FootingIQ is an arena footing maintenance web app operated by Nick Hallmark ("FootingIQ", "we", "us"). This policy explains what data we collect, why we collect it, who processes it on our behalf, where it is stored, how long we keep it, and the choices and rights you have — including under the EU and UK GDPR and California privacy law. Questions or requests: support@footingiq.com.
1. Who is responsible for your data
The data controller for FootingIQ is Nick Hallmark, trading as FootingIQ, a sole proprietor based in the Commonwealth of Virginia, United States. Contact for anything in this policy, including privacy requests: support@footingiq.com. We have not appointed a data protection officer or an EU/UK representative; at our size the law does not require one, and we will update this policy if that changes.
2. What we collect
We collect only what the app needs to work:
- Email address and sign-in credentials — used to create your account and sign you in. You can sign in with a one-time code we email you, or with an email address and a password you choose. Passwords are stored by our authentication provider (Supabase Auth) in hashed form; we never see or store them in plain text. If a Continue with Google option is offered and you use it, Google shares your email address and basic profile (name and profile picture) with us so we can create or match your account.
- Display name — optional, shown inside your own account and to any staff you invite.
- Arena location — a place name or coordinates for your arena, used to fetch local weather so the maintenance schedule can react to conditions. You can type a place, or tap Use my location, which asks your browser for your device's location only at that moment and only if you allow it; we then store approximate coordinates plus a readable place name. You can decline and type a nearby town instead — an approximate location works fine.
- Arena details and activity logs — your arena's footing type, size, construction details, and the maintenance and ride entries you log.
- Arena photos (Pro and Barn plans) — photos you choose to attach to log entries. They are stored in Supabase Storage (US, us-east-1), tied to your account, visible only to you and any staff you invite, and deleted when you delete your account.
- Chat messages — messages you send to the AI footing expert, plus the replies, so the conversation has memory.
- Team members (Barn plan) — if you invite staff, we store the email address you invite, the role you assign, and the link between that person and your arena. If you are invited as staff, your account is linked to the owner's arena and the owner can see the activity you log there.
- Subscription status — which plan your account is on (Free, Solo, Pro or Barn), trial and renewal dates, and a reference to your Stripe customer record. We never see or store your card number — payment details go directly to Stripe. Stripe also receives your billing address, which it uses to calculate any VAT or sales tax due at checkout.
- Push notification registration — if you opt in to task reminders, your browser gives us a push subscription (an anonymous delivery endpoint) that we store so we can send them. You can turn notifications off at any time in the app or your browser settings, which removes it.
- Error and performance diagnostics — when error monitoring is enabled, if the app crashes we receive an automatic error report (the error message, the app state around it, and basic device/browser info), plus a small sample of page-load timings, so we can fix bugs.
- Support emails — if you email support@footingiq.com, we keep your message, your email address, and our reply.
- Web server logs — our hosting provider records standard request data (IP address, browser type, time, page requested) when you load the app, as every website does.
We do not track your location in the background, and we never read your contacts, photo library (beyond the individual photos you choose to upload), or anything from other apps. There are no analytics or advertising trackers in FootingIQ.
3. Why we collect it, and the lawful basis for each use
Under the EU and UK GDPR we need a legal reason for each thing we do with your data. These are ours:
| What we do | Data involved | Lawful basis |
|---|---|---|
| Create your account and sign you in | Email, credentials, display name | Contract (GDPR Art. 6(1)(b)) — we cannot provide the service without an account |
| Build and update your maintenance schedule, weather advisories and trends | Arena details, location, logs, photos | Contract — this is the product you signed up for |
| Run the AI footing expert chat | Your messages and arena context | Contract — a feature of the paid plans you chose |
| Share an arena with staff (Barn plan) | Invited email, role, membership link | Contract with the arena owner; for invited staff, our legitimate interest in letting the owner run their team |
| Bill you and keep tax records | Email, plan, Stripe customer reference, billing address (held by Stripe) | Contract, and legal obligation (Art. 6(1)(c)) for tax and accounting records |
| Read your device's location when you tap Use my location | Device coordinates at that moment | Consent (Art. 6(1)(a)) — your browser asks you first; withdraw by typing a place instead |
| Send push reminders | Push subscription, your digest hour and time zone | Consent — opt-in in the app; withdraw by turning notifications off |
| Keep the service secure and working: abuse prevention, chat rate limits, server logs | IP address, request metadata, usage counters | Legitimate interest (Art. 6(1)(f)) in protecting the service and other users |
| Fix bugs: error and performance diagnostics (when enabled) | Crash reports, device/browser info, sampled timings | Legitimate interest in keeping the app reliable; reports are minimized and not used to profile you |
| Answer support emails | Your message and email address | Contract where it concerns your account; otherwise our legitimate interest in responding to you |
| Notify you of material changes to the service or these terms | Legitimate interest and, for some notices, legal obligation |
We do not use your data for advertising, we do not build profiles for marketing, we make no decisions about you by automated means that have legal or similarly significant effects, and we never sell your data to anyone. We send no marketing email.
