Privacy policy

Updated on 2 November 2026: chosen safety contacts, educational autonomy and email preferences. The other provisions remain in force.

Updated on 27 October 2026: Open Gallop game data, progress, resuming on your device and leaderboard visibility. Other provisions remain in force.

Updated on 15 October 2026: the Jobs area and its private applications are described in section 5 ter.

Updated on 13 October 2026: optional Meta advertising measurement is provided for the site and the web app. It requires your prior consent before activation. Private records, minors, demonstration accounts and native apps are excluded. Other provisions remain in force.

Paddoco is an app for riders and yards. This policy explains exactly what data it keeps, why, where, for how long and what you can do about it. It is written to be understood.

1. Who is responsible

Clément Faure, 156 avenue Jean Jaurès, 47000 Agen, France.

For any question about your data: [email protected].

Under the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), Clément Faure is the data controller. Under Quebec's Act respecting the protection of personal information in the private sector, he is also the person in charge of the protection of personal information, reachable at the same address.

2. What we collect, and why

We only ask for information that serves a purpose. Most fields below are optional, and the app works without them.

For your account

For your horses

Name, breed, coat, date of birth, SIRE number, photos, care records, shoeing, vaccination and worming due dates, training sessions, feed rations, observations and intervention reports. Reports may contain diagrams, findings, dates, authors and source documents. These data concern an animal, but also show who looks after it and when, so they concern you too.

For life at the yard

Your lesson bookings, rides, posts, replies, private messages and the photos you send in them, groups, friends, listings and payment records (paid or unpaid, never bank details).

What your device sends

A GPS track is location data, and we treat it as such. A ride remains private, shared with friends or shared within your yard until you decide otherwise. Heart rate is never shared with everyone: even on a public ride, it remains visible only to you and the people you choose.

We do not send your detailed browsing history or record pages to Meta. Only general visits and the actual creation of an account may be measured after your advertising consent. The app also keeps the elements needed for the functions you use on your device, including your session, the yard you are viewing, your preferences and local files you choose to create. Glasses and studio recordings are described in section 4 quinquies.

3. Legal basis

Each processing activity relies on one of the legal bases set out in Article 6 of the GDPR.

4. Who else sees your data

The services below help Paddoco operate. Google Calendar and Microsoft Outlook receive activity copies only if you connect them; those external accounts also follow their own terms and policies. No other partner receives your data today. Any new recipient and the reason for the transfer will be described on this page, and you will be informed before the transfer begins.

In My account > What I am told about > Email notifications, disable or re-enable notification emails. Re-enabling preserves your choices by category. The link at the bottom of new emails opens a page without signing in: confirm to stop delivery. If the link is blocked, copy the displayed address or return to your account. In-app notifications, authentication and expressly requested reports remain separate.

In My account, notification preferences distinguish in-app notifications, device notifications and emails. Within a family, “Turn off emails” records an explicit refusal that also disables its fallback emails, including for an essential notification. An old unticked box simply matching a notification kind’s default is not that evidence of refusal; use the explicit family choice to stop these transmissions. Essential notifications remain displayed in the app. Necessary account emails and delivery of a report you confirm are separate journeys.

The services needed to operate the app are separate from Meta, the recipient of the optional advertising measurement described below. Google and Microsoft calendars you choose to connect remain subject to their provider’s rules. The following three possible commercial uses retain their own conditions.

• Industry statistics. What horses eat, or how often farriers visit in a region. These are aggregated and anonymous : they cover groups large enough that nobody can identify you, your horse or your yard. Truly anonymous data is no longer personal data, which allows this use without asking for your consent. If we publish such statistics, this page will say so and specify the minimum group size below which nothing is published.
• Professionals appearing where you look for them : a farrier, vet or tack shop paying to be listed where people search. Paid placements are clearly identified. This does not require information about you: the professional is being promoted, rather than you being targeted.
• An introduction, if you request it. If we ever offer to share your contact details with a professional, this will require your explicit consent, with the box initially unticked and consent withdrawable at any time. The screen asking you will state exactly what is shared and with whom.

The rule underpinning all three, consistent with the law: nothing that identifies you leaves here without your permission. Any new use of your data will be described on this page and brought to your attention before it begins. No such contract currently exists.

There are currently no paid advertising placements in the app. Measuring our adverts displayed on Facebook and Instagram is a separate, optional function restricted to adults on the web.

The site’s images and fonts remain served from our own resources. No Meta advertising service is contacted before your consent. The hosting services needed to operate the site remain those described in this policy.

The website remembers your language choice on your device, without cookies or sharing it with a third party. If you switch languages while completing a public form, its draft is temporarily transferred within the same tab to preserve your text, then removed when restored. Passwords are excluded. You can clear the saved language choice in your browser’s site data settings.

