Privacy Policy

Information we collect

The following categories describe information collected during the preceding 12 months and our current practices. We collect information directly from you, automatically from your browser or device, from our authentication provider, and from property operators, listing contributors, and publicly available business or property sources. Not every category is collected from every visitor.

Identifiers and customer-record information

Names, email addresses, phone numbers, postal addresses, account identifiers, and related profile and contact information. We receive these when you create or update an account, send a listing request, or contact us. We use them to authenticate you, manage accounts, respond, and maintain listings. Authentication, hosting, database, and email providers process the information needed for those tasks.

Commercial and professional information

Property or business names, your role as a property contact, listing inquiries, private listing-representation claims and decisions, descriptions, amenities, pricing information, and communications about our services. We use this information to review, publish, correct, and support listings and to verify an authorized business relationship. Hosting, database, authentication, and email providers process it. Approved listing details are public, but claim identity and history are not included in public listings. Horse Layover does not process lodging bookings or collect payment-card details.

Place reviews and reports

Reviews you submit include your rating, written experience, display name from your profile, and optional stay date. Approved reviews can be public. Reports about reviews and moderation decisions are private administrative records; they are not shown with public reviews. Avoid sharing personal details in review text you do not want public.

Internet or other electronic network activity

IP addresses, browser and device information, cookie or session identifiers, pages and links visited, referring pages, timestamps, searches and filters, listing interactions, performance measurements, and error or security events. Our infrastructure and analytics providers process these to deliver, secure, measure, and improve the site. A search URL may contain the location or words you entered.

Geolocation information

Places, addresses, and coordinates you enter or select for searches, listings, and route endpoints, and approximate location derived by providers from an IP address. Location input can identify a home or another precise place. Mapbox receives search text and route coordinates to provide maps, suggestions, and directions. Listing coordinates are stored by our hosting and database providers and can be public.

Visual information

Account profile images and listing photos you or a contributor provide. We use authentication providers for profile images and storage and hosting providers for listing images. Approved listing photos are publicly accessible. We do not use photos for facial recognition or biometric identification.

Sensitive personal information

Depending on the sign-in method, our authentication provider processes login credentials or access tokens. Precise location information, when it relates to you, may also be sensitive personal information under California law. We use this information only as needed to provide requested account, mapping, and listing services, maintain security, and for other purposes permitted by California law, not to infer sensitive characteristics about you.

These categories overlap. We do not ask for Social Security numbers, government ID documents, financial-account credentials, health records, biometric identifiers, or information about protected characteristics. Avoid including unnecessary sensitive information in messages, listing descriptions, claim explanations, or photos. Listing representatives should not send identity documents, deeds, or other legal-title records.

How we use and disclose information

During the preceding 12 months, we have disclosed the categories above to providers for the business purposes described with each category: operating and securing the service, managing accounts, answering communications, reviewing and publishing listings, providing maps and routes, and measuring traffic and performance. Providers and their functions are described below.

Public listings. Published listings may show a property's name, address, precise map location, contact name, phone number, email address, website, photos, pricing, and description. Visitors, search engines, and other parties can access or copy this information. Submit only information you are authorized to provide for publication. Email us to request a correction or removal; account deletion alone does not remove a listing. We cannot directly erase copies held independently by other websites.

Listing requests and email. Our listing-request form prepares a message in your own email application. We receive the message and any photos you attach only when you send it. Your email provider and ours process those communications. Do not assume a submitter's contact details will remain private if they are included as public listing contact information.

Listing representation. A signed-in person may privately ask to represent an existing listing. We store the account/place relationship, claim state, explanation, decision reasons, necessary private administrative notes, and a limited audit history. Admins review claims and may contact the claimant for a basic confirmation. Approval records authorized representation in Horse Layover; it is not a legal-title determination, public listing verification, or permission to edit the listing. We do not publish claimant identity or claim history.

Public reviews. Published place reviews display the rating, written experience, name, and any stay date supplied. Visitors and search engines may copy public text. Deleting an account changes the byline on retained reviews to "Deleted user", but does not edit their text.

We may disclose information when reasonably necessary to comply with law or legal process, protect people and the service, investigate misuse, or establish or defend legal claims. If the service is involved in a merger, acquisition, or asset transfer, information may be disclosed to advisers and a successor subject to appropriate confidentiality protections and applicable law. We may also disclose information at your direction.

No sale or cross-context advertising. We do not sell personal information for money or other valuable consideration, or share it for cross-context behavioral advertising as those terms are defined by California law. We have not done so during the preceding 12 months. This applies to every category above and to all users, including users under 16. We do not offer a financial incentive in exchange for personal information.

