record the ride in the app | To our database, linked to that ride: track points, gaits and heart rate if your watch recorded it in the same file. It is visible to the audience you choose for the ride; see section 5. |
| Your position while following a route | When you tap “Follow this route” | Nowhere. Calculations happen on your phone. Nothing is written to the database or sent to anyone. |
A GPS track is location data, and we treat it as such. A ride remains private, shared with friends or shared within your yard until you decide otherwise. Heart rate is never shared with everyone: even on a public ride, it remains visible only to you and the people you choose.
We do not collect browsing data, page history or advertising profiles. The app stores only what it strictly needs on your device: your sign-in session and the yard you are viewing.
3. Legal basis
| What we do | Legal basis |
|---|---|
| Maintain your account and provide access to the app | Performance of our contract with you |
| Send you a notification you requested | Your consent, which you can withdraw at any time in settings |
| Send an email essential to the service: registration confirmation or password reset | Performance of the contract |
| Email you an alert you have not disabled | Your consent, which you can withdraw for each alert type in settings |
| Show your horses' profiles to your friends | Your consent, adjustable for each section and withdrawable at any time |
| Prevent abuse and mass account creation | Our legitimate interest in keeping the service usable |
| Keep a record of reported payments | Performance of the contract and the yard's legitimate interest in knowing who has paid |
4. Who else sees your data
Five providers process it on our behalf, solely to operate the service. No other partner currently receives it. If this changes, the partner will be named on this page, the reason explained, and you will be informed before it begins.
| Provider | What they do and receive | Where |
|---|---|---|
| Supabase | Hosts the database and files | Ireland, European Union |
| Brevo | Sends our emails: account emails (registration confirmation and password resets), and since 12 August 2026, alerts you have not disabled. It receives your email address and the alert's contents, which may name a horse, a yard, a role assigned to you or the person who triggered the alert. | France, European Union |
| Google (Firebase Cloud Messaging) | Delivers notifications to your phone | Outside the European Union, subject to Standard Contractual Clauses |
| Cloudflare | Hosts paddoco.com, the website you are reading, and stores responses to the anonymous feedback form (section 4a). Like any hosting provider, it receives the IP addresses of people loading pages; we never request this information from it or retain it ourselves. | Global network, US company, subject to Standard Contractual Clauses |
| Open-Meteo | Provides weather information | Receives the yard's coordinates, never yours, and no account data |
You can disable email alertsfor each alert type in your notification settings. Once disabled, no further alerts of that type are sent through Brevo. Essential account emails continue to be sent: without them, you cannot create an account or reset a password.
Currently, no personal data is sent to third parties for commercial purposes. The five providers above process it only on our behalf. Paddoco needs a sustainable income and plans to earn it from equestrian professionals paying to reach riders. To be clear from the outset, here are the three forms this may take and the rules for each.
- Industry statistics. What horses eat, or how often farriers visit in a region. These are aggregated and anonymous : they cover groups large enough that nobody can identify you, your horse or your yard. Truly anonymous data is no longer personal data, which allows this use without asking for your consent. If we publish such statistics, this page will say so and specify the minimum group size below which nothing is published.
- Professionals appearing where you look for them : a farrier, vet or tack shop paying to be listed where people search. Paid placements are clearly identified. This does not require information about you: the professional is being promoted, rather than you being targeted.
- An introduction, if you request it. If we ever offer to share your contact details with a professional, this will require your explicit consent, with the box initially unticked and consent withdrawable at any time. The screen asking you will state exactly what is shared and with whom.
The rule underpinning all three, consistent with the law: nothing that identifies you leaves here without your permission. Any new use of your data will be described on this page and brought to your attention before it begins. No such contract currently exists.
There is currently no advertising in the app, and there are no advertising trackers on this website or in the app. If paid placements are introduced, they will be clearly identified and described on this page.
This website loads nothing from elsewhere. Images, fonts and the small amount of code it uses are served from paddoco.com. No other server receives your IP address while you read this page, including servers that ordinarily distribute fonts.
The website remembers your language choice on your device, without cookies or sharing it with a third party. If you switch languages while completing a public form, its draft is temporarily transferred within the same tab to preserve your text, then removed when restored. Passwords are excluded. You can clear the saved language choice in your browser’s site data settings.
