Privacy Policy

Language: This is a translation of the German Datenschutzerklärung. If the two versions differ, the German version prevails.

1. Controller and contact

The controller within the meaning of the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG) is, unless section 4 says otherwise:

Data protection officer: Given the size and activities of our business, we are not required to appoint a data protection officer under § 38 BDSG. Please send privacy requests directly to the contact address above.

“We” and “us” means Cogswell IT. “You” means you as a visitor of the website or user of the app, usually as the owner or an employee of a horse-care business or boarding kennel. Horse owners who are clients of such a business will find specific information in section 28. Cogswell IT is based in Germany; for users in the United States and Canada, see section 27 as well.

2. Summary

• Local first. Everything you enter in the app is stored on your iPhone. Without a server account we do not receive this data. It then only leaves your device when you share it yourself (e.g. a backup file, a PDF by email) or when a feature uses an Apple service or the weather service (sections 8 to 13).
• Server account is optional. With a server account you can synchronise data, send email through our server and use the client portal, the live link and online payment. For your clients' data we act only on your behalf.
• No ads, no tracking. Neither the app nor the website contains advertising, analytics, crash-reporting or tracking SDKs, the advertising identifier (IDFA), App Tracking Transparency, cookies or fingerprinting. We do not sell data.
• Location only when needed. The app only requests location “While Using the App” and uses it only during a running live visit, then also while the screen is locked. Positions only reach the server during a live visit with a server account.
• On-device AI. The AI visit report is created with Apple Intelligence directly on the iPhone; there is no cloud AI provider.
• Pre-registration only with consent. For the launch notification we only keep your email address once you confirm it (double opt-in), and delete it no later than three months after the launch campaign.
• We never see payment details. In-app purchases are handled by Apple, your clients' online payments by Stripe on your own Stripe account.

3. Definitions

• Personal data is any information relating to an identified or identifiable natural person (Art. 4(1) GDPR), such as name, address, email address, IP address or location. Information about horses is not personal data in itself, but becomes personal data once it is linked to an owner.
• Processing is any operation on such data, from collection and storage to transfer and deletion (Art. 4(2) GDPR).
• Controller is whoever decides on the purposes and means of processing (Art. 4(7) GDPR).
• Processor is whoever processes data on behalf of and on the instructions of a controller (Art. 4(8), Art. 28 GDPR); under US and Canadian law this corresponds roughly to a “service provider”.
• Business means the horse-care business or boarding kennel using the app. On the server such a business is technically called a “tenant”.
• Server account is the business's optional account on our server at app.gethorsevisiters.com.
• Token link is a link containing a random, unguessable string (40 hexadecimal characters, 160 bits of randomness) that lets horse owners access their area of the client portal without a password.
• Third country is a country outside the European Union and the European Economic Area.

4. Scope and roles

4.1 What this policy covers

This policy covers the iOS app “GetHorseCare” (including its widgets, Live Activity and Siri shortcuts), our server with the client portal at app.gethorsevisiters.com and the website gethorsevisiters.com including pre-registration. It also covers the Android app “GetHorseCare” (specifics in section 22a).

4.2 Who is responsible for what

• We as controller process: website access data, pre-registrations, support requests, the data of your server account (business name, email address, password hash, subscription status), technical server logs and data for abuse prevention.
• You (your business) as controller decide about the data of your clients and their horses, your staff, your appointments, visits and invoices. This applies both to local storage in the app and to storage on our server. You need your own legal basis for this (usually the care contract, Art. 6(1)(b) GDPR) and inform your clients yourself. If staff use the app, you are also responsible for their data (§ 26 BDSG).
• We as processor: if you store your clients' data on our server (synchronisation, client portal, live link, email delivery, payment links), we process it solely on your behalf and on your instructions (Art. 28 GDPR), or as your service provider under US and Canadian law. A data processing agreement (DPA) is available on request via our contact form.
• Independent controllers are Apple (App Store, in-app purchases, iCloud, Apple Intelligence, Maps, Siri) and Stripe (payment processing) for the processing they carry out under their own responsibility.

Data that the app only processes on your device does not reach us. We are not the controller for such processing; we still describe it so you know what the app does.

4.3 Storing and reading information on your device (TDDDG)

The app stores information on your iPhone (database file, settings, keychain) and, with your permission, accesses device features such as location. The website stores a single entry in your browser's local storage. In each case this is strictly necessary to provide the service you explicitly requested (§ 25(2) no. 2 TDDDG). Beyond that we do not store or read any information on your device.

