Privacy policy

Last updated: 25 September 2026

Spoor is a training-log and planning app for equestrians. We keep the amount of personal data we collect small on purpose. This page explains what we hold about you, why we hold it, who else sees it, and how to delete it. If anything below is unclear, email hello@spoor.horse and we'll answer.

What we collect

Email address and password. Used only to sign you in. Password is stored hashed by our auth provider (Supabase) — Spoor never sees the plain password.
Your name or handle, if you enter one on the profile screen.
The horses you connect and the connection role you chose (rider, owner, etc.).
Training plans and session logs you save — session type, intensity, notes, timing.
Rider training program data if you use the feature — mobility, core, cardio sessions you accept or edit.
Free-text goals and coach notes you type into the app.

We do not collect: location, contacts, camera photos or video, device identifiers, advertising IDs, or usage analytics. We do not run advertising SDKs. We do not track you across other apps or websites.

Public competition data

When you connect a horse, Spoor fetches that horse's competition history from Tävlingsdatabasen, which is publicly available. This information is about the horse, not about you personally. We cache it on our server to power the stats and charts you see in the app.

Where the data lives

Supabase (EU region) holds your account and your saved training data. Supabase is our storage and authentication provider.
Our own server, hosted at Hetzner in Helsinki, runs the API and caches the public competition data.
Anthropic processes the free-text goal you enter and returns a draft training plan. Only the goal string, session-count preferences, and rider level (if provided) are sent — never your email, name, or any identifier.

Cookies and local storage

The Spoor iOS app uses on-device storage (UserDefaults) to remember your current selection and a small counter of how many sessions you've edited in your training plan. This never leaves the device. The web landing page uses localStorage only to remember which pitch variant you saw, so you don't get a different page on refresh.

Who we share your data with

We do not sell or trade your data to anyone. The only third parties involved are the ones named above — Supabase (storage + auth), Hetzner (server hosting), and Anthropic (AI plan drafting). Each processes data only as needed to run the service.

Your rights (GDPR)

You have the right to see, correct, download, and delete the data we hold about you.

See or export — email hello@spoor.horse; we'll send a JSON export within 30 days.
Correct anything from the You tab in the app.
Delete your account — You tab → Delete account. This removes your profile, horses, training plans and session logs. Public TDB data about the horses stays cached (it wasn't yours to begin with). Backups roll off within 30 days.
Complain to your data protection authority if you're not happy with how we handled a request. In Sweden this is IMY (Integritetsskyddsmyndigheten).

How long we keep data

We keep account and training data for as long as your account is active. When you delete your account we remove it immediately from the live database; encrypted backups roll off within 30 days.

Children

Spoor isn't aimed at children under 13. If you're a parent or guardian and think your child created an account, email hello@spoor.horse and we'll remove it.

Changes

If we change this policy we'll update the date at the top and, for material changes, we'll email everyone with an active account.

Contact

Spoor is operated by an independent developer. Reach us at hello@spoor.horse.