4a. The anonymous feedback form
A page excluded from search indexing, paddoco.com/avis, which we share directly with people who have just tried Paddocoto learn what to improve first. It is described here because it is the only part of the website that stores what you write . The contact form on the home page simply opens your email app and stores nothing.
What we record : your answers to the three questions and the date. Nothing else.
What we do not record, as enforced by the code : your IP address, device, referring page or language. No cookie is set. The function reading the form cannot access this information: it receives only your answers, so it cannot record anything else even accidentally. An automated check verifies this whenever the website changes.
What this does and does not mean. We do not know who wrote a response, so we cannot reply. However, if we give the link to one person and receive a response a minute later, the time is enough to make a guess. This is true of any anonymous form shared with a small group; no technical choice can prevent it, and we prefer to be clear. Leave out your name if you want to stay anonymous.
Where responses go. Responses are stored by Cloudflare, the website's hosting provider, and read only by us behind a password. Each response is also reported to us by email through Brevo, named above. They are used only to improve Paddoco : they are never sold, passed to a partner or matched to an account, since we do not know which account they would belong to.
How long we keep them. For as long as they help us decide what to improve. We cannot locate your response to delete it on request, precisely because it is anonymous: this is the trade-off for knowing nothing about you.
5. Who sees what in the app
This is the most important question, and the app is built around it.
- Yards are kept separate. What happens in one yard cannot be seen in another. This is more than a display setting: the database itself refuses to return a yard's data to a non-member. A yard's schedules, care records, feeding records, posts and listings stay within that yard.
- You control what crosses that boundary, and nothing crosses it by default. Since 13 August 2026, the app has included a public circle: a feed, listings, livery offers, creator showcases, a rider directory and rides can be shared with all accounts, never the open internet. Each item starts private; publishing opens it up, and counts as your consent. Two points deserve to be clear in advance: minors never appear in the platform's rider directory or marketplace, regardless of their settings; and a ride made public is public in full, including its start and finish points, and therefore the place you set off from. The app reminds you of this when you publish.
- Your horses' profiles, shared with friends. Since 12 August 2026, someone you have accepted as a friend can see the profiles of horses linked to you, even if they belong to another yard. Three sections are shared by default: identity (name, coat colour, sex, age and height), pedigree and competition record, plus one photo of the horse: the one already shown in the thumbnail. Seven sections remain private: care records, journal, feeding, sessions, equipment, location and people linked to the horse. None of this appears in a list or search: access is through your friend's profile.
- You can adjust each section, including setting it to “Only me”. Each horse's profile includes a grid showing what the yard, linked people, friends and others can see. You can share more, or close all sections to an entire audience in one step, and reverse that choice later.
- Your own profile is shared section by section. You decide what is visible and who can see it.
- Five things are inaccessible to anyone but you, including your yard administrators: private messages, secret ballot votes, blocked people, favourites and progress on a learning course.
- Messaging and what it has included since 12 August 2026. Private messages can now contain photos. These follow exactly the same rule as the message: only conversation members can see them. A sent message can be edited or deleted. Two points deserve to be clear: a recipient can forward a photo you send to another conversation, as with any messaging service; and conversations keep an album, so previously sent photos remain available there.
- A yard administrator can see everything within their own yard, and nothing elsewhere. This access is necessary to manage the yard and has clear boundaries.
- Image consent : you can refuse to appear in photos, and this refusal is enforced by the database, not just on screen.
6. Minors
The app accepts minors. A guardian can be linked to them, and the yard usually asks for the guardian's name and phone number. However, a minor's account can exist without a guardian account linked to it. We prefer to say this clearly rather than imply that parental supervision is mandatory.
- A minor never appears in the public rider directory or friend suggestions, regardless of their settings. This is enforced by the code, even if the directory option is ticked on their profile.
- A linked guardiancan view and manage matters concerning the child: bookings, payments, consent and notifications. This does not include their private messages : nobody reads them, whether a guardian or an administrator.
- Guardianship ends automatically when the person reaches adulthood.