5. This website

5.1 Hosting and access data (Cloudflare)

This website is static and is delivered via Cloudflare Pages by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA.

• Purpose: delivering the pages, fending off attacks, stable operation.
• Data: IP address, time, page requested, referrer, browser identifier (user agent), amount of data transferred.
• Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is the secure and stable operation of the website.
• Recipient: Cloudflare as processor; a data processing agreement is in place with Cloudflare.
• Third country: USA; Cloudflare is certified under the EU-US Data Privacy Framework (Art. 45 GDPR), and EU Standard Contractual Clauses apply in addition (Art. 46(2)(c) GDPR).
• Retention: according to Cloudflare's settings; we do not analyse access logs ourselves.
• Required? Without this data the website cannot technically be delivered.

Cloudflare's privacy policy: cloudflare.com/privacypolicy.

5.2 No cookies, no analytics, no advertising

The website sets no cookies. We use no web analytics (such as Google Analytics), no conversion tracking and no remarketing, and no usage profiles are created. Consent under § 25(1) TDDDG is therefore not required, so instead of a consent banner we only show a notice. When you close it, we store the entry dw-privacy-notice with the value 1 in your browser's local storage so it doesn't reappear on every page. The entry contains no personal data, is never sent to us and stays until you clear it in your browser. Legal basis: § 25(2) no. 2 TDDDG (strictly necessary for a service you requested). You can reopen the notice at any time via “Cookie notice” in the footer. The website creates no other entries in browser storage.

5.3 Fonts, images and videos

Fonts (Be Vietnam Pro, Old Standard TT), images and videos are served from our own web space. No connection is made to Google Fonts, video platforms or any other third party, and no third-party scripts are loaded, with one exception: once you use a form, the spam protection Cloudflare Turnstile loads (section 5.6).

5.4 Support form

When you submit the form on the support page, your browser sends your details to a function of this website at Cloudflare (/api/support). It forwards the message by email via Resend (section 20) to our internal support inbox, with your email address set as the reply-to address.

• Data: name, email address, topic, message, page language and, technically, your IP address. A hidden check field and Cloudflare Turnstile (section 5.6) help prevent spam.
• Purpose and legal basis: handling your request, Art. 6(1)(b) GDPR (questions about a contract or subscription) or (f) (other requests; our interest in replying). To prevent abuse, at most three messages per hour and IP address are possible; for this we briefly store a non-reversible hash of the IP address with a counter that expires after one hour. We may block addresses that have demonstrably been misused.
• Required: name, a valid email address and a message are needed so we can reply.

5.5 Links

Links to the App Store lead to Apple, links to third-party privacy pages to the respective provider. Data is only transferred to such a provider once you click the link.

5.6 Spam protection with Cloudflare Turnstile

We protect our forms (pre-registration and support) with Cloudflare Turnstile by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Turnstile only loads once you click or hover over a form; normal page views don't load it.

• Purpose: telling humans from automated programs so the forms can't be misused for spam or mass emails to other people's addresses.
• Data: Turnstile evaluates technical characteristics of your browser and connection; in particular your IP address and browser information are sent to Cloudflare. Our server then verifies the result with Cloudflare and also transmits your IP address. According to Cloudflare, Turnstile sets no advertising cookies and builds no usage profiles.
• Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is protecting the forms and our users from abuse. Where information is stored in or read from your browser, this is strictly necessary under § 25(2) no. 2 TDDDG for the service you requested (submitting the form).
• Third country: USA; Cloudflare is certified under the EU-US Data Privacy Framework, and EU Standard Contractual Clauses apply in addition.
• Required: without the check the forms can't be submitted. You can then reach us by post at the address in section 1.

Cloudflare privacy notices: cloudflare.com/privacypolicy and cloudflare.com/turnstile-privacy-policy.

6. App: local storage and encryption

6.1 What the app stores on your device

Depending on use and plan, the app stores the following categories locally:

• Business data: your business name, address, phone, email address, tax and bank details (e.g. IBAN) for invoices, prices, packages, templates and the coordinates for the weather display.
• Client data: name, address, phone, email, emergency contact, vet, insurance, intake form, care contract and its schedule, signatures, consents (e.g. off-leash, photos), key status, notes.
• Horse data: name, call name, breed, colour, sex, date of birth, weight, microchip number, health, allergies, medication, food, vaccinations with due dates, behaviour, compatibility, photos.
• Appointments and visits: times, meeting points, horses, notes, visit reports, recorded routes and markers (pee, poo, water), photos, your clients' ratings.
• Boarding: bookings, check-in and check-out, daily reports, incidents, waiting list.
• Invoices, reminders, subscription billing, e-invoice (XRechnung) files, mileage log, inquiries, staff and vehicle data.
• Settings (e.g. appearance, reminders, app lock) and, with a server account, the sign-in token.