4. Who processes your data
We use a small set of service providers ("processors") to run FootingIQ. Each receives only what its job requires:
| Processor | Role | What it receives |
|---|---|---|
| Supabase | Database, authentication (including password hashing), file storage for arena photos, and backend hosting (US, us-east-1 region) | All account data described above |
| Vercel | Web app hosting and content delivery | Standard web request data (IP address, browser info) when you load the app |
| OpenRouter and the AI model providers it routes to | AI chat. Your messages are processed by third-party language-model providers via OpenRouter, subject to those providers' own terms and privacy policies. We do not control how a given model provider handles the content it receives. | Your chat messages plus relevant arena context: the arena name and location as you entered them, footing type and construction, recent logs and conditions, and the weather summary — not your email, your name, or your exact coordinates |
| Stripe | Payment processing for Solo, Pro and Barn subscriptions, any VAT or sales-tax calculation at checkout, and the self-serve billing portal | Your email, billing address and payment details (card data is entered directly with Stripe and never touches our servers) |
| Resend | Email delivery: receives mail sent to support@footingiq.com and forwards it to our mailbox | Support emails you send us, including your address and any attachments |
| Open-Meteo | Weather forecasts for your arena, and turning a place name you type into coordinates | Your arena's coordinates (weather) or the place name you typed (geocoding) — no account information |
| postcodes.io | Turning a UK postcode you type into coordinates | The postcode only — no account information |
| BigDataCloud | Turning coordinates into a readable place name after Use my location | Coordinates only — no account information |
| Sign-in, only if you choose Continue with Google (when offered) | Google tells us your email and basic profile; we tell Google nothing beyond the sign-in request | |
| Sentry | Error and performance monitoring (when enabled) | Crash reports, sampled page-load timings and basic device/browser info |
| PostHog | Product analytics (when enabled): which steps of the app people reach — sign-up, arena created, entries logged, upgrade — so we can see where they get stuck | Event names tied to your account id, the app version and basic device/browser info. Cookieless: no cookie or persistent identifier is stored in your browser, your IP address is not kept, there is no session recording and no cross-site tracking |
The chat sends your arena's name and location exactly as you typed them — if you'd rather not share a precise address with the AI provider, name your arena something generic and use a nearby town as the location. The schedule works just as well. Please don't put sensitive personal information in chat messages.
We share personal data with no one else, except where the law requires it (for example, a valid court order) or to protect the rights and safety of users and the service.
5. Where your data is stored, and international transfers
FootingIQ is operated from the United States and hosted there: our database, authentication and photo storage run on Supabase in the us-east-1 (N. Virginia) region, and the web app is served by Vercel. The providers in section 4 are US companies or process data in the US (Stripe, OpenRouter and the model providers it routes to, Sentry, Resend). If you use FootingIQ from the EU/EEA, the UK or Switzerland, your personal data is transferred to and stored in the United States.
For those transfers we rely on the EU–US Data Privacy Framework (and its UK Extension and the Swiss–US DPF) where a provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses (with the UK International Data Transfer Addendum for UK data and the Swiss amendments for Swiss data) built into each provider's data-processing agreement, together with the technical measures in section 8. Each provider's certification status can be checked on the Data Privacy Framework list. You can ask us for a copy of the relevant safeguards at support@footingiq.com. By design we also minimize what crosses the wire — weather and geocoding services receive coordinates or a place name only, and the AI provider never receives your email or exact coordinates.
6. How long we keep data
- Account data (profile, arenas, logs, photos, chat, team links, push registrations): kept for as long as you have an account — your history is the product. It is removed from our live database and file storage immediately when you delete your account using the self-serve Delete account button on the Account page, which also cancels any active Stripe subscription so billing stops.
- Backups: deleted data can remain in encrypted database backups for up to 30 days after deletion, after which it is gone from backups too. Backups are never restored to the live service except in a disaster-recovery event, and are not used to reinstate deleted accounts.
- Staff accounts: if an arena owner removes you (or deletes their account), your link to that arena is removed; your own account and anything you own remain yours.
- Payment records: Stripe keeps transaction records (your email, billing address and invoice history — never your full card number with us) for as long as tax and financial law requires, generally 7 to 10 years depending on the country. We keep the matching invoice references for the same period as part of our accounting records.
- Support emails: kept for 2 years after the conversation ends, so we can follow up on earlier issues, then deleted.
