This notice covers the pilot
ThoroughTrack is pre-release. It isn't in the App Store or Google Play yet. Before it is, a small number of yards will use it in an invitation-only pilot. This notice describes how the app will work during that pilot, including features we're still building, which we mark as planned. We'll review and update it before public launch.
Summary
- Who we are. ThoroughTrack Limited makes the ThoroughTrack app for racing yards and runs this website. Privacy questions go to hello@thoroughtrack.ie.
- What we collect. Your name, email address and role in a stable; the yard records you and your team enter (horses, exercise and health); and the limited technical information needed to keep the app secure and working.
- What we don't do. We don't sell your data, show adverts, use advertising identifiers or track whether you open our emails. This website sets no cookies and runs no analytics.
- Where it's kept. Our main database, sync service and backups are hosted in EU regions. Data on your phone is stored in an encrypted database.
- Your stable decides who sees what. Each stable controls who joins and which horses each person can see. For GPS location data (planned) the stable is legally responsible as the controller; see our location data explainer.
- Your rights. You can ask for a copy of your data, have it corrected or deleted, and complain to a data protection authority. To close your account, see Delete your account.
Who we are
ThoroughTrack is made by ThoroughTrack Limited, which is building the app in Ireland for racing yards in Ireland and the UK. In this notice, “we”, “us” and “our” mean ThoroughTrack Limited.
This notice covers:
- the ThoroughTrack app for iPhone, iPad and Android, during its pre-release pilot;
- this website; and
- emails you send to us.
For anything about your personal data, or for help with the app, email hello@thoroughtrack.ie.
Who is responsible for your data
Data protection law separates a controller, which decides why and how personal data is used, from a processor, which handles data on a controller's behalf. ThoroughTrack is used by stables, so who is responsible depends on the data.
Location data from GPS recording (planned)
When GPS route recording arrives, each stable that switches it on is the controller of the location data its riders record. Before it can be switched on, the stable must record its own lawful basis, tell and consult its staff, choose how long the data is kept, and name a contact for questions and objections. ThoroughTrack Limited provides the app and completes a product-level data protection impact assessment (DPIA) before any stable can use the feature. Read more in our location data explainer.
Other stable records
Horse, exercise and health records are part of the stable's business. The stable decides who can see and change them. We're confirming the formal controller and processor roles for these records with our advisers and will set them out here before public launch. In the meantime, you can send any request about them to us and we'll deal with it or point you to the right person at your stable.
Your account, this website and messages to us
ThoroughTrack Limited is responsible for running your ThoroughTrack login, for this website and for the emails you send us.
What we collect
Your account and stable membership
- Your name and email address.
- Your password, which our sign-in provider stores in scrambled (hashed) form, not as readable text.
- The stables you belong to, your role (Stable Admin, Trainer, Yard Manager or Staff) and the horses you're allowed to see.
Yard records
- Horse profiles, exercise sessions and health checks such as temperature, weight, feed eaten, heart rate, respiratory rate and notes. Shoeing, medication and vaccination records are planned.
- Who created each record, and when. Corrections (planned) will also record who made them and when, and keep a revision history so the record can be trusted.
- Anything you type into notes. Most records are about horses, but notes can mention people, so please only write what's needed.
- Photos (planned). The first release supports photos of horses only, and asks you to confirm no identifiable person is shown.
Location (planned)
Precise location is collected only while a rider has an exercise recording running, which they start themselves. It's never collected at any other time. See the location data explainer for what's stored, who can see it and for how long.
Owner reports and sharing (planned)
If your stable publishes reports to owners or creates share links, we store the report, who published it, the link's expiry and a minimal record of when a report was accessed.
Device and technical information
- Identifiers for your device and app installation, used to secure offline access to your stable's data.
- A push notification token, once notifications are available (planned).
- Error reports containing only internal IDs, counts, timings and error codes. They never include names, notes, health values or locations.
Messages to us
If you email us, we receive your email address and whatever you include in the message. Emails applying for the pilot are covered in Applying for the pilot.
What we don't collect
We don't use an advertising identifier, we don't track whether you open or click our emails, we don't access your contacts or microphone, and we don't collect your location outside an exercise recording you've started.