6.2 Where and how it is protected

• The data is kept in a database file inside the app's protected container; photos as downscaled JPEG copies in a separate folder of the container. Other apps have no access.
• iOS encrypts these files with the data protection class iOS uses by default for app data: they are encrypted until the iPhone is unlocked for the first time after a restart. The app does not add its own encryption of the database. Please protect your iPhone with a passcode and optionally use the app lock (section 15).
• The sign-in token for the server account is stored in the iOS keychain and can only be used on this device (it is not transferred in backups). The app does not store your password.

6.3 Device and iCloud backup

The app does not use its own iCloud or CloudKit account. If you have enabled device backup to iCloud or a computer, iOS backs up the app container including database and photos. Apple is responsible for iCloud backups; Apple's privacy policy applies. If you don't want this, you can exclude GetHorseCare from iCloud backup in iOS Settings.

6.4 Deletion

You delete individual records directly in the app. “Settings → Delete all data” removes all business data on the device (your business settings are kept). Deleting the app makes iOS remove the entire app container. Data on our server is not affected; see section 18.6.

7. App permissions

The app only requests the following iOS permissions, each only when you use the feature. You can revoke any permission at any time in iOS Settings under “GetHorseCare”; the rest of the app keeps working.

The app does not ask for “Always” location permission, contacts, calendars, microphone, Bluetooth, health data or permission to track you across apps. It does not use push notifications via Apple's servers.

8. AI visit report (Apple Intelligence)

The app can draft the text of visit reports with the Apple Intelligence language model directly on your iPhone (Apple Foundation Models). It uses horse names, date, duration, distance, markers, the day's weather and your keywords. This data does not leave your device for this purpose and is not sent to us or to any other AI provider. If Apple Intelligence is unavailable, the app builds the text from a fixed template. Whether and how Apple Intelligence is available on your device is governed by Apple; Apple's privacy policy applies. You review and send the report yourself; no automated decision about people is made.

9. Route planning and maps (Apple)

When you let the app optimise the order of a pick-up and drop-off tour, it uses Apple's map service (MapKit):

• Data sent to Apple: to convert them into coordinates, the addresses (street, city) of your business and of the selected clients; then, to calculate travel times and the route, only the coordinates of the stops. Names or other client data are not sent. Technically Apple also receives your IP address.
• Navigation: when you start navigation, the app passes the stops with coordinates and the client's name to Apple's Maps app. Tapping an address in the app opens Apple Maps with that address.
• Purpose and legal basis: efficient route planning, Art. 6(1)(b) GDPR (a feature you chose) or, for client addresses, your business's legal basis.
• Recipient: Apple as an independent controller; Apple's privacy policy applies.
• Retention: the app only keeps the coordinates in memory until it is closed.
• Required? Voluntary; without route planning you set the order yourself.

10. Weather (Open-Meteo)

For the forecast on the “Today” tab and in the visit report, the app fetches forecast data from Open-Meteo (Open-Meteo GmbH, Switzerland, open-meteo.com).

• Data: the coordinates you enter in the business settings under “Weather: latitude/longitude” (a fixed default location if empty) and, technically, your IP address. The app does not use your iPhone's location for this. No accounts, names or identifiers are sent.
• Frequency: when the “Today” tab opens, when refreshing and in the visit report; results are cached for one hour.
• Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is a useful weather display for planning visits.
• Recipient and third country: Open-Meteo as an independent provider in Switzerland; there is an EU Commission adequacy decision for Switzerland (Art. 45 GDPR). Provider information: open-meteo.com/en/terms.
• Required? The request is part of the start screen and currently cannot be turned off.

11. Photos, camera and QR codes

• Photos for horses and visits are chosen with the iOS photo picker. The app stores a downscaled copy in its container. Photos are never transmitted to our server, not even with a server account. They only leave the device if you share them yourself or iOS includes them in the device backup.
• QR scanner: the scanner (VisionKit) analyses the camera image solely on the device and matches the recognised code to a horse profile. No images are stored or transmitted.
• QR code for horse profiles: if you create a QR code (e.g. for a collar tag), it contains in plain text the horse's name, breed, the owner's name and phone number and your business's name and phone number. Anyone who scans the code can read this. Agree on its use with your clients first.

