Privacy policy

This is an English translation provided for convenience. The French version of this policy is the authoritative one.

This policy explains what data the Equiflow app and its website process, why, on what basis, with whom and for how long, in accordance with Regulation (EU) 2016/679 (GDPR) and French law no. 78-17 of 6 January 1978 on information technology, data files and civil liberties. We designed the app so that your horses' lives stay on your phone, and we describe below, without leaving anything out, what leaves it.

1. Data controller

BAUGEY MATHEO, sole trader (entrepreneur individuel) trading as DEVOLIM
248 rue de Bègles, 33800 Bordeaux, France
SIREN: 948 000 757
Email: contact.equiflow@devolim.fr

The publisher has not appointed a data protection officer: any question or request about your data is handled directly by the publisher, at the address above.

2. Our principles

• No account to create: no name, email address, phone number or password is asked of you.
• What you enter stays encrypted on your phone. What you share is end-to-end encrypted.
• No advertising, no advertising tracking, no advertising identifier, no GPS geolocation.
• No data sold, rented, exchanged or transferred, to anyone.
• Artificial intelligence is only used with your explicit consent. It never receives your horse's name, your name, its official numbers or its yard, except what appears on a photo you choose to have it read. Your messages are not stored on our servers and are not used to train an AI.
• Usage statistics never contain your horses' names, your notes, your photos or their care.
• We collect as little as possible, and the data kept on our servers has a limited lifetime.

3. What stays on your phone

The following information is stored only on your phone, in an encrypted vault (AES-256-GCM encryption, whose key is kept in the system's secure keychain and never leaves this phone):

• your rider profile: role, age band, declared Galop level, goals, availability, riding areas and equipment;
• your horses' profiles: name, photo, breed, coat, age, height, sex, SIRE and UELN numbers, microchip, owner, yard, temperament, particular features;
• the health record: care, vaccines, dewormers, appointments, copied prescriptions, tracked discomforts and wounds, weight and condition, emergency card, contact details of your professionals (vet, farrier, dentist...);
• the photos and documents you add (passport, insurance, prescriptions, invoices), also encrypted;
• your weeks, sessions, journal, feelings, reports, competitions, results and expenses, and your calendar (lessons, clinics, time away, transport);
• your conversations with Jo;
• the version and date of your acceptance of the disclaimer and terms, and the date of your consent for Jo.

A few settings with no personal content are kept outside the vault, in the app's preferences (appearance, sounds, lock on or off).

We have no access to this information and cannot recover it. It is deleted when you tap "Delete my data" (Settings) or uninstall the app.

Backups. The vault is excluded from automatic backups (iCloud, computer, Android backup) and its key is tied to this phone. To keep a copy or change phone, the app offers a backup that you trigger yourself, encrypted with a password you choose: you store the file wherever you like (for example iCloud Drive, Google Drive or a computer), under your own responsibility and the terms of that service. We receive neither this file nor your password, and cannot open it.

Exports. You can export a horse's record as a PDF, or share a document, through your phone's share menu: you choose the recipient. The file is not encrypted; once shared, it leaves our control. Temporary files created for the export are then deleted from the phone.

Notifications. Reminders are local notifications, scheduled on the phone itself, with no sending server.

4. What leaves your phone

4.1 From the first launch

For the app to work and stay secure, a few technical exchanges take place from the first launch, with no information about your horses:

• Session identifier: the app creates a random technical identifier (Firebase Authentication anonymous sign-in). It contains neither your name, nor your email address, nor your number; we call it "anonymous" for that reason, but under the GDPR it is pseudonymous data, since it is specific to your installation. It is used to apply Jo's usage limits, link your subscription, manage your sharing and erase your data on our servers when you ask.
• Service protection: each request to our servers carries a Firebase App Check attestation (Apple's App Attest and DeviceCheck, Google's Play Integrity) proving that it comes from the genuine app. This attestation contains no content and is not kept by us.
• Subscription status: the app asks RevenueCat, with your session identifier, whether a subscription is active.

