Privacy Policy

Last updated: August 2026

Introduction

Saddle ("we", "our", "us") is a social platform for horse owners. This Privacy Policy explains how we collect, use, and protect your information when you use our mobile application and related services.

Information We Collect

Information You Provide

• Account information: name, email address, password (hashed)
• Profile information: profile photo, bio, horse details
• Content: posts, photos, comments, ride data
• Barn information: barn name, location, membership details

Information Collected Automatically

• Location data: GPS coordinates during ride tracking (with your permission). Background location is used only during active ride recording. If you turn on Ride Safety, your live location during a ride is shared with the safety contacts you chose — those people, and no one else, can see it until the ride ends or is marked safe.
• Motion data: accelerometer readings from your phone — and from your Apple Watch, if you use the watch app — recorded while a ride is running. These come from the device's motion sensors, not from Apple Health, and they are what let Saddle tell a walk from a trot from a canter. The raw readings stay on your device unless you press Sync on a finished ride. If you do, they are stored privately alongside that ride, where only we can open them, and are used to check and improve gait detection.
• Device information: device type, operating system version, app version
• Usage data: app interactions, feature usage, crash reports
• Photos: images you choose to upload for posts, horse profiles, and ride documentation

What we don't collect

Saddle does not access your contacts, your microphone, or your calendar. There is no advertising, attribution, or analytics SDK in the app, so nothing here is used to build a profile of you or shared with anyone for their own purposes.

Saddle reads nothing from Apple Health. It does use one Health feature — a workout session on the Apple Watch — for a purely mechanical reason, explained next.

Apple Watch and Health

If you ride with the Apple Watch app, Saddle runs a workout session on the watch for the length of the ride. That session is the only reason Saddle touches Apple's Health framework at all, and the reason is mechanical rather than medical: watchOS only keeps an app's sensors running once a workout is under way, so without it the watch would stop recording the moment you dropped your wrist.

On the watch, specifically:

• Saddle asks for permission to save workouts, because watchOS will not start a session without it — and then never saves one. No Saddle ride appears in the Health app, in your activity rings, or in your workout history.
• Saddle asks to read nothing. The request lists no readable data types at all, so there is no heart rate, step count, weight, or any other health record for the app to see — not even by accident.
• Because nothing is read, nothing from Apple Health is sent to our servers, shown to anyone else, or shared with any third party.

The iPhone app carries no Health capability at all: the workout session, and the permission that authorizes it, live entirely on the watch. The phone never asks you for Health permission, and never reads or writes a health record.

We do not use Apple Health data for advertising or marketing, for building a profile of you, for sale or disclosure to data brokers, or for any purpose beyond running the ride you started — a commitment that is easy to keep, since we never receive any.

What the watch does collect is motion: the accelerometer readings described above, which reach your phone over your own Bluetooth pairing and are treated exactly like the phone's own.

How We Use Your Information

• Provide and improve the Saddle app experience
• Enable social features (posts, comments, barn communities)
• Record and display ride routes and statistics
• Send push notifications (with your permission)
• Provide weather information for your barn location
• Diagnose technical issues and improve app stability

Third-Party Services

We use the following third-party services:

• Sentry (sentry.io): Crash reporting and error monitoring. A crash report identifies you only by your account ID — not your email address or name — so we can tell whether a bug is affecting one account or everyone. Your IP address, request contents, and the details of what you were looking at are not sent.
• Mapbox (mapbox.com): Map display, and route-snapping for saved trails. When you snap a trail to the trail network, the coordinates of that route are sent to Mapbox.
• Google Maps Platform: Address search and reverse geocoding. When you search for a place or drop a pin, that text or those coordinates are sent to Google.
• Google Weather API: Weather for your barn. Your barn's location is rounded to about a kilometre before it is sent.
• Cloudflare R2: Media and document storage.
• Expo (expo.dev): App builds, updates, and push-notification delivery. Notification text may include a barn name and the name of the person who triggered it.
• Resend: Sends account emails (verification, deletion notices) and receives your email address and name to do so.

We do not use any advertising, attribution, or analytics SDK. Your data is not sold, and it is not shared with anyone for their own purposes. Each third-party service above has its own privacy policy governing their use of data.

Data Storage and Security

• Your data is stored on secure servers with encryption in transit (TLS/SSL)
• Passwords are hashed using bcrypt and never stored in plaintext
• Authentication tokens are stored securely on your device
• Documents you upload (such as vet records or boarding paperwork) are kept in private storage. They can only be opened through a short-lived link we issue after checking that you are allowed to see that document.
• Photos and profile images (post photos, avatars, cover images) are served from long, randomly generated web addresses that are not listed or searchable anywhere. However, these addresses are not password-protected and do not expire: anyone you give the link to can open the image, and someone who saw an image while they were a member of your barn may still be able to open it afterwards. Please treat an image link as public.

Your Rights

You have the right to:

• Delete your account and everything in it, yourself, from Account Settings → Delete Account. Deletion is scheduled 30 days out and you can cancel it at any point during that window by signing back in. After that your data is permanently erased, not hidden.
• Correct your name, photo, and horse details directly in the app.
• Access or export a copy of your data, including your rides. There is no self-serve export button yet, so this one is handled by hand: email privacy@redrail.io and we will send you a copy. We aim to respond within 30 days.
• Opt out of push notifications, and revoke camera, photo, and location permissions, at any time in your device settings.

Data Retention

Your content — rides, photos, horses, documents — is kept for as long as your account is active. We do not currently age out old rides or routes; if you want one gone, delete it in the app and it is gone.

Some things are cleared automatically on a schedule: notifications you have read are removed after 30 days and all notifications after 90; photos uploaded but never attached to a post are removed after 24 hours; expired sign-in tokens are cleared daily.

When you delete your account, it is scheduled for deletion 30 days later and you can cancel any time in that window by signing back in. After that everything is permanently erased — including your uploaded files — rather than hidden or archived. Barns you own are handed to their longest-standing member so the barn's other members do not lose their own content.

Children's Privacy

Saddle is not intended for children under 13. We do not knowingly collect personal information from children under 13.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the app or by email.

Contact Us

If you have questions about this Privacy Policy or your data, please contact us at privacy@redrail.io.