12. Invoices, contracts, export and backup

• PDF, XRechnung, CSV: the app creates invoices (PDF, possibly with a payment link), care contracts (PDF), e-invoices in XRechnung format (XML) and invoice lists (CSV with number, date, client name, amount, status) locally. They are only transferred when you pass them via the share menu to an app or person of your choice.
• Backup export: under “Data & backup” you export all business data as a JSON file. It contains all client and horse data including health details, signatures, routes, invoices and your bank details, but no photos. The file is not encrypted. Where you store it (iCloud Drive, Files, email) is your decision and responsibility; keep it protected.
• Import: importing a backup file replaces all data on the device with the file's contents. Nothing is sent to us.

As a business you are responsible for retaining your invoices under commercial and tax law (e.g. § 147 AO, § 257 HGB in Germany).

13. Messages and sharing

• Without a server account the app does not send messages itself. You pass visit reports, reminders, dunning letters and other texts via the iOS share menu or a prepared mailto: link to the app of your choice (e.g. Mail, Messages, WhatsApp). From then on, that app's or provider's terms apply.
• With a server account you can send email through our server (section 20).
• Calls and maps: tapping a phone number or address opens the Phone or Maps app.
• Clipboard: the app only writes to the clipboard when you ask it to (e.g. payment link, message text, emergency position) and does not read it.
• Rating the app: “Rate GetHorseCare” opens Apple's rating dialog; the rating goes to Apple, not to us.

14. Notifications and reminders

Reminders for visits (horse names, time, meeting point), boarding arrivals and departures (horse names) and monthly subscription billing are local notifications that the app schedules on your device. There are no server push notifications; no push tokens are created or sent to us. Due vaccinations are shown as a hint on the “Today” tab, not as notifications. Notifications may be visible on the lock screen; you choose which reminders you get in the app settings and how they are displayed in iOS Settings.

15. App lock with Face ID

The optional app lock uses iOS device authentication (LocalAuthentication): Face ID or Touch ID, or the device passcode as a fallback. The app locks as soon as it moves to the background. iOS performs the biometric check in the Secure Enclave; biometric data never leaves the device, and neither the app nor we have access to it.

16. App log and diagnostics

• App log: the app keeps a short technical log (e.g. sync results, error messages from the server, number of reconciled payments). It is held in memory only, contains at most 200 entries and is discarded when the app quits. The app does not write names or contact details into it; invoice numbers and server error texts may appear.
• Diagnostics report: under “Help” you can create a diagnostics report. It contains app version, iOS version, device type, your business name, whether a server account is connected, the time of the last sync and the number of your clients, visits, invoices and bookings, but no client data. It is only transmitted if you email it, share it or attach it to a support request yourself (section 23); you can optionally include the app log.
• Connection check: when you open Help, the app checks without credentials whether our server is reachable. This only produces technical connection data (section 18.4).
• No analytics or crash SDKs. We only receive crash reports if you have enabled sharing analytics with app developers in iOS Settings; Apple then provides them without names or contact details (section 22).

17. Admin demo and sample data

“Start admin demo” or “Load demo data” replaces the data on your device with made-up sample data and unlocks all features for trying them out. The sample data does not describe real people; its email addresses end in example.com or gethorsevisiters.com. The demo runs entirely locally and sends nothing to us. Note: existing business data on the device is replaced; create a backup first.

18. Optional server account

For synchronisation and restore, the client portal, the live link, email delivery and online payment, you can create an account at app.gethorsevisiters.com in the app under “Server account”. This is voluntary; without an account all local features keep working.

18.1 Registration and sign-in

• Data: your business name, email address, password (at least eight characters), registration time, role in the account; for subscriptions, the subscription status (section 22).
• Protection: we only store the password as a bcrypt hash, never in plain text. After signing in the app receives a signed token valid for 30 days, stored in the iOS keychain. “Sign out” removes the token from the device.
• Purpose and legal basis: providing the server account under our terms, Art. 6(1)(b) GDPR.
• Required? Business name, email address and password are needed for an account. We also use the email address as the reply-to address for emails you send through the server.

18.2 Synchronisation and restore

Sync only happens when you trigger it (sync button, pull to refresh, “Restore”). There is no automatic background sync.