Crash reports (point 4.9) are also active from the first launch.

4.2 Weather

To show the weather, the app queries the Open-Meteo service (OpenMeteo GmbH, Switzerland) directly from your phone: it sends it the name of the town you type to find it, then the coordinates of the chosen town, rounded to about one kilometre. Like any online service, Open-Meteo also receives your phone's IP address. The app does not use GPS. Under its terms, Open-Meteo deletes its logs, which may contain these coordinates, after 90 days. Our server does not receive your town; when Jo prepares your week, it only receives the forecast (temperatures, frost, storms, rain), with no location.

4.3 Jo, only with your consent

Jo only works after your explicit consent, given on a dedicated screen that explains the following. When you use Jo, the app sends, encrypted, to our server function (Google Cloud Functions, europe-west1 region, in Belgium), depending on what you ask:

• your request: your question and the latest messages of the current conversation, or the text you entrust to it (dictated session account, notes after a vet visit);
• the useful context, without names: for the horse, its age, sex, breed, coat, height, discipline, level, condition (fit, returning to work, injured), shoeing and whether it competes; for you, your role, age band, Galop level, goals, available days, session length, riding areas and equipment; a summary of your latest sessions (durations, gaits, feeling, signs noted, exercises), the types and relative dates of recent and upcoming care (without product or professional names), the areas of current discomforts, the season and, for the week, the weather forecast and upcoming events (their type and date only, never their name or place);
• a photo, only when you ask Jo to read it (point 4.4);
• the app's language, the version of your consent, your session identifier and the App Check attestation.

The app never sends: your horse's name, your name, SIRE, UELN or microchip numbers, the yard's name, the owner, free notes not requested, photos not requested, a position. The server checks your usage limits and subscription, then passes on to OpenAI, which writes the answer: your request, this context and a pseudonymous identifier, obtained by hashing your session identifier, which OpenAI uses to detect abuse. Requests and answers are also checked automatically to filter out dangerous content, and the answer is checked before being returned to you (no diagnosis, no medicine or dose, referral to the vet on any warning sign).

• We do not store your requests, the answers or your photos: neither in our database nor in our technical logs.
• OpenAI processes this data on our behalf. It is not used to train its models; it may be kept for up to 30 days for abuse detection, then deleted. It may be processed in the United States (section 8).
• You can withdraw your consent at any time in Settings, Privacy. Without consent, nothing is sent to Jo; the app's other features remain available.
• Do not write your name, your address or information about your health or anyone else's to Jo: what you write is passed on as is.

4.4 Photos and documents read by Jo

When you ask Jo to read a photo (your horse, its passport, a prescription, an invoice, a forage analysis, a wound or discomfort), the app sends that photo only, reduced and recompressed on the phone, without its metadata (no location, date or device), with the context described in point 4.3. Jo reads everything that is visible: a document may show your name, your address, your vet's name or your horse's numbers, and a photo may show a person. Before sending, hide or crop anything not needed. The photo is not kept by our server; OpenAI processes it under the conditions of point 4.3. The result is shown to you, and nothing is recorded without your validation; it then stays on your phone.

4.5 End-to-end encrypted sharing

If you share a horse, the shared items (profile, record, sessions, documents, depending on the role chosen) are encrypted on your phone with a key specific to that horse (AES-256-GCM), then stored in our database (Google Cloud Firestore, in Europe). This key never passes through our servers: it only travels in the invitation code that you pass on yourself to the invited person. We therefore cannot read what you share. Our server only keeps what is needed to make sharing work, with no readable content:

• the session identifiers of the owner and of invited people, and their role (owner, part-loaner, instructor, rider, vet with read-only access);
• for each encrypted item: its type (for example care, session, document), the date it was last modified, who modified it and whether it was deleted;
• pending invitations: their identifier, a fingerprint of their secret, the role offered and their expiry date.