Mobile apps

Our mobile apps for iOS and Android provide the same directory, mapping, account, review, and reporting features described in this policy. The mobile apps begin location-based discovery with a general United States view. They request your current device location only when you choose the current-location feature and grant the operating system permission.

Location and maps

Mobile location access is optional and foreground-only. On iOS, this is called When In Use access. We do not request background location. You can deny the request and continue browsing by state, or revoke permission later in your device settings.

If you grant permission, the app may use a precise device location to show nearby Layovers and populate a route starting point. Mapbox receives coordinates and technical request information needed to provide maps, place search, and routes. We do not send your device location to the Horse Layover application database, intentionally associate it with your account, or save it in the app's persisted public-data cache.

Accounts, reviews, and reports

If you sign in on mobile, Clerk processes your email address, authentication information, session, and related security information. Reviews and review reports you submit are sent to Horse Layover and associated with your signed-in account for moderation, duplicate prevention, and account-lifecycle handling. Published reviews show the public name selected for your profile, not your account email.

On-device storage

The app stores a public Layover archive so directory information remains available offline. It may also cache public listing details and public reviews for up to 24 hours. Favorites and hidden-reviewer preferences are stored only on that device and are not synchronized to your Horse Layover account. Clerk stores session tokens using protected device storage.

The persisted public-data cache does not include private review responses, Mapbox search results, route geometry, or device coordinates. The offline archive remains on the device until it is refreshed, app data is cleared, or the app is uninstalled. Device-only preferences remain until you remove them, clear app data, or uninstall the app.

Crash diagnostics and tracking

The mobile apps do not use a product-analytics or advertising SDK, and we do not use mobile activity for cross-app tracking. In non-development builds, Sentry automatically receives crash and error reports so we can diagnose reliability problems. We configure Sentry not to send default personal information or account identity and remove query strings and fragments from request and navigation breadcrumbs because they can contain search terms, coordinates, or tokens.

Crash reports and providers' ordinary technical logs may include app version, device or operating-system details, timestamps, network information, and other diagnostic metadata. Horse Layover does not intentionally associate crash reports with your account. These operational diagnostics are separate from product analytics, advertising, and tracking.

Service providers and Google sign-in

Clerk: authentication and account management

We use Clerk as our authentication and account-management processor. Clerk processes account information, sign-in credentials or tokens, authentication sessions, and related device and security information to provide these services on our behalf. We keep a synchronized profile containing your account ID, name, email address, display name, profile image URL, and account timestamps.

See Clerk's Privacy Policy and Data Processing Addendum. Clerk's processing of customer data is governed by its agreements with us; its privacy policy also explains its own separate practices. Contact Horse Layover about your account data and privacy rights rather than assuming that a request to Clerk deletes all information we hold.

Google sign-in, when available

If we offer Google sign-in and you choose it, Google provides Clerk and us with the account identifier and basic profile information authorized in that flow, such as your name, email address, and profile picture. We use this information to create or connect your account and authenticate you. Google sign-in is optional and this description does not mean it is already available or was used during the preceding 12 months.

We do not receive your Google password. We do not request access to Gmail messages, Google Drive files, contacts, or calendars for sign-in. Google processes your interaction under Google's Privacy Policy. You can manage the connection in your Google Account connections. Disconnecting Google does not by itself delete your Horse Layover account, and deleting your Horse Layover account does not delete your Google account.

Maps, infrastructure, mobile delivery, and analytics

• Mapbox receives location searches, selected coordinates, and technical request information to supply maps, geocoding, and directions on the website and in the mobile apps. Its mobile SDK may also process location and SDK-usage information needed to operate its services. See Mapbox's privacy information.
• Vercel hosts the website and provides usage analytics and performance monitoring. See Vercel's Privacy Notice.
• Microsoft Azure stores and delivers listing photographs. Database and hosting providers store listings and synchronized account profiles. See Microsoft's Privacy Statement.
• Expo and EAS provide mobile app builds, delivery, and over-the-air updates and may process app, device, update, and technical delivery information for those functions. See Expo's Privacy Policy.
• Sentry receives crash and error diagnostics from non-development mobile builds. We use it for app reliability, not product analytics or tracking. See Sentry's Privacy Policy.
• Apple Maps and Google Maps can receive a listing destination when you choose to hand off navigation to one of those external apps. The selected provider processes the interaction under its own privacy policy. See Apple's Privacy Policy and Google's Privacy Policy.
• Google Analytics, when configured, measures visits and interactions with the public website. It is not integrated into the mobile apps. See how Google uses information from sites that use its services.
• Email service providers deliver and store listing requests, attachments, support messages, and privacy-request correspondence.