• Clients: first and last name, email, phone, street, city, horses (name, breed, date of birth), contract status, active/inactive, package name and booking details (days, time window, pick-up and drop-off).
• Visits from the last 30 days and future ones: horse names, assigned clients, status, duration, group visit, report text, distance, route (up to 200 points), rating, start time.
• Invoices: number, date, amount, status, assigned client.
• Not synchronised: photos, signatures captured in the app, keys, notes, vet and insurance details, health, allergy and vaccination details entered in the app, staff, vehicle and mileage data.
• Retrieved from the server as well: the details horse owners enter themselves in the client portal (section 19), including health details about the horse and signatures, and visit ratings.

For client data we act as processor (section 4.2); the legal basis is your business's. For providing the feature to you, Art. 6(1)(b) GDPR applies.

18.3 Hosting and database

The API server and the client portal at app.gethorsevisiters.com run on a dedicated server operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in its data centre in Nuremberg (Germany). We run the database ourselves on the same server, so server data does not leave Germany. A data processing agreement under Art. 28 GDPR is in place with Hetzner. Daily database backups are kept only on this server and deleted after 14 days. Data from users in the US and Canada is therefore stored and processed in the EU.

18.4 Technical logs and abuse prevention

• Connection data: on every request to the server (app, client portal, live link, support form) the web server logs the time, the requested page without parameters, status code, data volume, referring page and browser or app identifier, plus the IP address in shortened form (IPv4 without the last byte, IPv6 only the first 48 bits). The logs are deleted automatically after 7 days.
• Throttling: to prevent abuse and password guessing, the server limits requests (e.g. 5 registrations per hour, 10 sign-in attempts in 10 minutes, 5 support requests in 10 minutes per IP address; payment features per account). For this it stores a hash (MD5) of the IP address or the account identifier together with the request times in a temporary file; times outside the respective window (10 to 60 minutes) are discarded on the next request.
• Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is secure, stable operation.

18.5 Activity log

For traceability and troubleshooting, the server logs important actions in your account with time and acting person or system: e.g. registration, creating and deleting records, emails sent (with recipient address and subject), invited clients (with email address), completed intake forms, signed contracts, package bookings and ratings (with the owner's email address), payment links (with invoice number) and subscription changes. The legal basis is Art. 6(1)(f) GDPR or, for client data, your business's instructions. The log is deleted with your account.

18.6 Retention and deletion

Your server account data and the client data stored in it are kept as long as the account exists. Individual records can be deleted on the server; records you only delete in the app remain on the server until the account is deleted. You request deletion of your server account via our contact form, stating your registered email address, or by post to the address above. We then delete all of your business's server-side data (account, clients, horses, visits, invoices, payment links, activity log) within 30 days unless statutory retention duties apply. “Sign out” and “Delete all data” in the app do not delete data on the server.

19. Client portal and links for horse owners

With a server account, your business can email token links to horse owners. We process the data as your business's processor; the controller towards horse owners is the business (section 28).

19.1 Token links

Each link contains a random string (160 bits) assigned to a client; client IDs never appear in the links. The links currently have no expiry date and remain valid as long as the client's record exists on the server. An intake form already filled in, a completed package booking or a signed contract cannot be submitted again via the link. Treat the links like a password.

19.2 Online intake form

Owners enter: first and last name, address, phone, email, emergency contact, vet, insurance, notes and wishes, consent to photos; for the horse, name, call name, breed, colour, date of birth, sex, neutering, weight, microchip number, allergies, medication, food, health status, vaccinations, behaviour towards horses and people, leash manners, recall, off-leash, hunting behaviour, being left alone, past conflicts or bite incidents, group experience and equipment; plus a signature and confirmation of the details. On submission the server stores the time, name, signature and IP address as proof. The business is notified by email.

19.3 Contract signature

Via the contract link, owners see the care contract and sign it on screen. The signature is stored as an image together with the time.

19.4 Package booking

Owners choose a care package with days, time window, pick-up and drop-off, start date and notes and confirm it with their name. The server stores the selection, time, name and IP address as proof and emails a confirmation to the owner and the business.

19.5 Portal and visit ratings

In the portal, owners see upcoming appointments, contracts and invoices. They can rate visits from the last 30 days with one to five stars and a comment (up to 500 characters); the rating appears in the business's app.

19.6 Sign-in by email link

Anyone who can no longer find their portal link enters the email address stored with the business on the sign-in page and receives the personal link by email. The page always shows the same response and does not reveal whether an address is on file. There are no passwords.