How we use it and why
We only use personal data for the purposes below. Data protection law requires a lawful basis for each.
| What we do | Data used | Lawful basis |
|---|---|---|
| Provide the app: your login, your stable's records, syncing between your team's devices and offline use | Account, membership, yard records, device information | Contract with you or your stable. Where our agreement is with your stable rather than you, our and the stable's legitimate interest in providing the service you use. |
| Keep the app secure and working, fix errors and keep a record of important changes | Device information, error reports, audit records | Legitimate interests in running a secure, reliable service |
| Send sign-in, invitation and password-reset emails, and notifications once available | Email address, push token | Contract, or legitimate interests where the agreement is with your stable |
| Consider pilot applications, reply to them and, if your yard takes part, arrange the pilot | Whatever your application email contains: usually your name, yard, country, number of horses, devices, how you record work today and your contact details | Legitimate interests in choosing pilot yards and replying to you; steps you ask us to take before an agreement |
| Answer your questions and support requests | Your messages and the details you give us | Legitimate interests in helping you |
| Deliver and protect this website | Request data such as your IP address, browser and the page requested, handled by Cloudflare | Legitimate interests in running a secure website |
| Record exercise routes (planned) | Location, rider link | Chosen by your stable as controller: legitimate interests, legal obligation, contract or explicit consent. Consent is never assumed in employment. |
| Respond to data protection requests and meet other legal duties | Whatever the request or duty needs | Legal obligation |
We don't use your data for advertising, we don't sell it, and we don't make automated decisions about people that have legal or similarly significant effects on them. Health alerts (planned) are flags about horses, based on ranges your stable sets; there are no built-in medical thresholds.
Search and AI
You'll be able to ask questions in plain English, such as “Who is due a flu vaccine?”. The question matcher is built but not yet released, and the reports it opens are planned. Questions are matched to reports by fixed rules in the app. There's no AI model involved, and it works offline.
The design includes an optional AI search feature, but it's switched off and no AI provider has been chosen. No AI provider processes your data today. Location routes and rider details are excluded from AI features by default. If we ever propose to switch AI on, we'll update this notice first.
Service providers
We use the providers below to run ThoroughTrack. Each receives only what it needs for its job. Some will only be used once the related feature launches.
| Provider | What for | What they receive |
|---|---|---|
| Supabase | Database, sign-in and file storage (EU region) | Your account details and your stable's records |
| PowerSync | Syncing records between our servers and devices (EU region) | The records your devices are allowed to sync |
| Backblaze B2 | Off-site backups (EU region) | Encrypted backups that Backblaze can't read |
| GitHub | May run our automated backup process | Data passing through on its way to encrypted backup storage |
| Sentry | Error reports from the app | Internal IDs, counts, timings and error codes only; never names, notes, health values or locations |
| Resend | Sign-in, invitation and password-reset emails | Your email address and the message, with open and click tracking switched off |
| Expo, Google Firebase Cloud Messaging and Apple Push Notification service | Push notifications (planned) | A device token, generic alert text and an internal reference; never health values or locations |
| Esri ArcGIS | Satellite map imagery (planned) | Map-tile positions for the area you're viewing and network details such as your IP address; never your route or any horse, rider or stable ID |
| Microsoft (Microsoft 365 email) | Receiving email sent to hello@thoroughtrack.ie, including pilot applications and privacy requests | Your messages and any attachments |
| Cloudflare | Hosting this website | Technical request details such as your IP address and browser type |
We're completing our review of each provider's data processing terms before public launch and will update this list if anything changes. Apart from these providers and the people in your stable who have access, we don't share your data unless the law requires us to.
Our own team has no standing access to your stable's records. The app is designed so that support access needs a time-limited grant (no more than 60 minutes) approved by your Stable Admin.
Where your data is stored
Our database, sign-in service, sync service and backups are hosted in EU regions. Records you can access are also stored in an encrypted database on your own device so the app works without signal.
Some providers, such as push notification services, error reporting, email, maps, website hosting and GitHub, may process limited data outside the EU and UK. We're confirming the safeguards each uses for international transfers, such as Standard Contractual Clauses, before public launch, and will describe them here.
How long we keep it
We keep personal data only as long as we need it. Where we have set periods, they're below.
- Your account
- For as long as you have an account. When you delete it, your name, email address and login are erased. Records you created stay with the horse under a pseudonymous ID instead of your name. That isn't the same as anonymous, because your stable may still be able to work out who made a record from its context.
- Stable records
- For as long as the stable uses ThoroughTrack. If a stable's only Stable Admin closes the stable, its data is deleted after a 30-day grace period, unless the law requires us to keep something.
- Location data (planned)
- The rider link is kept for 90 days by default (the stable can choose 30 to 365 days). Route coordinates are kept for 365 days by default (the stable can choose 365 to 3,650 days; anything over 365 days needs a necessity assessment, renewed every year).
- Owner share links (planned)
- Expire after 24 hours, 7 days (the default) or 30 days, and can be revoked at any time.
- Notification records
- 30 days.
- Report access logs and audit records
- 365 days.