- Sharing with friends also applies to minors. If a minor is linked to a horse, their friends can see its profile under the same rules and defaults as everyone else (section 5). Access can be closed in the same way, section by section on the horse's profile.
7. How long we keep data
- For as long as your account exists, and in most cases until it is deleted.
- Deletion is under your control: in My account, under Leave. It is immediate, and the app first lists exactly what would be removed. See the details on Delete my account.
- After deletion, your account and personal data are erased. Some records remain because they also belong to others, such as attendance at a past lesson or a payment recorded by a yard. These are detached from your identity.
- Files you uploaded are deleted along with the records they were attached to.
- Items deleted in the app first go to a binfor forty-eight hoursto allow mistakes to be undone. They are then permanently deleted without anyone needing to ask. This period is a yard setting: if your yard changes it, it will tell you.
- Emailed alerts leave a record with our email provider for the period set by its own policies. We do not use this to track you.
8. Your rights
At any time, you can access your data and obtain a copy; correct it, mostly directly in the app; request erasure; object to processing or request its restriction; withdraw consent to notifications; and leave instructions about your data after your death.
You can exercise three of these rights without writing to us, in My account, under Leave : download a copy of your data, pause your account and delete it. For anything else, email [email protected]. We reply within one month.
If you are not satisfied with the response, you can contact the CNIL, the French supervisory authority.
9. How data is protected
- All data is encrypted in transit between your device and our servers.
- The database denies access by default. Each table determines who may read each row, and an unauthorised request returns nothing. The database enforces this, rather than the screen: bypassing the app grants no extra access.
- Your private messages and their photos are not end-to-end encrypted. They are encrypted in transit and protected by the rule above, but we prefer to be explicit rather than imply otherwise.
10. Changes on 6 September 2026
Two types of information collected since the summer were missing from this policy. They are now included. This is a policy update to reflect the app, rather than new processing.
- Ride GPS tracks (section 2): a ride can include a GPX track, gaits and heart rate. The track follows the ride's visibility; heart rate is never shared with everyone. Following a route does not send any position data off the phone.
- Sharing across yards (section 5): this page previously said that only horses' profiles shared with friends crossed the boundary. That was true on 12 August. A public circle has existed since 13 August, with a clear rule: nothing enters it by default, publishing counts as consent, and a public ride includes its full route.
- “Near me” now also works for listings, riding clinics, livery and riders. The rule is unchanged: location is used to calculate distance and is not stored.
11. Changes on 18 August 2026
Nothing changed in practice : no new recipients, additional data collection or trackers. What changed was a promise clarified before it was needed.
- This page previously said “we sell nothing to anyone”. Section 4 now explains how Paddoco plans to earn revenue : anonymous industry statistics, professionals paying for visibility and introductions made only at your request.
- It no longer promises “never” where the meaningful rule is this: nothing that identifies you leaves here without your permission, and every new use is described here before it begins. A service promising never to earn money risks making a promise it cannot keep; ours prefers to explain its plans in advance.
- Why explain this beforehand? Because narrowing a policy when it becomes inconvenient is backtracking, while clarifying it while it is still fully accurate is transparency. No such contract currently exists.
12. Changes on 12 August 2026
Four changes made that day affect this page. Two expanded access and are described above. Two restricted it and also deserve mention.
- Sharing with friends (sections 4 and 5): friends at another yard can now see your horses' profiles. This is the first time information has crossed yard boundaries, which is why this page explains it explicitly.
- An email delivery provider (section 4): our email alerts now go through Brevo, which receives your email address and the alert's contents. It already handled account creation emails but was not named here. It is now.
- Access to horse photos was restricted. Until that date, a confirmed member of a yard could see photos of horses at other yards and horses belonging to no yard. This was a defect, which was identified and fixed: a horse's photos now follow that horse's yard permissions, with access granted only by the rules in section 5.
- Twenty-three internal database functions were closed to signed-in accounts. No screen used them, but they remained accessible externally. None was needed by the app, and none has become necessary since.
- Messaging now supports photos (sections 2, 5 and 9), and sent messages can be edited or deleted. This grants access to nobody new: a message photo can only be viewed within its conversation.
12. If this policy changes
We will update it here with a new date. Any change affecting what we collect or who receives it will be announced in the app, as well as described on this page.