Privacy policy

Effective 16 September 2026. Worldweaver Ltd is the data controller.

What we collect

• Email, name, phone, date of birth, profile photo — to identify you, contact you, and personalise the app.
• Yard, horse, field, treatment, visit, vehicle and feed records you create — to provide the service you signed up for.
• Push notification tokens (web, iOS, Android) — to send the reminders and messages you opted into.
• Subscription tier and Stripe customer reference — to bill paid plans. We never see your card number; Stripe handles that directly.
• Login times, IP addresses, basic logs — to detect abuse, debug problems, and keep the service secure.

Where it lives

All data is stored in Microsoft Azure's UK South region. The database is Azure SQL; uploaded images go to Azure Blob Storage in the same region.

Who can see your data

You and people you've invited to your business (Owner / Admin / Member roles). Practitioners you invite, only for records where they're named. Worldweaver staff only when needed to operate or debug. Sub-processors: Microsoft Azure (hosting), Stripe (payments), Apple Push Notification service and Firebase Cloud Messaging (push delivery). Plus an AI assistant you connect yourself, if you choose to — see below.

Connected AI assistants

Horsepower runs an MCP server so you can connect an AI assistant and ask it about your yard. This is off unless you set it up — no data goes to any AI provider until you deliberately connect one. When you do, what you ask about is sent to the provider you chose, governed by their terms rather than ours; the connection carries only your own access and can't reach records you couldn't open yourself; it is read-only unless you turn writing on, and no tool can delete anything. Each connected assistant has its own credential, listed in your profile with a Disconnect button. Because you are directing your own data to a provider you picked, that provider is not one of our sub-processors and we cannot retrieve or delete what they have retained.

How long we keep it

For as long as your account is active. When you delete your account we remove your personal data within 30 days, except where we're legally required to keep something (e.g. invoices for tax purposes).

If we close down

If Horsepower ever shuts down we will email every account holder at least 60 days beforehand and keep the service readable throughout so you can get your records out (see section 8 of the terms, including refunds). At the end of that period we delete the personal data we hold, except anything the law requires us to keep. Your data may transfer to a buyer or successor if the business is sold, governed by this policy until they tell you otherwise. We would not sell your data as an asset to a third party unrelated to running Horsepower.

Your rights

Under UK GDPR you can ask us to provide a copy of your data, correct it, delete it, restrict processing, or object to processing. Email support@worldweaver.com. You can also lodge a complaint with the UK Information Commissioner's Office.

Cookies and similar

We use a single authentication token (stored locally in your browser or app) to keep you signed in. The Azure load balancer sets a small affinity cookie. We don't use third-party tracking or advertising cookies.

Photos, video and moderation

Photos and video are stored in Azure Blob Storage in the UK and shown only to the people you shared them with — your yard, your family group, or individuals you name. They are never public, never indexed by search engines, and never used to train an AI model or shown to an advertiser. We do not pre-screen uploads and do not routinely look at them, but we reserve the right to access, view, copy, retain and delete any content in the service where we reasonably need to investigate a report, check compliance with our terms, protect someone and in particular a child, comply with the law or a police request, or keep the service secure — without notifying you first where that would prejudice an investigation or put someone at risk. Access is limited to the staff who need it and is recorded. The owner and admins of a yard can separately see and remove content posted into that yard; a member's private diary entries are the exception.

Children

Horsepower is a private yard-management system, not a social network: no public profiles, no discovery, and no way for a stranger to find or contact anyone. Nobody under 18 holds an account in their own right. A child appears only where a parent or guardian has added them to a family group — as a profile with no login, or an account the parent sets up and supervises — and that parent or guardian consents, can see and control the data, and can delete it at any time. Photographs of a child may only be uploaded with the parent's or guardian's permission and must show ordinary equestrian activity; anyone can ask us or the yard to remove an image of them or their child, and we will.

Contact

Worldweaver Ltd, United Kingdom · support@worldweaver.com