- Backups
- Encrypted backups are kept for 365 days, plus a 30-day safety margin, and then deleted. We also keep a minimal record of deletions (internal IDs and dates, no content) so that restoring a backup can never bring deleted data back.
- Data on your device
- Until you sign out, which wipes it. If your access to a stable is removed, that stable's data is removed from your device the next time it connects. If the app can't check in with our servers for 30 days, it locks the stable's data until it can.
- Emails to us
- For as long as we need to deal with your enquiry and any follow-up, and to show how we handled a data protection request.
- Pilot applications
- If your yard doesn't take part, up to 12 months after our last contact with you, then deleted. If it does, as long as needed to run the pilot, after which your account and stable records are kept as described above.
- Error reports
- For the shortest period we need to investigate and fix problems.
How we protect it
- Encrypted on your device. Stable data stored on a phone or tablet is kept in an encrypted database and is left out of Android device backups. Signing out wipes it, and the app warns you first if anything hasn't synced yet.
- Access checked on the server. Each person can only reach the stables they belong to and the horses they're allowed to see.
- App lock (planned). Unlock with Face ID, fingerprint or your device passcode. The app locks again after 15 minutes of inactivity.
- Protected backups. Backups are encrypted and write-protected, so they can't be changed or deleted early.
- Minimal error reporting. No names, notes, health values or locations leave the app in error reports.
- No standing staff access to your stable's records, as described above.
No system is perfectly secure. If a personal data breach affects you, we'll tell you and the relevant authority where the law requires.
Your rights
Under the GDPR and UK GDPR you have the right to:
- get a copy of your personal data;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to how we use it, including where we rely on legitimate interests;
- receive data you've given us in a reusable format; and
- withdraw consent at any time, where consent is the basis.
To use any of these rights, email hello@thoroughtrack.ie, ideally from the address linked to your account. We'll check it's really you before acting, and we'll reply within one month. If a request is complex, the law lets us extend that by up to two further months, and we'll tell you if we need to.
The app is being built so that you can download a copy of your own data as JSON or CSV, and a Stable Admin can separately export the stable's records (planned). To delete your account, see Delete your account.
If your request is about records your stable controls, such as location data, we may need to involve the stable, and we'll tell you if we do.
Complaints
We'd like the chance to put things right, so please contact us first. You can also complain to the data protection authority where you live or work. In Ireland that's the Data Protection Commission, and in the UK it's the Information Commissioner's Office.
Applying for the pilot
There's no form on this website. To apply for the pilot, you email us at hello@thoroughtrack.ie, usually using the template on the pilot page.
- What we receive. Your email address and whatever you put in the email. The template asks for your yard name, the trainer's name, your country, roughly how many horses you have in training, the devices your team uses, how you record work today and the best way to contact you. Please don't send horse health records, staff details or spreadsheets at this stage.
- Why. To consider your application, reply to you and, if your yard takes part, arrange the pilot with you. We rely on our legitimate interests in choosing pilot yards and on steps you've asked us to take before any agreement. We don't add you to a mailing list or use your details for marketing.
- Who sees it. The ThoroughTrack team and our email provider, Microsoft (see Service providers). We don't share applications with anyone else.
- How long we keep it. If your yard doesn't take part, we delete your application and our correspondence about it within 12 months of our last contact with you. If it does take part, we keep it for as long as we need it to run the pilot.
- Your rights. You can ask for a copy of what we hold, ask us to correct it, withdraw your application or ask us to delete it at any time by emailing hello@thoroughtrack.ie. Your other rights are set out in Your rights.
This website and cookies
This website is a set of static pages. It sets no cookies, runs no analytics and contains no tracking pixels, third-party scripts, embedded content or externally loaded fonts. There are no forms; email links open your own email app.
The site is hosted by Cloudflare. To deliver pages and protect the site from abuse, Cloudflare necessarily handles technical details of each request, such as your IP address and browser type. We don't use this to identify you.
If you apply for the pilot by email, see Applying for the pilot for how we handle your details.
Children
ThoroughTrack is a work tool for racing yards and isn't designed for children. Accounts are created by invitation from a stable. If you think a child's data has been added, please email hello@thoroughtrack.ie and we'll look into it.
Changes to this notice
This notice covers the pre-release pilot. We'll update it before ThoroughTrack launches publicly, and whenever the way we handle personal data changes, for example when a planned feature goes live. The date at the top shows when it was last updated. If we make a significant change, we'll tell you in the app or by email before it takes effect.
Contact us
- Company
- ThoroughTrack Limited, a company registered in Ireland (company number 819213)
- Registered address
- Garrauncreen, Ballyglunin, Tuam, Galway, H54 K244, Ireland
- Privacy questions, requests and help with the app
- hello@thoroughtrack.ie