The people you invite see the shared content and what other members add to it; you see what they add. For what they do in their private life, the GDPR does not apply to them; a professional who uses sharing for their work is responsible for their own use.

4.6 Counters and subscription status on our servers

On our servers (Google Cloud Firestore, in Europe), no text or photo is stored for Jo. Linked to your session identifier are: counters of requests made to Jo (per day and per type), which apply the usage limits, and your subscription status (active or not, end date), stored so as not to ask RevenueCat for each request and checked again regularly.

The server's technical logs show the type of event (answer sent, limit reached, error), without the content of requests. As with any online service, Google Cloud request logs also record the IP address and device type behind each call.

4.7 Suggestions, bugs and reports

If you write to us from the app (suggestion or bug), we receive: the text you write, the category, the app version, the phone's system (iPhone or Android), the language and your session identifier. If you report an answer or a programme from Jo, we receive the reported answer (a limited excerpt), the feature concerned and the reason chosen, never your own messages or photos; the report window tells you so and asks for your agreement before sending. These messages contain neither your name nor your email address: we cannot reply to them. Do not include information about your health or anyone else's.

4.8 Usage statistics, without content

To know which screens and features are really used, and to fix what gets in the way, the app sends usage statistics without content, like Devolim's other apps. Google Analytics for Firebase receives, with a pseudonymous instance identifier: the screens displayed (under a generic name); the features used, without their content (for example: care added, session finished, request to Jo, purchase started); numbers (for example the number of horses); whether a subscription is active; and the information Google Analytics collects automatically (phone model and system, language, approximate country, sessions, first open). Never sent: a horse's name, a note, a photo, a care item or product, a text, a town or a position. Advertising is always refused in the Google Analytics consent settings, and the advertising identifier is not collected. The "Delete my data" function erases the instance identifier. You can object to these statistics by writing to us (section 14).

4.9 Crash reports

When the app crashes or hits an error, Firebase Crashlytics receives a technical report: error trace, phone model, system and app version, and an installation identifier specific to Crashlytics. By design, these reports do not contain your horses' names, your notes, your photos or their care.

4.10 Purchases

Payments are collected by Apple (App Store) or Google (Google Play): we see neither your identity nor your bank details. RevenueCat, our subscription management provider, receives your session identifier and, during a purchase or restore, the transaction information sent by the Platform (product, dates, store country and currency, receipt), in order to open and verify your Premium access.

4.11 Dictation

If you dictate a session account, speech recognition is provided by your phone's system (Apple or Google). Depending on your phone and its settings, it runs on the device or on Apple's or Google's servers, under their own responsibility. We never receive the recording of your voice. The resulting text stays on your phone, unless you ask Jo to turn it into the session record (point 4.3).

4.12 Messages to support, calls and links

If you email us, we use your address and your message only to reply to you. If a refund has to be made directly by the publisher (terms of sale, articles 6 and 8), the bank details you give us are used only for that refund and are deleted once the transfer is made; only the accounting record is kept. When you call your vet or an emergency number from the app, the call is made by your phone itself, on your initiative: the app does not send us these numbers and alerts no one. A contact is chosen through the system picker, which only passes the chosen contact to the app. Links to external websites open in your browser, under those websites' responsibility.

5. Your horse's health and sensitive data

A horse's health is not "health data" within the meaning of article 9 of the GDPR, which only covers people. Linked to you, this information is still personal data, which we protect as such: it stays on your phone, and only what is strictly useful goes to Jo, without names. The app asks you no questions about your own health. If you nevertheless write information about your health or someone else's to Jo, in the journal or in a report, it falls under article 9: it is only sent on your explicit consent (consent for Jo, agreement before a report), is not stored on our servers for Jo, and we ask you to avoid it.

6. Purposes and legal bases

Providing your data is optional and is not required by any law. Without it, some features cannot work (for example Jo without your consent, the weather without a town, sharing without a connection); the rest of the app works.