19.7 Live page and map

The live page asks the server for the current position every 15 seconds. To display the map, the viewer's browser loads the Leaflet map library from the content delivery network unpkg.com and map tiles from the OpenStreetMap Foundation (St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom). These providers technically receive the IP address, the browser identifier and, for map tiles, the map area shown. The legal basis is Art. 6(1)(f) GDPR (interest in a working map display). There is an EU Commission adequacy decision for the United Kingdom (Art. 45 GDPR). OpenStreetMap Foundation privacy policy: osmfoundation.org/wiki/Privacy_Policy.

19.8 Browser storage

The portal and live page set no cookies and use no local storage. The portal registers a service worker so it can be installed as an app on the home screen; it does not cache any content. Legal basis: § 25(2) no. 2 TDDDG.

20. Email delivery (Resend)

Emails sent via our server are delivered by Resend (Resend, Inc., 2261 Market Street, San Francisco, CA 94114, USA). This covers:

• emails you send from the app with a server account (e.g. visit reports, invoices, dunning letters, messages to clients);
• invitations, intake form, contract, package and portal links, and confirmations and notifications from the client portal;
• support requests from the app (with a server account) and via the form on this website.

Recipient address, sender name (your business name or “GetHorseCare”), reply-to address (your business's email address or that of the person making the request), subject and content are transmitted; Resend reports the delivery status to us. The sender address is [email protected]; replies go directly to the reply-to address. Resend acts as our processor; transfers to the USA are based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). The legal basis is Art. 6(1)(b) GDPR or, for client data, your business's instructions. Without a server account or pre-registration, no data is sent to Resend via the app or website.

21. Online invoice payment (Stripe)

You can optionally connect your own Stripe account to GetHorseCare (Stripe Connect, standard account) and send your clients a payment link for an invoice. You are the merchant towards Stripe and your clients; the money goes straight to your Stripe account and we charge no platform fee.

• Connecting the account: our server creates an account for your business at Stripe with business name and email address; you complete setup (identity verification, bank details) directly with Stripe. We only store the Stripe account ID and whether the account can accept payments.
• Payment link: the app sends our server the invoice ID, invoice number, amount, currency and the client's name and email address. The server stores these with a token link (…/pay.php?t=…) and the payment status. Stripe receives the invoice number, amount, currency, your business name, internal identifiers and, if available, the client's email address.
• Paying: payment takes place on Stripe's checkout page (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). Your clients enter payment details such as card number or IBAN directly with Stripe; we never receive them. Stripe reports payment status, amount and currency to our server via a signed webhook; the app retrieves this status.
• Cancelling: if you cancel or delete an invoice or manually mark it as paid, the app disables the associated payment link.
• Legal bases: for us Art. 6(1)(b) GDPR (providing the feature) or, for client data, your business's instructions; for Stripe Art. 6(1)(b) (payment processing), (c) (legal obligations such as anti-money-laundering) and (f) GDPR (fraud prevention).
• Stripe's role: Stripe processes payment and account data as an independent controller. Data may be transferred to Stripe, Inc. in the USA; Stripe, Inc. is certified under the EU-US Data Privacy Framework, and EU Standard Contractual Clauses apply in addition. Stripe's privacy policy: stripe.com/privacy.
• Retention: payment links and payment status are kept until your server account is deleted; Stripe keeps data according to its own, including statutory, periods.
• Required? Voluntary; your clients can still pay by bank transfer.

22. App Store and in-app purchases (Apple)

• Download and subscriptions: you get the app and its subscriptions through the App Store. Apple handles purchase, billing, free trial, renewal and cancellation as an independent controller; we receive no payment details, no name and no Apple ID.
• Without a server account the app checks the subscription status only on the device via StoreKit.
• With a server account the app reports product, trial, expiry date and Apple's original transaction ID to our server after a purchase. In addition, Apple sends us App Store server notifications about renewal, cancellation or refund. We link this to your server account to enforce plan limits. Legal basis: Art. 6(1)(b) GDPR. Retention: until the account is deleted.
• Beta test via TestFlight: if you take part in the beta, you install the app through Apple's TestFlight. Apple then provides us with your name and email address (if we invited you by email), device model, iOS version, crash reports and any feedback and screenshots you send in TestFlight yourself. With a server account the beta version also sends the Apple-signed app receipt (app ID, version, environment “Sandbox”) to our server, which then unlocks all features for your account until the beta ends on 31 January 2027. Legal basis: Art. 6(1)(b) GDPR. We keep the unlock until the account is deleted or a purchase replaces it.
• Statistics and crash reports: Apple provides aggregated download and sales figures in App Store Connect. We only receive usage statistics and crash reports if you have enabled “Share with App Developers” in iOS Settings; they contain no names or contact details.