Some install links that we publish ourselves, on a profile, a video or a QR code, carry an origin code chosen from a fixed list. That code only records which link was used. It is passed in the address to the store or the app, together with any language and usage already present. It sets no cookie, identifies no one, and is not sent to an analytics service or an advertising network. The page does not contact any other server for this.

Optional Meta advertising measurement

The Meta Pixel and Conversions API may measure general visits to the site and web app, together with an actual account registration, to assess and improve our Facebook and Instagram adverts. The same event identifier avoids counting a registration twice when received from both the browser and server. A sign-up button click, failure or login to an existing account is not a new registration.

This processing relies on your optional consent. “Accept” and “Refuse” are presented at the same level; refusing does not restrict any function or account creation. Your choice, shared between paddoco.com and app.paddoco.com, is kept for no more than 180 days. You can change it through “Advertising choices”, visible on the relevant pages. Withdrawal stops new transmissions, removes advertising cookies from our domain and cancels registrations still awaiting transmission. It does not automatically erase events already received by Meta.

The browser may send Meta the _fbp and _fbc advertising identifiers, the event and technical information, including its IP address and browser. These cookies last no more than 90 days. For a registration, our server sends only the normalised email and account ID as SHA-256 hashes, the event identifier and date, and, when available, advertising identifiers and browser information. The server does not add an IP address. Hashing is pseudonymisation: Meta can match these hashes to its users; they are not anonymous data.

UTM origin, medium, campaign, content and term codes are limited to normalised technical tags, kept until sign-up and then linked to the profile in a private area reserved to the server. The version and date of consent for that registration are also retained. These records are erased when the account is deleted. The tags are not sent in the Meta event payload.

No horse name, care information, health data, message, document, GPS track, precise location or private record URL is sent to Meta. The Pixel runs on a separate page without access to the app’s forms or records. Demonstration accounts and their yards are excluded as soon as they are identified. No Meta Pixel or advertising SDK is added to the native Android and iPhone apps.

The recipient is Meta Platforms Ireland Limited, which also processes data for its own purposes and under its own retention periods. Processing may take place outside the European Union, including in the United States, under the safeguards provided in its terms. To understand this processing and exercise your rights with Meta, see its privacy policy and Business Tools Terms. For data kept by Paddoco or a request concerning this measurement, contact [email protected].

Meta privacy policy · Meta Business Tools Terms

4a. The anonymous feedback form

A page excluded from search indexing, paddoco.com/avis, which we share directly with people who have just tried Paddocoto learn what to improve first. It is described here because it is the only part of the website that stores what you write . The contact form on the home page simply opens your email app and stores nothing.

What we record : your answers to the three questions and the date. Nothing else.

What we do not record, as enforced by the code : your IP address, device, referring page or language. No cookie is set. The function reading the form cannot access this information: it receives only your answers, so it cannot record anything else even accidentally. An automated check verifies this whenever the website changes.

What this does and does not mean. We do not know who wrote a response, so we cannot reply. However, if we give the link to one person and receive a response a minute later, the time is enough to make a guess. This is true of any anonymous form shared with a small group; no technical choice can prevent it, and we prefer to be clear. Leave out your name if you want to stay anonymous.

Where responses go. Responses are stored by Cloudflare, the website's hosting provider, and read only by us behind a password. Each response is also reported to us by email through Brevo, named above. They are used only to improve Paddoco : they are never sold, passed to a partner or matched to an account, since we do not know which account they would belong to.

How long we keep them. For as long as they help us decide what to improve. We cannot locate your response to delete it on request, precisely because it is anonymous: this is the trade-off for knowing nothing about you.

4 ter. AI assistant and voice dictation

Fara is optional and available to signed-in accounts through her avatar. Free includes the Economy model with an allowance of USD 0.50 per person per month. Personal, Pro and Yard Premium trials are granted separately by the platform. Enabling access sends no data to OpenAI: relevant data is sent when you use the corresponding features, as described below.

Since 24 September 2026, Fara asks for your consent before your first request. A card sets out what is sent to OpenAI: your message, your dictation, the files you attach and the data relevant to your request, within the limits of your permissions. Nothing is sent until you accept; typing, dictation and attachments stay closed until then. The time of your consent is recorded. You can withdraw it at any time in “About the assistant”: Fara then sends nothing until you consent again, and your conversations stay in your history.

The assistant helps organise equestrian activities, consult authorised data, prepare actions and write drafts. OpenAI is the selected provider for replies, voice transcription and attachment analysis. For chat, it receives the text you send, part of the recent conversation and the necessary data your permissions allow you to consult: names, horses, relationships, lessons, registrations, work, care or listings. Fara follows your profile across your yards, with permissions checked separately in each. It does not receive direct database access.

The microphone opens only when you tap it. When you tap Finish, the audio is automatically sent through our server to OpenAI for transcription. Authorised horse names may accompany the audio to improve recognition. Paddoco does not retain the audio file. If transcription fails, the recording remains temporarily on your device so you can try again while the screen is open. The transcript remains an editable draft: it is sent to the chat only when you tap Send. No background listening is provided.