We use providers for the specific functions described here, not to sell your information or run cross-site advertising. Providers may also process technical or service-use information under their own notices. Their linked notices do not replace our responsibility for the personal information we collect and disclose.

Cookies, website analytics, and browser signals

Authentication uses cookies or similar technologies to recognize sessions and keep accounts secure. Google Analytics may use cookies and identifiers to measure visits. Analytics can include page visits, referral information, listing views, searches, selected filters, contact-link clicks, review and listing-representation interactions, and performance information. We do not intentionally send contact-form message contents, sign-in credentials, entered route addresses, review text or ratings, report reasons, account identifiers, or private claim history to Google Analytics. Our custom page-view reporting removes query strings and private dynamic review path segments. This does not prevent request URLs or technical metadata from reaching hosting, mapping, or authentication providers.

Browser local storage remembers appearance and optional feature preferences. Public place-map data is cached for up to seven days before it is treated as expired; expired entries are removed when the cache is next read. Preferences remain until changed or cleared. We do not store Mapbox route geometry or location suggestions in this cache.

You can clear site data or block cookies in your browser, although doing so may affect sign-in and preferences. Google offers a Google Analytics opt-out browser add-on for supported browsers. That add-on does not stop all site logging, mapping requests, or other providers' processing. We do not currently offer a website analytics consent or opt-out control.

Do Not Track and Global Privacy Control. Our site does not currently change its behavior automatically in response to a browser Do Not Track signal or a Global Privacy Control signal. Our no-sale and no-cross-context-sharing policy applies whether or not you send a signal; there is no sale or sharing to opt out of under that policy. These signals do not currently disable analytics, essential services, or authentication. Third-party services may collect information about your activity over time and across websites according to their own settings and notices; browser controls and this disclosure are not a substitute for any opt-out mechanism required by law.

Retention and account deletion

We retain personal information for the time reasonably necessary for the purposes described in this policy, taking into account the information's sensitivity, the service you request, security needs, unresolved disputes, and legal obligations. We use the following criteria rather than promising a single deletion period for all systems:

• Account identifiers and profile information: for the life of the account and as needed to complete an account-deletion request, resolve account issues, and meet applicable legal or security requirements.
• Listing, business-contact, location, and photo information: while needed to review or maintain an accurate directory listing, handle corrections or removal requests, and resolve related issues. An active listing may remain published after its contributor deletes an account.
• Listing-representation records: minimal account, place, state, and version information while the relationship or a support restriction remains relevant. Terminal claim explanations and private notes are scrubbed after 180 days. Ownership audit records are deleted after 365 days, idempotency operation metadata after 30 days, and submission-rate ledger events after 24 hours. A deletion guard containing a pseudonymous digest of the Clerk account ID, not the plaintext ID, is retained for 365 days. The digest remains personal information that may be linkable; it is not anonymous.
• Messages and attachments: while needed to respond to the inquiry, administer a listing or request, document the correspondence, and address legal or operational needs.
• Place reviews and reports: deleting your account removes reviews that were never published, private decisions and reports attached to your reviews, and reports you submitted. Reviews published at least once can remain with the byline "Deleted user", even if later unpublished or removed. Their original text remains and might still identify you; deleting your account does not erase copies made elsewhere.
• Network activity, analytics, and security information: for the configured provider retention periods and as needed to measure service performance, investigate incidents, and prevent abuse. These periods depend on the service and the purpose; account deletion does not automatically clear provider logs or analytics.
• Authentication secrets and tokens: for session, account-recovery, and security purposes under the authentication provider's applicable lifecycle and retention practices.
• Route inputs and browser storage: route calculations run in your browser, and we do not save Mapbox Directions responses to our application database. Route and search URLs can remain in browser history, copied links, or provider request logs. Website public-place cache data expires after seven days; website preferences remain until changed or cleared.
• Mobile app storage: cached public listing details and public reviews expire after 24 hours. The public offline Layover archive remains until refreshed, app data is cleared, or the app is uninstalled. Device-only favorites and hidden-reviewer preferences remain until removed, app data is cleared, or the app is uninstalled. Clerk-managed session tokens follow the authentication provider's session and security lifecycle.
• Privacy-request records: where the CCPA applies, we retain a record of the request and our response for at least 24 months to demonstrate compliance, not for unrelated marketing.

Copies may remain in backups or caches until overwritten, deleted, or expired under their applicable lifecycle. A cached copy is not a promise of a specific source-data retention period. We will handle deletion requests and any permitted exceptions under applicable law, including restrictions on information retained solely for compliance or recovery.