7. Recipients and processors

Your data is only accessible to the publisher, to the people with whom you share a horse (for what you share) and to the providers below, who act on its behalf as processors (article 28 of the GDPR), except Apple and Google for the sale, and Open-Meteo for the weather, who act under their own responsibility.

Each of these providers is contractually bound to ensure the confidentiality and security of the data. No data is sold, rented or transferred to third parties. We would only disclose data to an authority on a legally founded request; we could not hand over the content of what you share, which we cannot read.

8. Transfers outside the European Union

Our server functions and our database are located in the European Union. Some data may nevertheless be processed outside the European Union:

• in the United States, by OpenAI for Jo's answers and photo reading, by RevenueCat, by Google for its global services (Firebase Authentication anonymous sign-in runs from the United States; App Check, Crashlytics and Analytics may process data outside Europe), and by Cloudflare for delivering the website. These transfers are covered by the EU-US Data Privacy Framework where the recipient participates in it, and otherwise by the standard contractual clauses adopted by the European Commission, supplemented where necessary by additional measures;
• in Switzerland, by Open-Meteo, a country covered by a European Commission adequacy decision.

You can obtain a copy of the applicable safeguards by writing to us.

9. Retention periods

Automatic deletions on our servers take place when the period ends, usually within the following days.

10. What we do not do

• No advertising, either in the app or on the website.
• No advertising tracking: the advertising identifier is not collected, and the app does not ask for Apple's tracking permission (App Tracking Transparency), which it does not need.
• No geolocation: the app does not use GPS. Only the town you choose for the weather and your phone's time zone (for the app's sky) are used.
• No access to your address book: a contact is chosen with the system picker.
• No access to your photos other than those you choose.
• No selling, renting or exchange of data, no data brokers.
• No training of an artificial intelligence with your data.
• No retrieval of FFE or IFCE data about you or your horses: what the app knows, you enter.
• No profiling, and no sharing with an insurer, a horse dealer or a bank.

11. Automated processing and artificial intelligence

Jo is an artificial intelligence: its answers, programmes and photo readings are produced automatically, and are labelled as such in the app. The app and the server also automatically detect certain warning words, to prompt you to call your vet. This processing takes no decision producing legal effects concerning you or significantly affecting you within the meaning of article 22 of the GDPR: you remain free to follow what is suggested or not, and nothing is recorded without your validation.

12. Phone permissions

• Camera and photos: to take or choose a photo of your horse or a document, when you decide. The photo is copied and encrypted in the app.
• Microphone and speech recognition: to dictate a session account, if you use it (point 4.11).
• Contacts: to choose your vet or farrier from your contacts, with the system picker. Nothing is sent.
• Face ID or fingerprint: for the lock, if you enable it. Recognition is done by the system; the app receives neither your face nor your fingerprint.
• Notifications: for care, session, competition, calendar event and backup reminders.
• Exact alarms and restart (Android): so that reminders arrive on time and are rescheduled after a restart.
• Background audio: so that the session player keeps giving timings with the screen locked.
• Internet: for Jo, the weather, sharing, messages to the team, purchases, crash reports and usage statistics.

The app does not use location. You can withdraw these permissions at any time in your phone's settings.

13. Security

• Your content is encrypted on the phone (AES-256-GCM, using the system's encryption functions), and the key is kept in the system's secure keychain.
• What you share is end-to-end encrypted, with a key that never passes through our servers.
• The backup is encrypted with your password, which we do not know.
• Optional lock by Face ID, fingerprint or code.
• All exchanges with our servers are encrypted (HTTPS).
• Our servers only accept requests from the genuine app (App Check); access to the database is limited, item by item, to the members of a share only; secret keys stay on the server; usage limits protect the service.
• Data kept on our servers is deleted automatically when its period ends. Access to administration tools is reserved for the publisher.

No system is invulnerable: protect your phone with a code and keep its system up to date.