Fara's personal memory is separate from conversations. It stores up to 12 notes of 180 characters in Supabase, for no more than one year after their last update: presentation preferences, nicknames of accessible horses and routines specific to a yard. These notes are private to their author; only notes compatible with the current context and permissions are sent to OpenAI to personalise a reply. They must not contain secrets or health or financial records, and are not used for Internet searches. You can view and delete notes, or turn off their use and the recording of new memories, in Fara's information panel. Turning memory off keeps the notes; deleting a conversation does not erase them. Deleting the account removes them. No additional subscription is required; the small text cost is included in the AI budget.

Fara may perform a web search when a question calls for public or up-to-date information. To prepare it, OpenAI receives your question and, if needed, up to two recent clarifications, without previous responses, records or personal memory. Search terms are intended for a public search: do not include secrets or confidential information. Sources are displayed as links; their content may be inaccurate. Following those links is also subject to the visited site’s policy. Search costs are included in your allowance, at USD 0.01 per completed search plus the text processed. A search triggers no operational action.

AI conversations are restricted to their author in the app. Their retention period is displayed: 30 days by default, configurable up to 90 days. You can delete them. Technical request details are kept for 62 days. Counters needed for monthly and annual limits, without conversation text, are retained for the current and previous calendar years. A file's volume records remain for as long as the file is retained; their link to your account is removed if the account is deleted. A technical receipt of confirmed actions, without the text of your requests, is retained for one year to verify operations. Deleting a chat does not undo lessons, care records or other actions already recorded.

Usage and subscription brings together personal storage and shared services. Monthly and annual limits follow the UTC calendar, with their reset dates displayed; older rolling thirty-day limits remain shown separately. Each AI request is charged to one allowance: the yard's for covered management, otherwise the person's. The meter shows estimated costs and pending reservations, not the OpenAI balance. Reaching a limit does not trigger a charge to another allowance. Premium Pro includes personal use; no coverage grants additional business permissions. Removing a file frees storage but does not refund uploads already consumed. A reduced limit does not delete existing files. Your model and automatic-action preferences follow your account independently of conversation history. Word and PDF exports are prepared on your device. No payment or paid subscription is activated during this pilot.

For attachment analysis, prepared files and your instructions are sent to OpenAI after you press Send. Several files can be combined in one request: six by default, up to a combined eight MB after preparation. Applicable limits are displayed and may be adjusted by the platform. Photos are prepared on your device; by default, each video becomes up to eight timestamped still images over thirty seconds, without audio. Analysis is isolated from memory, web research and action tools. A comparison can include attachments from earlier care: Fara first checks their references, then loads only relevant files accessible under your current permissions. Permissions are checked again before the answer. Unless you explicitly request filing in the horse’s diary, Paddoco does not retain newly supplied originals or extracted images on its servers. The response and file references remain in your conversation for its retention period. Reattach an unfiled file for a later analysis. A filed report is labelled as AI-generated and can automatically receive supplied files still available on the device. Diary visibility, retention and media quotas then apply independently of chat deletion. Earlier media remain referenced to their original care entry. Processing all selected files is charged as an analysis against your usual AI allowance. For earlier-care research, source selection and analysis are two steps charged at their actual cost against that same allowance. Only send files you are authorised to use and avoid unnecessary personal information. Premium or trial coverage, its expiry date and administrative changes are retained; their private audit log is purged after one year.

OpenAI API data is not used to train its models by default. Paddoco disables response storage at OpenAI. Abuse prevention logs may nevertheless retain content for up to 30 days, unless legally required otherwise. An encrypted technical cache may remain for up to 24 hours, separately from Paddoco’s personal memory. According to the provider’s documentation, the audio transcription service used does not retain application state or abuse logs for that transcription. Image and file inputs may undergo specific safety checks.

The provider’s arrangements are described in its API data documentation.

Exclusive European residency or complete absence of retention by OpenAI is not promised. Processing may involve transfers outside the European Union. Before activation, Paddoco must check OpenAI's data processing agreement, its subprocessors and applicable transfer safeguards, including Standard Contractual Clauses. These details will be updated if the selected configuration changes.

Send only information needed for your request, without secrets, passwords or human health data. The yard remains responsible for the purpose and lawfulness of its members' data used for management. Requested assistance forms part of providing the service; abuse prevention and traceability serve the legitimate interest of securing it. Access, erasure and objection requests can be made using the contact on this page. The AI does not independently make decisions with legal effects.

4 quater. Personal Google and Microsoft calendars

Connecting a personal calendar is optional. In My account → My calendars, you choose which Paddoco activities to copy to a dedicated calendar in your Google or Microsoft account. The provider receives each selected activity’s title, date, times when available, time zone and a link to that activity in Paddoco. These copies remain subject to the rules of your provider account, including when you share or forward them.