Deleting an account is not the same as deleting every record

You can delete your account through Account / Manage account / Security / Delete account. See our account-deletion instructions. Deleting the Clerk-managed account triggers removal of our synchronized account profile, private representation claims and assignments, operation and rate records, and identifying/free text in ownership audit records, plus the review and report cleanup described above. Account deletion does not automatically delete published listings, listing contact information, photographs, emails, unrelated administrative records, analytics, or backups.

To request deletion of other personal information, email hello@horselayover.com. Please identify the account, listing, or correspondence involved. We will assess the request, arrange deletion where required, and explain any applicable exception. Clearing browser storage or disconnecting Google is not a substitute for this request.

Your California privacy rights

The California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA), gives California residents the rights below when the law applies to a business and the information involved. Some information and requests are subject to legal exceptions. You may contact us about your information regardless of whether these laws apply to your particular request.

• Know and access: request the categories and specific pieces of personal information we hold about you, the categories of sources, the purposes for collection and disclosure, and the categories of recipients. Where required, we provide a portable, readily usable copy.
• Delete: request deletion of personal information, subject to exceptions such as meeting legal obligations, protecting security, and exercising or defending legal claims.
• Correct: request correction of inaccurate personal information, taking into account its nature and why it is used. Account settings also let you update supported profile fields; email us about listing corrections.
• Opt out of sale or sharing: direct a business to stop selling your information or sharing it for cross-context behavioral advertising. Horse Layover does neither, as explained above.
• Limit sensitive-information use: limit uses and disclosures beyond those permitted by the CCPA. We use sensitive information only for the permitted purposes described in this policy and not to infer characteristics about you, so we do not offer a separate limitation control for such additional uses.
• No discrimination or retaliation: we will not discriminate or retaliate against you for exercising an applicable privacy right. Deleting information necessary for an account or feature may prevent us from providing that account or feature; this is not a penalty for exercising your rights.

We do not use automated decisionmaking to make credit, employment, housing, insurance, or similarly significant decisions about you. Our route and listing tools help you find information, not determine your eligibility for those services.

How to make a privacy request

Email hello@horselayover.com and describe what you would like to access, correct, or delete. "Privacy request" is a helpful subject line, but is not required. Include the email address associated with your account or correspondence and any relevant listing URL so we can locate the information. You may request all information we are required to provide, including information older than 12 months where applicable. You do not need to create an account.

Verification and authorized agents

To protect your information, we may verify control of the relevant email address or account and match details already in our records before granting access, correction, or deletion. If needed, we will request only additional information reasonably necessary to verify and process the request. We use verification information for that purpose and applicable security or compliance requirements, not for marketing. Never send your password. If we cannot verify a request or must deny part of it, we will explain why.

You may designate an authorized agent to contact us at the same email address. We may request signed permission, verify your identity directly, and ask you to confirm the agent's authority, as permitted by law. We will recognize a valid power of attorney and applicable exceptions to these verification steps.

Response timing and cost

For CCPA requests to know, delete, or correct, we will acknowledge receipt within 10 business days and respond within 45 calendar days of receipt. If a permitted extension is reasonably necessary, we will explain it within the initial period; the total will not exceed 90 calendar days. These deadlines run from receipt, not from completion of verification. Requests are ordinarily free. If the law permits a fee or refusal for a manifestly unfounded or excessive request, we will explain the basis before charging.

If a sale/sharing opt-out or sensitive-information limitation obligation becomes applicable, the applicable deadline is as soon as feasibly possible and no later than 15 business days, not the 45-day access-request period. We will provide any legally required controls before beginning such practices.

California residents may also contact us about disclosures for third parties' own direct marketing under California's "Shine the Light" law. We do not disclose personal information for that purpose. If you have a concern about our response, reply to us or submit a complaint to the California Privacy Protection Agency.

Children, security, and other websites

Our service is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has provided personal information, contact us so we can investigate and take appropriate deletion steps. Our no-sale and no-sharing policy also applies to information about people under 16.

We use reasonable administrative and technical safeguards, including access controls for account and administrative functions. No website, transmission, or storage system can be guaranteed completely secure. Please do not send passwords, government identification numbers, or financial-account credentials by email.

Our service is focused on the United States. Providers may process information in the United States and other countries where they operate. Property websites, mapping services you open, and other external links have their own privacy practices. Contacting or booking with a property is a separate interaction with that operator.

Changes and contact information

We will update this policy when our practices change and review it at least annually. We will revise the date above and notify you of material changes through a prominent website notice or, when appropriate, an email to your account address before the changes take effect. If a new use requires consent or another notice under applicable law, we will obtain that consent or provide that notice.

For privacy questions, requests, listing corrections, or an accessible alternative format of this policy, contact Horse Layover at hello@horselayover.com.