14. Your choices and your rights

At any time, in the app, you have:

• withdrawal of your consent for Jo (Settings, Privacy);
• editing or deleting any information, photo or horse, and stopping a share;
• a backup of all your data, and export of the record as a PDF;
• the "Delete my data" function (Settings). It deletes your content from the phone and, if your phone is connected to the internet, from our servers: your counters, your subscription status, your suggestions and reports, the shares you own (with all their encrypted items and invitations), and your participation in other people's shares; it also erases the statistics identifier and replaces your session identifier with a new one. What remains, with no content: subscription information at RevenueCat and at Apple or Google, as well as logs, reports and statistics already sent and what OpenAI may keep, which are deleted when their period ends (section 9). Without a connection, deletion on our servers is retried automatically each time the app is opened, until it succeeds.

In accordance with articles 15 to 22 of the GDPR, you have the right of access, rectification, erasure, restriction, objection and portability, the right to withdraw your consent at any time without affecting processing already carried out, and the right to give instructions about what happens to your data after your death (article 85 of the French Data Protection Act). These rights are exercised by email to contact.equiflow@devolim.fr. We reply within one month, which may be extended by two months for complex requests.

As we do not know your identity, we cannot find the data linked to your session by your name or email address: the app's tools above are the safest and fastest way. If you no longer have the app, give us the session identifier shown in Settings, Privacy, if you noted it: we will then erase what is linked to it. Otherwise, this data deletes itself at the periods in section 9. The steps are also on the Help and contact page. You can object to crash reports by writing to us; since they are not linked to any information about you, uninstalling the app remains the certain way to stop them being sent. Purchase information can also be managed with Apple or Google.

15. Data about other people

The contact details of your professionals (vet, farrier, dentist...) and of people close to you stay on your phone and are only sent to us if you share them. Only photograph a person with their consent, and hide on a document anything concerning third parties. The people you invite to a horse are identified on our servers only by their session identifier; what they add is encrypted like the rest of the share. If you are invited to another user's horse, its owner sees what you add to it.

16. Website

This website sets no cookies and uses no audience measurement tool. Fonts are hosted with the site: your browser does not contact any font, advertising or analytics service. The website is hosted by OVH and may be delivered through Cloudflare's network, which protects it against attacks and speeds up its display; these providers process, for these purposes only, the technical data of your visit (IP address, pages requested, date) for a limited period.

17. Minimum age and users aged 16 to 17

The app is reserved for people aged 16 and over, in every country where it is offered. Everyone states their age band when signing up; a person who states they are under 16 cannot continue, and nothing is recorded about them. We do not knowingly collect data about children under 16. This single threshold takes into account the age from which several countries allow a person to consent alone to an online service (article 8 of the GDPR: 16, for example, in Germany, the Netherlands, Poland and Ireland) and the terms of Jo's artificial intelligence provider for minors.

If you are 16 or 17: before you first use Jo, whose legal basis is your consent (section 6), and then before you subscribe, the app asks you to confirm that a parent or guardian agrees. This declaration, the version of the information shown and its date are recorded on your phone, not on our servers. Without it, nothing is sent to Jo and no purchase is started. Your data is processed like everyone else's, with no advertising or pushy commercial offers; only share your horse with people you know; you can erase everything at any time. A parent or guardian who thinks a child under 16 is using the app may write to us; "Delete my data" also erases their data from the phone and from our servers.

18. Security incident

In the event of a personal data breach, we notify the CNIL under the conditions of article 33 of the GDPR and, where it is likely to result in a high risk to your rights and freedoms, we inform you in the app or on this website, in accordance with article 34.

19. Complaint to the CNIL

If you believe, after contacting us, that your rights are not being respected, you may lodge a complaint with the French data protection authority (Commission nationale de l'informatique et des libertés): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or online at cnil.fr. If you live in another European Union country, you may also contact your local data protection authority.

20. Changes

This policy may be amended to reflect legal or technical developments. The date of the last update appears at the top of the page; substantial changes are flagged in the app and, if they affect your consent, it is asked for again. In the event of a discrepancy between the French version and a translation, the French version prevails.