Paddoco receives the external account’s identifier and email address, the authorisations needed for the connection, and the identifiers of the dedicated calendar and its copies, so that it can update them without duplicates. Access and refresh tokens are encrypted on the server in Supabase. They are not sent to other Paddoco members or to Fara.

You can separately allow Paddoco to display your busy times and select calendars that you own. Google provides free/busy time intervals. Microsoft provides times, busy status and cancellation status, which are immediately reduced to busy intervals. Paddoco does not store the titles, descriptions, locations, guests or attachments of your personal appointments. Busy intervals appear as “Busy”, for you alone, and are not recorded in the shared planner. Hiding this display does not pause copies to the dedicated calendar.

Google allows Paddoco to create and manage calendars created by the application; access to your calendar list and free/busy information is requested only for the busy-times option. Microsoft requires delegated calendar read and write permission to create the dedicated calendar. Paddoco’s code limits writes to that dedicated calendar and busy-time reads to calendars that you own and have selected. External calendars do not feed the shared planner, and no invitations are sent.

You can pause copies, disconnect the provider or revoke authorisation in your Google or Microsoft account. When disconnection is complete, the tokens and connection identifiers are deleted. You can choose to remove only the copies created by Paddoco; the dedicated calendar and appointments you added yourself remain. If you have already revoked access, complete disconnection while keeping copies, then remove them at the provider. Activity changes and removals are reflected at the next successful run; an outage may delay them. Tokens remain encrypted while the connection exists, including when copies are paused or removal is still pending. Deleting your Paddoco account deletes the tokens but cannot recall copies at the provider: disconnect the calendar and choose to remove its copies first.

This connection is used only for the calendar features you request. Data obtained through these APIs is not used for advertising, data sales or training artificial intelligence models. Paddoco’s use and transfer of information received from Google APIs comply with the Google API Services User Data Policy, including its Limited Use requirements. Data you keep or share directly in Google Calendar or Microsoft Outlook is also subject to those providers’ terms and privacy policies.

4 quinquies. Connected glasses, memories and voice commands

This section prepares for the optional glasses integration in Paddoco’s next app update. Initial tests are restricted to the authorised superadmin account in the Android and iOS apps, with a compatible phone, glasses and operating system. These screens are not offered on the website, in a mobile browser or in the PWA. Other users continue to use Paddoco without glasses.

Connection uses the Meta AI app and permissions from the phone and Meta. Paddoco uses the selected device’s identifier and name, connection status and capabilities to find the correct glasses. The selected device and connection preferences are stored on the phone. Connecting or reconnecting does not itself authorise a photograph, recording or broadcast. You can stop the session, forget the glasses and revoke permissions in the relevant settings.

Images received from the glasses are used for the capture you start. Original photographs and videos are initially kept in Paddoco’s private storage on your phone. Native files from the glasses are excluded from automatic system backups. Videos from this first glasses integration are silent. Sound in a video recorded with the phone depends on microphone permission and the choice made in the studio. The integration described here enables neither continuous voice listening nor facial recognition.

“Keep in Paddoco” is a separate choice from capture. It sends the selected original photo or completed video to our private Supabase storage, with your account identifier, title, indication of recognisable people, optional link to a ride, lesson or session, format, size and, for a video, duration and markers you added. An operation identifier, file fingerprint and upload log allow a transfer to resume without creating a duplicate. Reconnecting glasses does not automatically start an upload. Original JPEG or HEIC photos may retain EXIF metadata, which may reveal where they were taken; Paddoco does not promise to remove it.

Photos and videos saved this way remain private to their authorised owner in the native app during testing. Linking them to an activity does not give other participants, the yard or website visitors access. Marker transfers do not include GPS coordinates. A recorded ride track nevertheless retains its own visibility rules. Places, faces or information visible in images remain in the files; also check their metadata before exporting or sharing them.

Local copies stay on your phone until you delete them from the library or clear the app’s data. Personal memories saved in Paddoco remain linked to your account until you delete them. You can change or remove their activity link; deleting that activity does not delete these personal memories. Older media saved directly within an activity still follow that activity’s deletion. Deleting a remote memory removes its annotations and prevents new access; a previously issued playback link may remain valid for up to two minutes. Physical file deletion then runs through the storage purge queue and is not promised to be immediate. A minimal technical receipt, without annotations or media, prevents an old transfer from recreating a deleted memory; it remains until account deletion. An incomplete upload may also leave temporary data until storage cleanup or expiry.

Deleting a remote item does not delete the phone’s original or copies already exported or shared: those copies must be managed separately. Sharing through your phone’s share sheet sends the file to the app or recipient you choose, under their own terms. It does not automatically publish it on La Place. The private live-stream pilot, separate from this library, is described below; this journey does not offer a connection to a YouTube or Twitch channel.