- Error reports (when enabled): retained by Sentry for 90 days, then deleted. Web server logs at Vercel are retained for a short rolling period and then discarded.
7. Cookies and local storage
FootingIQ uses browser storage for exactly two things: keeping you signed in (your authentication session, held in your browser's local storage) and making the app work offline (cached app data and entries queued while you're out of signal). Both are strictly necessary for the service you asked for. There are no advertising cookies, no third-party trackers, no analytics cookies and no cross-site tracking. Because nothing we store is optional tracking, no cookie consent banner is required and none is shown. Stripe sets its own cookies on its checkout and billing-portal pages, which are Stripe's pages and covered by Stripe's privacy policy.
When product analytics is enabled (see the PostHog row in §4), it runs without cookies or any identifier stored in your browser. Events are tied only to your account id while you are signed in, so that we can see which steps of the app people reach; nothing is shared with advertisers or used across other sites.
8. Security and data breaches
Your data is encrypted in transit (TLS) and at rest, passwords are stored only as salted hashes, and database row-level security isolates every account — no user can read another user's data (staff see only the arena they were invited to), and the app's client holds no privileged keys. Administrative access to the database is limited to the operator. If, despite this, a breach of personal data ever occurs, we will notify the relevant supervisory authority without undue delay (within 72 hours where GDPR Art. 33 applies) and tell affected users directly when the breach is likely to put them at risk.
9. Your rights (EU/EEA, UK and Switzerland)
If you are in the EU/EEA, the UK or Switzerland, data-protection law gives you the following rights over your personal data. We extend the same rights to everyone, wherever you are:
- Access: see the personal data we hold about you. Your data is visible in the app, and Download my data on the Account page gives you a complete machine-readable copy.
- Rectification: correct anything inaccurate — your profile, arena and logs are editable in the app; email us for anything else.
- Erasure: use Delete account in the app — self-serve, no email required, no waiting period — or email us.
- Restriction: ask us to pause processing of your data while a dispute about it is resolved.
- Portability: Download my data exports your profile, arenas, logs and chat in a machine-readable file; individual arenas can also be exported (and re-imported) from the Arena page.
- Objection: object to processing we base on legitimate interest (section 3); we will stop unless we have compelling grounds to continue.
- Withdraw consent: at any time, without affecting earlier processing — turn push notifications off in the app; replace a device-derived location by typing one.
- Complain to a supervisory authority: you can lodge a complaint with the data-protection authority of the country where you live or work. In the UK that is the Information Commissioner's Office (ICO); in the EU/EEA, your national authority (the EDPB keeps the list); in Switzerland, the FDPIC. We would appreciate the chance to address your concern first.
To exercise any right that is not self-serve, email support@footingiq.com from the address on your account (that is how we verify it is you). We respond within 30 days, free of charge; if a request is complex we may extend by up to two further months and will tell you why.
10. California privacy notice
This section is for California residents and is provided under the California Consumer Privacy Act as amended by the CPRA. It supplements the rest of this policy.
- Categories of personal information we collect (all described in section 2, collected directly from you or from your device and browser): identifiers (email address, display name, account and Stripe customer references); commercial information (your plan and billing history); approximate geolocation (your arena's location); internet or network activity (web server logs, error diagnostics); and user-generated content (arena details, logs, photos, chat messages, support emails). We collect no precise real-time geolocation, no biometric information, and no sensitive personal information beyond your sign-in credentials, which we use only to sign you in.
- Purposes: those in section 3. We keep each category for the periods in section 6.
- We do not sell your personal information and we do not share it for cross-context behavioral advertising, and have not done so in the preceding 12 months. We do not use or disclose sensitive personal information for purposes that would give you a right to limit its use. We disclose personal information only to the service providers in section 4, under contracts that restrict them to providing their service to us.
- Your rights: to know what personal information we collect, use and disclose; to delete it; to correct it; and not to be discriminated against for exercising these rights. We honour them for everyone, as described in section 9.
- How to exercise them: use Download my data and Delete account on the Account page, edit your details in the app, or email support@footingiq.com. We verify requests by matching the email address on your account; an authorized agent may submit a request with your signed permission. We respond within 45 days.
11. Children
FootingIQ is not directed at children and we do not knowingly collect personal data from anyone under 16. You must be at least 16 years old (or the age of digital consent in your country, if higher) to create an account. If we learn that an account belongs to someone under that age, we will delete it. Parents or guardians who believe a child has created an account can email support@footingiq.com.
12. Changes to this policy
If we change how we handle your data, we will update this page and the "Last updated" date above. For material changes we will notify you in the app or by email before they take effect.
13. Contact
FootingIQ · Nick Hallmark · Commonwealth of Virginia, United States · support@footingiq.com (privacy requests, data-protection questions and everything else).