Privacy Policy

Last updated: July 2026

Introduction

Saddle ("we", "our", "us") is a social platform for horse owners. This Privacy Policy explains how we collect, use, and protect your information when you use our mobile application and related services.

Information We Collect

Information You Provide

• Account information: name, email address, password (hashed)
• Profile information: profile photo, bio, horse details
• Content: posts, photos, comments, ride data
• Barn information: barn name, location, membership details

Information Collected Automatically

• Location data: GPS coordinates during ride tracking (with your permission). Background location is used only during active ride recording.
• Device information: device type, operating system version, app version
• Usage data: app interactions, feature usage, crash reports
• Photos: images you choose to upload for posts, horse profiles, and ride documentation

What we don't collect

Saddle does not access your contacts, your microphone, your health data, or your calendar. There is no advertising, attribution, or analytics SDK in the app, so nothing here is used to build a profile of you or shared with anyone for their own purposes.

How We Use Your Information

• Provide and improve the Saddle app experience
• Enable social features (posts, comments, barn communities)
• Record and display ride routes and statistics
• Send push notifications (with your permission)
• Provide weather information for your barn location
• Diagnose technical issues and improve app stability

Third-Party Services

We use the following third-party services:

• Sentry (sentry.io): Crash reporting and error monitoring. A crash report identifies you only by your account ID — not your email address or name — so we can tell whether a bug is affecting one account or everyone. Your IP address, request contents, and the details of what you were looking at are not sent.
• Mapbox (mapbox.com): Map display, and route-snapping for saved trails. When you snap a trail to the trail network, the coordinates of that route are sent to Mapbox.
• Google Maps Platform: Address search and reverse geocoding. When you search for a place or drop a pin, that text or those coordinates are sent to Google.
• Google Weather API: Weather for your barn. Your barn's location is rounded to about a kilometre before it is sent.
• Cloudflare R2: Media and document storage.
• Expo (expo.dev): App builds, updates, and push-notification delivery. Notification text may include a barn name and the name of the person who triggered it.
• Resend: Sends account emails (verification, deletion notices) and receives your email address and name to do so.

We do not use any advertising, attribution, or analytics SDK. Your data is not sold, and it is not shared with anyone for their own purposes. Each third-party service above has its own privacy policy governing their use of data.

Data Storage and Security

• Your data is stored on secure servers with encryption in transit (TLS/SSL)
• Passwords are hashed using bcrypt and never stored in plaintext
• Authentication tokens are stored securely on your device
• Documents you upload (such as vet records or boarding paperwork) are kept in private storage. They can only be opened through a short-lived link we issue after checking that you are allowed to see that document.
• Photos and profile images (post photos, avatars, cover images) are served from long, randomly generated web addresses that are not listed or searchable anywhere. However, these addresses are not password-protected and do not expire: anyone you give the link to can open the image, and someone who saw an image while they were a member of your barn may still be able to open it afterwards. Please treat an image link as public.

Your Rights

You have the right to:

• Delete your account and everything in it, yourself, from Account Settings → Delete Account. Deletion is scheduled 30 days out and you can cancel it at any point during that window by signing back in. After that your data is permanently erased, not hidden.
• Correct your name, photo, and horse details directly in the app.
• Access or export a copy of your data, including your rides. There is no self-serve export button yet, so this one is handled by hand: email privacy@redrail.io and we will send you a copy. We aim to respond within 30 days.
• Opt out of push notifications, and revoke camera, photo, and location permissions, at any time in your device settings.

Data Retention

Your content — rides, photos, horses, documents — is kept for as long as your account is active. We do not currently age out old rides or routes; if you want one gone, delete it in the app and it is gone.

Some things are cleared automatically on a schedule: notifications you have read are removed after 30 days and all notifications after 90; photos uploaded but never attached to a post are removed after 24 hours; expired sign-in tokens are cleared daily.

When you delete your account, it is scheduled for deletion 30 days later and you can cancel any time in that window by signing back in. After that everything is permanently erased — including your uploaded files — rather than hidden or archived. Barns you own are handed to their longest-standing member so the barn's other members do not lose their own content.

Children's Privacy

Saddle is not intended for children under 13. We do not knowingly collect personal information from children under 13.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the app or by email.

Contact Us

If you have questions about this Privacy Policy or your data, please contact us at privacy@redrail.io.