Studio voice commands are optional and restricted to the authorised pilot. After you explicitly select the glasses’ Bluetooth microphone and choose “Open and listen”, detected phrases are sent through our server to OpenAI for transcription, together with the language and equestrian vocabulary that may include names or nicknames of horses accessible to your account. Any detected phrase may be transmitted, even if it contains no command: filtering happens after transcription. An Internet connection, your personal Fara consent and available quota are required.

Recognised commands can take a photo, start or stop a video, add a marker or stop listening. They act directly in the studio, without a draft to confirm, and do not publish memories. Listening stays in the foreground, lasts no more than five minutes and stops, among other cases, when you leave the app or lose the selected microphone. “Stop listening” also closes the camera; returning to the app does not restart listening. Glasses videos remain silent even while voice commands are enabled.

This voice flow does not create an audio file in phone or Supabase storage and does not save the transcript as a Fara conversation message. Text is processed in memory to recognise commands. Fara usage counters and technical controls still apply. This does not guarantee zero retention by providers or infrastructure logs: the OpenAI terms, transfers and limits described in section 4 ter also apply to this transcription. This voice flow does not attach camera media or GPS coordinates.

Meta provides the glasses connection and SDK. Its documentation states that Meta may receive information about communication between Meta devices and the app. Paddoco configures the SDK’s usage analytics and crash reporting to be disabled. This setting does not remove processing associated with your Meta account, Meta AI or the operation of the glasses, which is governed by Meta’s terms and may involve processing outside the European Union. Paddoco does not promise that Meta holds no data, or a retention period it does not control.

Capture, storage and retrieval of memories provide the features you request; their basis is performance of the service. Access protection and prevention of duplicates are based on the legitimate interest in securing that service. Camera, microphone and connection permissions remain under your control, and refusing them must leave other features usable. Only record and share people and places for which you have the necessary permission, particularly when a minor appears. The rights and contact details in section 8 also apply to these data.

Meta Privacy Policy

4f. Professionals, external clients and reports

A professional’s application file is used to review their business, contact details and supporting documents. It remains private to people authorised to process it. Saving a draft does not submit it to the administrators or publish a directory profile. Professionals can resume their application and edit their profile with their usual permissions.

The public location can show a business address or just a town or village and its postcode, with the chosen service radius. Changing an existing profile to “Town only” removes the street and previous precise point from the saved public location. A town suggestion may provide an approximate centre; no directions to that centre are offered. Without a point, the profile remains readable without a map or calculated distance. The administrative address in the application remains private and separate: it is not copied into the public profile.

A professional can keep records for clients who do not have a Paddoco account: names, contact details, internal notes, horses and reports. These records are private to their business. The professional must inform the people concerned about this use and enter only necessary information. Permissions to manage the client book do not automatically grant access to clinical content; a secretarial role alone cannot read it. Report drafts remain private to their author.

A finalised report preserves its author, date, original horse and corrections. Dental, hoof, osteopathy, saddle fitting and bit fitting diagrams show recorded observations and their source. The 3D view is reference anatomy; it does not measure the horse or provide a diagnosis. Access to authorised history does not grant any additional permission to provide care or edit records.

The professional can prepare an export or confirm sending a report by email to the address in the client record. The recipient and report version are checked before sending. The file or email includes a “Made with Paddoco” credit. It contains the selected report’s information, not internal client-book notes. A downloaded export or received email is a copy outside Paddoco; later withdrawal of access cannot retrieve it.

If the client creates an account, the professional can propose linking their archives. The recipient account must accept and choose the proposed sources. They can keep an archive without linking it to a current horse. Linking a source to an existing horse or one created for them requires an explicit choice and current ownership permissions. Several chosen sources can link to the same horse while retaining their provenance. Internal notes are not transferred; a new external horse does not automatically become part of an earlier agreement.

The professional relationship, current access permissions and intervention history are separate. Withdrawing an authorisation closes new reads it previously permitted, without deleting reports already recorded. Archiving a client record does not delete it. For correction, access or erasure requests concerning these archives, contact the professional and, for Paddoco’s processing, our privacy contact.

4g. Positions, presence and possible fall alerts

In My account > My record or the ride settings, open Contacts to notify. Choose one or more accepted friends and save. Even without a yard, they can receive your new probable fall alerts and the event location. This choice shares neither live tracking nor earlier alerts. Remove a contact to close their access. No automatic SMS or call to the emergency services.

Your presence in the app is different from your geographical position. Presence visibility settings, your personal invisible mode and blocking determine who can see that status. Being an administrator does not override the “Nobody” choice. The internal usage measurements described in the summary are separate from this display and are available only through their aggregate dashboard.

Sharing your position during a hack is a separate choice from route guidance alone. Sharing sends the database a recent position, its available accuracy and a short trail, for recipients authorised under the outing’s rules. Reads check current permissions, blocking, the outing’s status, expiry and withdrawal of sharing. Stopping sharing closes new reads; a position already seen cannot be taken back from the recipient.

