Privacy policy

Last updated: 5 October 2026

Spoor is a training-log and planning app for equestrians. We keep the amount of personal data we collect small on purpose. This page explains what we hold about you, why we hold it, who else sees it, and how to delete it. If anything below is unclear, email [email protected] and we'll answer.

What we collect

Email address and password. Used only to sign you in. Password is stored hashed by our auth provider (Supabase) — Spoor never sees the plain password.
Your name or handle, if you enter one on the profile screen.
The horses you connect and the connection role you chose (rider, owner, etc.).
Training plans and session logs you save — session type, intensity, notes, timing.
Rider training program data if you use the feature — mobility, core, cardio sessions you accept or edit.
Free-text goals and coach notes you type into the app.
Your competition goal — the show, date and class height you aim for — and the week-by-week plan built towards it, including your weekly check-in choices.
Your home club, if you choose one, so we can suggest shows near you.
When you agreed to this policy, and which version, recorded when you create your account.
A record of sensitive actions on your account (see Activity record).

We do not collect: location, contacts, camera photos or video, device identifiers, advertising IDs, or usage analytics. We do not run advertising SDKs. We do not track you across other apps or websites.

Public competition data

When you add a horse, Spoor fetches that horse's public competition record from Tävlingsdatabasen (TDB), which is run by Svenska Ridsportförbundet. The record lists the horse's starts — date, show, class, height, faults, time and placing — and the name of the rider in each start. Spoor saves this record in our database (Supabase, EU) so the app can show and analyse it without asking TDB again, and checks TDB each night for the horse's new results. When no one on Spoor follows the horse any more, we delete its saved record. We don't save the names of the horse's owners or breeders. To suggest upcoming shows, Spoor also reads TDB's public competition calendar, class lists and club list, which we keep for up to 12 hours.

Spoor shows where this data comes from and links back to TDB for the full record and for entries. We identify ourselves to TDB in every request and keep our requests low. We don't publish start lists or result lists, and we don't sell or share this data.

Coaches

If you invite a coach for a horse and they accept, the coach can see the training sessions you mark as visible to your coach for that horse, and can write notes and competition plans for you. They can't see sessions you haven't shared, or anything logged by other people connected to the same horse. To end a coaching arrangement, email [email protected].

Activity record

To keep accounts safe, we record sensitive actions: creating or deleting your account, downloading your data, connecting or removing a horse, deleting a session or plan, coaching requests and decisions, and a coach viewing your sessions. Each record holds what happened, when, and which account did it. We store a scrambled form of the internet address the request came from, never the address itself, and never the content of your notes. Only our server can read these records. We keep them for 12 months, and they're included when you download your data.

Where the data lives

Supabase (EU region) holds your account, your saved training data and the saved competition records of the horses Spoor users follow. Supabase is our storage and authentication provider.
Our own server, hosted at Hetzner in Helsinki, runs the API and briefly caches TDB's public competition calendar.
Anthropic processes the free-text goal you enter and returns a draft training plan. Only the goal string, session-count preferences, and rider level (if provided) are sent — never your email, name, or any identifier.

Cookies and local storage

The Spoor iOS app stores a few things on your phone (UserDefaults) to make it quicker to use: your current competition goal and home club, how many sessions you've moved or swapped in your plan, and which weekly check-ins you've dismissed. They're kept separately for each account that signs in on the phone and never leave the device. The web landing page uses localStorage only to remember which pitch variant you saw, so you don't get a different page on refresh.

Who we share your data with

We do not sell or trade your data to anyone. The only third parties involved are the ones named above — Supabase (storage + auth), Hetzner (server hosting), and Anthropic (AI plan drafting). Each processes data only as needed to run the service. Spoor reads public competition data from TDB (Svenska Ridsportförbundet); we don't send them your personal data.

Your rights (GDPR)

You have the right to see, correct, download, and delete the data we hold about you.

See or download — download a copy of everything we hold about you from the You tab, or email [email protected] and we'll send it within 30 days.
Correct anything from the You tab in the app.
Delete your account — You tab → Delete account. We delete your profile, horses, plans, sessions, rider plan, coaching data and login straight away; if anything can't be deleted at that moment, it is finished within a day. Encrypted backups roll off within 30 days. Records of sensitive actions are kept for up to 12 months for security, linked only to an anonymous id. A horse's public competition record stays only while someone else on Spoor follows the horse.
Complain to your data protection authority if you're not happy with how we handled a request. In Sweden this is IMY (Integritetsskyddsmyndigheten).

How long we keep data

We keep account and training data for as long as your account is active. When you delete your account we remove it straight away (at the latest within a day); encrypted backups roll off within 30 days. Activity records are kept for 12 months. A horse's saved competition record is kept while at least one Spoor user follows the horse, and deleted within a day after the last one stops. TDB's competition calendar is cached for up to 12 hours.

Children

Riders of any age can use Spoor, but riders under 13 need a parent or guardian to create the account and agree to this policy for them; the app asks for this confirmation when an account is created. If you're a parent or guardian and think your child created an account without you, email [email protected] and we'll remove it.

Changes

If we change this policy we'll update the date at the top and, for material changes, we'll email everyone with an active account.

Contact

Spoor is operated by an independent developer. Reach us at [email protected].