Apple's privacy policy applies. Apple also processes data in the USA.

22a. Android app and Google Play

The Android app “GetHorseCare” offers the same core features as the iOS app. This policy applies to it accordingly; differences are listed here.

• Permissions: internet (server account, weather), precise location (only during a live visit, requested when you start it) and Google Play billing. The Android app does not ask for camera, contacts, microphone or background location.
• Storage: business data is kept in a file in the app's private storage, readable only by the app. The server account's login token is kept in the app settings and excluded from Google backups and device transfers.
• Google backup: if you have enabled Android backup, Android backs up the remaining app data encrypted to your Google account. You control this in the Android settings.
• Download and subscriptions: you get the app and its subscriptions via Google Play. Google handles purchase, billing, trial, renewal and cancellation as an independent controller; we receive no payment data.
• With a server account the app reports Google's purchase token to our server after a purchase. The server checks the subscription status (plan, term, state) directly with Google and receives notifications about renewal or cancellation. The legal basis is Art. 6(1)(b) GDPR.
• Deleting your account: in the app under More → Server account → “Delete account”, or via our page Delete account.

Google's privacy policy applies. Google also processes data in the USA.

23. Support

• Channels: the form on this website (section 5.4) or the support form in the app. The app sends the request with the reply address you enter via our server and Resend, also without a server account.
• Data: your contact details, topic and message; from the app, optionally the diagnostics report and app log (section 16). Please don't send us client data unless the request needs it.
• Legal basis: Art. 6(1)(b) GDPR or (f) (interest in answering).
• Retention: we delete support requests once resolved, at the latest after 12 months, unless statutory retention duties apply (e.g. tax-relevant correspondence).

24. Recipients at a glance

We only pass personal data to the following parties, do not sell data and do not share it for advertising. Authorities only receive data where we are legally obliged to provide it.

25. International transfers

Transfers to third countries only take place to the providers listed in section 24. We base them on an EU Commission adequacy decision under Art. 45 GDPR (EU-US Data Privacy Framework for certified US companies, Switzerland, United Kingdom) or on appropriate safeguards under Art. 46(2)(c) GDPR (EU Standard Contractual Clauses) with supplementary measures such as encryption in transit. You can request a copy of the safeguards via our contact form or by post to the address above. US authorities may in some circumstances access data held by US providers; the Data Privacy Framework provides limits and redress for this. If you are in the US or Canada, your server data is transferred to and processed in the EU, where it is protected by the GDPR.

26. Retention at a glance

We keep personal data only as long as necessary for the respective purpose or required by statutory retention duties (e.g. up to eight years for accounting records and up to six years for business letters under § 147 AO and § 257 HGB in Germany).

27. Your rights (EU, US, Canada)

27.1 European Union / EEA (GDPR)

Where the legal requirements are met, you have the following rights against us:

• Access (Art. 15 GDPR): whether and which data we process about you, for what purposes, who receives it, how long it is kept and where it comes from, plus a copy of the data.
• Rectification (Art. 16 GDPR): correction of inaccurate and completion of incomplete data.
• Erasure (Art. 17 GDPR): deletion of your data, e.g. when it is no longer needed or you withdraw consent, unless a retention duty applies.
• Restriction (Art. 18 GDPR): blocking instead of deletion, e.g. while accuracy is disputed.
• Notification (Art. 19 GDPR): we inform recipients of rectification, erasure or restriction where possible.
• Data portability (Art. 20 GDPR): receiving the data you provided in a structured, commonly used, machine-readable format. In the app you can get your data yourself at any time as a JSON backup.
• Withdrawal of consent (Art. 7(3) GDPR): at any time with future effect, e.g. by revoking an iOS permission or unsubscribing from pre-registration.
• No solely automated decisions (Art. 22 GDPR): see section 32.
• Complaint to a supervisory authority (Art. 77 GDPR): in particular in the member state of your residence, your place of work or the controller's seat.

How to exercise your rights: an informal message via our contact form or by post to the address above is enough. We respond without undue delay and at the latest within one month (Art. 12(3) GDPR; extendable by two further months for complex requests, in which case we let you know). Access is free of charge. We may ask for suitable proof of identity, e.g. a reply from the email address registered for the server account. We do not know data that only exists on your device; you view, export and delete it yourself in the app.