Optional safety during a hack or ridden session can report a possible fall when the phone detects an event and the server receives the signal. Enabling it shows you the recipients. The server retains the activity, your identifier, detection and response times, the event’s status and the position available when reported. Answering “I’m safe” before the deadline prevents the alert; asking for help or not responding may produce notifications. Events remain linked to the activity history; we do not promise a separate automatic deletion period for these events.

Safety recipients depend on the activity: hack participants and organiser, the horse’s current owners and the currently authorised team of the activity’s yard, under the applicable rules. Friendship, guardianship, another yard or a subscription alone do not grant this access. The rider’s identity and event position are returned only to an authorised person; their phone number remains subject to the usual contact rules. Content prepared for the lock screen retains its privacy protection.

Permissions and event status are checked again before push or email notifications leave. A reassurance response closes possible-fall notifications still waiting and preserves the history. A fallback email may replace missing or failed push delivery under the applicable preferences and limits. A transmission already started or received cannot be withdrawn. Without a network, permission or compatible device, detection or delivery may fail. No public emergency service is called automatically, and these notifications do not confirm a fall or a medical condition.

4h. Films, private live streams and local copies

Hack, lesson or training-session memories can become an MP4 film prepared on your device from elements you select and are authorised to use. A map may show a route; an exercise may be presented by a camera orbit around its 3D plan. This illustrates the recorded plan, not the horse’s actual movement. Before sharing, check the route, start and finish points, names, photos and people’s image permissions, especially for minors. Creating a film does not publish it: La Place, download and system sharing are separate delivery choices.

Private live streaming remains a pilot restricted to authorised accounts and devices. It transmits the camera and, if you enable it, the selected microphone to invited viewers whose access is checked. Invitation, admission and session information pass through Paddoco; the stream uses its OVHcloud relay running LiveKit. Under the pilot’s current configurable settings, optional chat is kept in the database for twenty-four hours and the stream’s technical history for thirty days. Withdrawing an invitation prevents new admission and closes access under the stream’s checks; it cannot erase what a viewer has already seen or recorded on their device.

A replay is a separate, voluntary choice: its video is recorded locally on the broadcaster’s phone. Chat messages are not copied into the video or its export; reading them remains checked against the canonical source. Replay chat is retained for at most thirty days, according to the platform setting. Deleting the local file does not delete server messages, and deleting messages does not retrieve a video already exported. Live streaming promises neither continuous availability nor an absence of network processing by providers.

Private media may be read through temporary signed links. New standard signatures are valid for one hour; specialised readers have their own duration. A link already issued may remain valid until expiry despite a permission change, and older links retain their original duration. The cache is separated by account and cleared on session changes. Downloaded files, screenshots and shared exports remain under their recipient’s control: no withdrawal can guarantee the removal of those copies.

The app also keeps the preferences, references and files needed for its features on your device. Content updates may be checked while the app is visible and online, then installed when entering an idle Home screen. Download requests use Cloudflare hosting and transmit necessary network and version information. Editing, an activity or an ongoing live stream may defer installation. This automation grants no new access to your data and does not guarantee that a closed app will wake up.

5. Who sees what in the app

This is the most important question, and the app is built around it.

• Access is limited to each record and its audience. Membership or an administrator role in one yard does not grant the same permissions in another. An owner can still access their horse kept elsewhere, and an authorised professional can read records under the consent given. Exact addresses, private routes and presence data retain their own rules; a management role does not make them all public.
• The public La Place circle is for signed-in Paddoco accounts. Other publishing features follow their own journey, including the journey edition visible on the Internet described below. You choose the circle and content you publish. The rider directory follows a separate rule: adult accounts appear by default, with first name, surname and yards, and can opt out in My account, “What I show”. Minors do not appear in this directory or the platform market. A publicly shared hack may show its complete route, including start and finish: review locations and information before publishing or sharing a memory.
• Your horses' profiles, shared with friends. Since 12 August 2026, someone you have accepted as a friend can see the profiles of horses linked to you, even if they belong to another yard. Three sections are shared by default: identity (name, coat colour, sex, age and height), pedigree and competition record, plus one photo of the horse: the one already shown in the thumbnail. Seven sections remain private: care records, journal, feeding, sessions, equipment, location and people linked to the horse. None of this appears in a list or search: access is through your friend's profile.
• You can adjust each section, including setting it to “Only me”. Each horse's profile includes a grid showing what the yard, linked people, friends and others can see. You can share more, or close all sections to an entire audience in one step, and reverse that choice later.
• Your own profile is shared section by section. You decide what is visible and who can see it.
• Your private conversations can be read by their members, not by an administrator who does not participate. Your individual secret ballots, blocked accounts, favourites and personal course progress retain their own protections. An organisational role does not make them accessible.
• Messaging and what it has included since 12 August 2026. Private messages can now contain photos. These follow exactly the same rule as the message: only conversation members can see them. A sent message can be edited or deleted. Two points deserve to be clear: a recipient can forward a photo you send to another conversation, as with any messaging service; and conversations keep an album, so previously sent photos remain available there.
• A yard administrator has the access needed to manage that yard. This role does not replace specific data audiences, professional consent, or presence and messaging protections. A public yard profile may show permitted information without revealing the exact address reserved to authorised members.
• Image consent : you can refuse to appear in photos, and this refusal is enforced by the database, not just on screen.

