Privacy policy

Draft - version 0, not yet in force

This is a draft and has not been reviewed. It was written by reading the code, so it describes what the app genuinely does rather than what a template says. That still is not the same as legal review, and it is not yet the policy we are bound by. Do not rely on it.

Beyond the Yard is a place for horse riders to find people nearby. This explains what we hold about you, why, who else gets to see it, and how to make us get rid of it. We have tried to write it so that you could check any line of it against what the app actually does.

Who we are

Beyond the Yard is an independent project run from the UK. For UK and EU data protection law we are the data controller for everything described here. Write to hello@beyondtheyard.app about anything on this page.

What we collect

Because you give it to us

Your email address: Required. It is also your username. If you sign in with Google or Apple, we get it from them instead.
Your password: Only if you set one. We store a hash, never the password. Accounts opened with Google or Apple have no password at all.
Your display name, and a confirmation that you are 18 or over: Required to register. The age declaration is a tick box - we do not ask your date of birth and we do not verify your age.
Your profile: Optional: a short bio, a photograph, your town, your disciplines, experience, preferred pace, when you tend to ride, whether you have transport, and your relationship to horses.
Your horses: Optional: name, age, height, breed or type, disciplines, description and notes on what they get on with.
What you write: Forum posts, comments, marketplace listings, and messages to other riders and to ride groups.
Photographs: Only the ones you choose to add, from your camera or your photo library.
Your plans: Rides and events you organise or say you are going to. This is a record that you intend to be somewhere at a particular time, so treat it as you would telling anyone.
Who you connect with: Friendships, groups you belong to, and people you have blocked. Blocks are never shown to the person blocked.

Because of how the app works

Your location, only if you ask us to use it: The app never needs it. If you tap to use your location when choosing your town, your device's approximate position is sent to us once so we can offer the five nearest towns. We do not store it, and it is deliberately left out of our request logs. Only the town you then pick is kept.
Sign-in tokens: Held in your phone's secure storage. We keep a hash of the refresh token so it can be revoked.
Your IP address: Used in memory to limit how often something can be attempted, so the app is harder to abuse. It is never written to our database and never written to our logs.
Reports about you or by you: If someone reports content, we keep a copy of the reported content as evidence - see below, because this includes private messages.

What we deliberately do not collect

No analytics. No advertising identifier. No tracking across other apps or websites. No crash-reporting service of our own. No device identifiers. No contacts, no calendar, no microphone. We have never asked for your phone number and no part of the app collects one.

Who else sees it

We do not sell anything about you, and we do not share anything for advertising. These are the only companies your data reaches, and only because the app cannot work without them.

Resend - sending email: Your email address and the message itself, for the only two emails we send: confirming your address and resetting your password.
Cloudflare - storing and delivering photographs: The photographs themselves, tagged with your account's internal identifier. Because your phone fetches images straight from Cloudflare, they also see the IP address of whoever is looking at a photograph.
Google and Apple - only if you sign in with them: They tell us your account identifier and your email address, and Apple also passes your name the first time. They know you signed in.
Our hosting and backups: The app runs on servers we rent in Europe, and the database is backed up nightly to European object storage.

We may also have to hand something over if the law requires it, or to protect someone from harm.

Who can see what, inside the app

Your profile is shown to riders it is discoverable to, and to your friends. You can turn discovery off.
Your horses follow the visibility you set - friends only, by default.
Forum posts and comments are visible to members. These stay on the site if you delete your account, attributed to a deleted member - see below.
Messages go to the person or ride group you send them to. They are not end-to-end encrypted: we could read them, and we do not, except in the one case below.
Reported content is copied as evidence and can be read by a moderator. This includes the text of a private message, if a message is reported. Every such viewing is recorded. We are telling you this because you would otherwise have no way of knowing.

Deleting your account

You can delete your account from the app, or by emailing us - see how to delete your account. Either way it works the same:

Your account is scheduled for deletion 30 days ahead, and is hidden from other riders immediately.
You can cancel during those 30 days by signing back in. Nothing has been erased yet.
After 30 days we erase your email address, your password, your links to Google or Apple, your sign-in tokens, your profile, your horses, your photographs, your marketplace listings and the contents of your private messages. Your email address becomes free to register with again.

Two things deliberately survive, and we would rather say so here than surprise you:

Your forum posts and comments stay, attributed to "Deleted member", with your photographs removed. A useful answer about a local farrier is worth more than the account that gave it, and the next person to ask deserves to find it.
Reports, moderation decisions and the audit log stay. These exist to protect other people, and leaving must not be a way to erase a record of what you did.

Our nightly backups are kept for 30 days. Deleting your account does not reach into a backup that has already been taken, so a copy may persist there for up to 30 more days before it ages out.

How long we keep things

Meeting points for rides and events: Deleted 30 days after the ride or event.
Notifications: Deleted after 90 days.
Unfinished photo uploads: Removed after 2 hours.
Backups: 30 days.
Everything else: Kept while your account exists, and dealt with as above when you delete it. We are being plain rather than quoting a period we do not actually enforce.

Your rights

Under UK and EU data protection law you can ask us to give you a copy of your data, correct it, delete it, or restrict or object to what we do with it. Deletion is built into the app. For anything else, email hello@beyondtheyard.app and we will answer within a month.

If you think we have got this wrong, you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first.

Why we are allowed to hold it

To give you the service you asked for - your account, your profile, your messages, your rides.
Because we have a legitimate interest in keeping the app safe and working - rate limiting, moderation, and the records that go with it.
Because you consented - using your device's location, and your camera or photo library. You can withdraw that in your phone's settings at any time, and the app keeps working without it.

Children

Beyond the Yard is for adults. You must be 18 or over. We ask you to confirm it and we cannot verify it. If you believe someone under 18 has an account, tell us and we will close it.

Changes

If we change this, we will update the date at the top and say so in the app. If a change matters, we will tell you before it takes effect.