Supervisory authority responsible for us: the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Postfach 3163, 65021 Wiesbaden, Germany, phone +49 611 1408-0, [email protected], datenschutz.hessen.de.

27.2 California (CCPA/CPRA)

California residents have the right to know what personal information we collect, use and disclose (the categories and sources are described in sections 5 to 26), to request deletion and correction, to opt out of the sale or sharing of personal information, to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights. We do not sell or share personal information as defined by the CCPA (in particular not for cross-context behavioural advertising) and do not use sensitive personal information, such as precise geolocation from live visits or account credentials, for purposes other than providing the service. We disclose personal information only to the service providers and independent parties listed in section 24, for the business purposes stated there. Retention periods are listed in section 26. You can exercise your rights via the contact above; you may authorise an agent to act for you, and we will verify your request as described in section 27.1. For client data stored by a horse-care business, we act as its service provider and forward requests to that business.

27.3 Canada (PIPEDA and provincial laws)

Canadian residents may request access to and correction of the personal information we hold about them, withdraw consent subject to legal or contractual restrictions, and file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the competent provincial commissioner. Our privacy contact is Joshua Cogswell at the address in section 1. Your server data is stored and processed in the EU, and service providers in the USA, the United Kingdom and Switzerland may process data as described in sections 24 and 28; it may then be accessible to authorities in those jurisdictions under their laws.

28. Information for horse owners

If you are a client of a business that uses GetHorseCare:

• The controller for your data and your horse's data is your horse carer or boarding kennel. It decides what data it records and informs you under its own responsibility, usually in the care contract. Cogswell IT only provides the software and, where your data is stored on our server, processes it on the business's behalf.
• Where your data is stored: first on the business's iPhone. If the business uses a server account, the data listed in section 18.2 and section 19 is also stored on our server in the EU.
• What you enter yourself: intake form details, your signature, package bookings and ratings. For the intake form and package booking, your IP address is stored as proof.
• Emails from your business come from [email protected] with the business's name; your replies go directly to the business.
• Live link: the live page shows the horse carer's position during the visit. When you open it, your browser loads the map from OpenStreetMap and unpkg.com (section 19.7).
• Paying: if you pay online, you enter your payment details directly with Stripe (section 21); the payee is your business.
• Your rights under section 27 are best exercised directly with the business. If you contact us, we forward your request to the business and help it respond.

29. App Store privacy details

For the privacy details shown in the App Store, our review of the code finds:

• Data used to track you: none. The app does not use the advertising identifier and does not pass data to data brokers or ad networks.
• Data linked to you (only with a server account, online payment or a support request from the app, in each case for app functionality): contact info (name, email address, phone number, physical address, mainly of your clients), precise location (live visit), purchases (subscription history), other financial info (invoice amounts and status), user content (visit reports, ratings, customer support), identifiers (account ID) and diagnostics (only in the support report).
• Data not linked to you: Open-Meteo receives the weather coordinates you entered without any identifier; Apple processes addresses and coordinates for route planning.
• Without a server account we collect no data through the app within the meaning of the App Store privacy details.

The privacy details in the app itself (privacy manifest) match this review.

30. Children

GetHorseCare is a tool for businesses and is not directed at children and teenagers under 16. We do not knowingly collect data from children. If you learn that a child has sent us data, please let us know so we can delete it.

31. Security

We take technical and organisational measures appropriate to the risk under Art. 32 GDPR, including:

• TLS encryption of all connections between app, website, client portal, server and service providers;
• passwords only as bcrypt hashes; signed, time-limited sign-in tokens (30 days), stored in the iPhone keychain;
• strict separation of businesses on the server (every query is bound to the own account), database access only via the server;
• random, unguessable token links (160 bits) for the client portal and payment links without client IDs;
• throttling of sign-in, registration, support and payment requests; signed Stripe webhooks and secret webhook URLs for Apple;
• on the device: iOS data encryption, optional app lock, no third-party SDKs.

No system is completely secure. Please protect your iPhone with a passcode, keep iOS up to date and do not pass on token links. Please report security vulnerabilities via our contact form.

32. No automated decision-making

No automated individual decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. Route planning, the AI visit report and compatibility are suggestions that you decide on yourself.

33. Changes to this policy

We update this privacy policy when the app, the server, the website or the law changes. The current version is always available at this address and in the app under “Settings → Privacy” and on the subscription screen.

Last updated: October 2026