The public La Place circle and a public journey edition are different forms of sharing. In Tourism, you can prepare a journey edition visible on the Internet without an account, after selecting elements, previewing and agreeing. Private journey dates, contacts, bookings, companions and private horse data are excluded automatically. However, texts, locations, routes and photos you choose may reveal personal information. Editing the private record does not automatically update that edition. Withdrawing publication closes new reads and reuse, without retrieving copies already created or downloaded.

5a. Learning records and training centres

From the educational autonomy threshold, currently fifteen years of age, learners accept their own invitation and use their learning record without prior parental confirmation. Below this threshold, confirmation by the legal guardian is still required. A parent can be linked later through verified guardianship; this grants no yard role or access to a horse.

A Training Centre has an administrative application and a learning space after the required acceptance and activation steps. Publishing its profile remains a separate choice. Admission, team membership or a cohort does not automatically grant access to a learner’s private activities, a horse or another yard.

A learning record may retain activities the learner selects, their date and duration, objectives, dated teacher or workplace mentor observations, and published reviews. It may include a minimal extract of an authorised personal activity, without its GPS route, medical data, payments, clients, messages or third-party identities. Sharing names accepted recipients with current assignments, with an expiry date and content preview. Permissions are checked on access; withdrawing sharing does not retrieve copies already received.

Progress in your personal Training library is separate from this record and is not opened to a centre simply by enrolling there. Qualifications you choose to show on your profile do not publish your learning record or grant a professional role. For minors, guardianship rules and the journey’s authorisations still apply.

5 ter. Jobs, applications and CVs

The Jobs area lets you offer or seek a job, internship, apprenticeship or assignment working with horses. A published listing may show its introduction, roles, availability, declared conditions, town and chosen photos to signed-in Paddoco accounts. No home address is requested. Map markers show the approximate town location. Qualifications are self-declared and do not become verified credentials.

CVs and other documents remain in a private library. You explicitly choose which documents to attach to each application; they appear neither on the public listing nor on the map. The authorised recruiter for that application can download them while sharing remains permitted. A proposal sent to a candidate listing remains an invitation until accepted and grants no automatic document access. Conversations are limited to currently authorised parties. Moderating public listings grants the moderation team no right to read CVs or these conversations. Fara does not consult them.

For a minor, the currently linked legal guardian must approve publication and submission. Changes to attachments by the minor require fresh approval. Ending the family relationship or yard management role removes the corresponding access. Withdrawing an application blocks future recruiter downloads. Removing a file revokes sharing and queues it for deletion from storage. A copy already downloaded cannot be remotely erased.

Drafts, listings and private tracking remain accessible in My workspace under current permissions; expired or closed listings leave search results. Library documents remain until removal or account deletion. Personal exports include the account’s own recruitment data. Account deletion erases personal listings, applications as a candidate, authored messages and documents, then queues files for deletion. A yard-owned opportunity remains with the yard under its current managers; it does not become the former administrator’s private property. An application creates no employment contract, educational entitlement or yard role.

5 quater. Open Gallop game and leaderboards

In Open Gallop, runs and their results, progress by discipline, daily goals, earned horseshoes and unlocked appearances are linked to your account and kept on our servers. If you choose a horse linked to you, the game uses its name and coat colour; it does not collect GPS locations. The command log is sent to verify the result. A local copy of the current run, stored under your account identifier on this device, lets you resume or retry sending it.

The games visibility setting lets you keep your scores private, share them with your friends and members of your current yard, or appear on the public leaderboard for signed-in Paddoco accounts. Open Gallop keeps scores private if you have not already made an explicit choice for games. The public leaderboard is restricted to adults; on friends’ or yard leaderboards, a minor’s surname is reduced to its initial for other people. Blocking still applies. A leaderboard may show your first name, surname or its initial, your mount’s name and coat colour, and your result.

The local copy on your device is separate from Open Gallop data kept on our servers.

6. Minors

The app accepts minors. A guardian can be linked to them, and the yard usually asks for the guardian's name and phone number. However, a minor's account can exist without a guardian account linked to it. We prefer to say this clearly rather than imply that parental supervision is mandatory.

• A minor never appears in the public rider directory or friend suggestions, regardless of their settings. This is enforced by the code, even if the directory option is ticked on their profile.
• A linked guardiancan view and manage matters concerning the child: bookings, payments, consent and notifications. This does not include their private messages : nobody reads them, whether a guardian or an administrator.
• Guardianship ends automatically when the person reaches adulthood.
• Sharing with friends also applies to minors. If a minor is linked to a horse, their friends can see its profile under the same rules and defaults as everyone else (section 5). Access can be closed in the same way, section by section on the horse's profile.

7. How long we keep data

• For as long as your account exists, and in most cases until it is deleted.
• Deletion is under your control: in My account, under Leave. It is immediate, and the app first lists exactly what would be removed. See the details on Delete my account.
• After deletion, identifiers and contact details linked to your account are erased through the stated process. Some shared records may remain: participation in a past lesson, a declared payment, an intervention or an archive kept by a professional. Their retention and any source information must not be confused with an active account. Deleting an account does not retrieve copies already delivered to a third party; requests about a professional archive use the contacts given in section 4f.
• Files you uploaded are deleted along with the records they were attached to.
• Items with a recycle bin remain there for forty-eight hours by default to recover from mistakes, then follow their deletion process. This duration is a yard setting. Not every item has this recycle bin: Fara conversations, professional archives and the studio library follow the separate rules described above.
• This recycle bin does not apply to photos and videos in the studio library: their deletion and that of local copies are described in section 4 quinquies.
• Emailed alerts leave a record with our email provider for the period set by its own policies. We do not use this to track you.

8. Your rights

At any time, you can access your data and obtain a copy; correct it, mostly directly in the app; request erasure; object to processing or request its restriction; withdraw consent to notifications; and leave instructions about your data after your death.

You can exercise three of these rights without writing to us, in My account, under Leave : download a copy of your data, pause your account and delete it. For anything else, email [email protected]. We reply within one month.

If you are not satisfied with the response, you can contact the CNIL, the French supervisory authority.

9. How data is protected

• All data is encrypted in transit between your device and our servers.
• The database denies access by default. Each table determines who may read each row, and an unauthorised request returns nothing. The database enforces this, rather than the screen: bypassing the app grants no extra access.
• Your private messages and their photos are not end-to-end encrypted. They are encrypted in transit and protected by the rule above, but we prefer to be explicit rather than imply otherwise.

10. Changes on 6 September 2026

Two types of information collected since the summer were missing from this policy. They are now included. This is a policy update to reflect the app, rather than new processing.

• Ride GPS tracks (section 2): a ride can include a GPX track, gaits and heart rate. The track follows the ride's visibility; heart rate is never shared with everyone. Following a route does not send any position data off the phone.
• Sharing across yards (section 5): this page previously said that only horses' profiles shared with friends crossed the boundary. That was true on 12 August. A public circle has existed since 13 August, with a clear rule: nothing enters it by default, publishing counts as consent, and a public ride includes its full route.
• “Near me” now also works for listings, riding clinics, livery and riders. The rule is unchanged: location is used to calculate distance and is not stored.

11. Changes on 18 August 2026

When the legal wording was clarified on 21 September 2026, no new collection or tracker had been added. The optional advertising measurement introduced on 13 October 2026 is described separately above and requires your prior consent.

• This page previously said “we sell nothing to anyone”. Section 4 now explains how Paddoco plans to earn revenue : anonymous industry statistics, professionals paying for visibility and introductions made only at your request.
• It no longer promises “never” where the meaningful rule is this: nothing that identifies you leaves here without your permission, and every new use is described here before it begins. A service promising never to earn money risks making a promise it cannot keep; ours prefers to explain its plans in advance.
• Why explain this beforehand? Because narrowing a policy when it becomes inconvenient is backtracking, while clarifying it while it is still fully accurate is transparency. No such contract currently exists.

12. Changes on 12 August 2026

Four changes made that day affect this page. Two expanded access and are described above. Two restricted it and also deserve mention.

• Sharing with friends (sections 4 and 5): friends at another yard can now see your horses' profiles. This is the first time information has crossed yard boundaries, which is why this page explains it explicitly.
• An email delivery provider (section 4): our email alerts now go through Brevo, which receives your email address and the alert's contents. It already handled account creation emails but was not named here. It is now.
• Access to horse photos was restricted. Until that date, a confirmed member of a yard could see photos of horses at other yards and horses belonging to no yard. This was a defect, which was identified and fixed: a horse's photos now follow that horse's yard permissions, with access granted only by the rules in section 5.
• Twenty-three internal database functions were closed to signed-in accounts. No screen used them, but they remained accessible externally. None was needed by the app, and none has become necessary since.
• Messaging now supports photos (sections 2, 5 and 9), and sent messages can be edited or deleted. This grants access to nobody new: a message photo can only be viewed within its conversation.

13. If this policy changes

We will update it here with a new date. Any change affecting what we collect or who receives it will be announced in the app, as well as described on this page.

Legal notice · Terms of use · Delete my account