Privacy Policy

Stallion applications are not open to the public. Access is granted individually, and most applications are used by a handful of people. You will have an account because someone invited you to one.

Each application is a separate service with a separate database. Having access to one does not give anyone access to another, and this policy applies to all of them.

Account information. Your email address, your display name, and authentication data. Sign-in is handled by Auth0; where an application still uses a password directly, it is stored only as a hash and never in a form we can read.

The data you put into an application. This varies by application and is the substantive part:

• Health Organizer holds medical records, health profiles and related documents.
• Cashflow holds bank transactions and loan records, including accounts you connect through Plaid.
• Accounting Ledger holds bookkeeping records, which for client organizations means their financial data.
• Human Performance holds athlete training and physiological data.
• Stallion Academy holds per-person learning records — what you attempted, what you answered, and what the system concluded you understand.
• Other applications hold collection inventories, commerce figures, sports and fantasy data, media libraries, and creator analytics.

Operational records. Sign-in times, sync runs, and error logs, kept so a failure can be diagnosed and so unauthorized access would be visible.

We do not run advertising, we do not use third-party analytics or tracking pixels, and we do not sell or share personal data with anyone for their own purposes.

Some applications can connect to a third-party account you already have — for example a podcast host, a YouTube channel, an Instagram professional account, or a bank through Plaid. Those connections are always started by you and can be disconnected by you.

We request read-only access wherever the platform offers it, and we store the resulting access tokens encrypted. We never receive or store your password for a connected service. Disconnecting removes the stored token; data already imported remains until you delete it.

Each application records how it is shared, and that setting is enforced in the application rather than being a description of intent:

• Per-user — your data is visible only to you.
• Role-based — visibility depends on your role, for instance an instructor seeing a learner’s progress in a course they teach, or a client’s staff seeing that client’s records.
• Owner-only — the application is used by one person and is never granted to anyone else.

The operator of Stallion has administrative access to the systems and can therefore reach stored data when operating or repairing them. This is stated plainly because it is true of any hosted service and is often left unsaid.

These providers process data on our behalf in order to run the applications:

• Auth0 (Okta) — sign-in and identity.
• Railway — application hosting and database storage.
• Resend — transactional email, such as password resets.
• Plaid — bank connections, for the applications that offer them.
• Cloudflare — DNS.
• Google Drive — encrypted backup storage.

Where an application uses an AI model to summarize or explain something, only the text needed for that request is sent, and we do not send data to providers whose terms permit training on it.

We keep your data for as long as your account exists, because the applications are record-keeping tools and old records are usually the point. Backups are retained separately and a deletion may persist in a backup for a period after it is removed from the live system.

You can ask us to export or delete your data, or to close your account, and we will do it. Where a record is jointly held — a client organization’s bookkeeping, for instance — we may need to keep the organization’s copy while removing your access to it.

Access tokens and other secrets are stored encrypted. Each application runs as its own service with its own database, so a problem in one does not expose another. Sign-in is handled by a managed identity provider rather than by us.

No system is perfectly secure, and we would rather say so than imply otherwise. If you believe an account or record has been exposed, contact us and we will investigate.

Stallion applications are not intended for children, and accounts are created by invitation. Where an application holds data about a minor — a young athlete’s training records, for example — that data is entered and controlled by a responsible adult, not by the child.

Depending on where you live you may have rights to access, correct, export, or delete your personal data, and to object to certain processing. We honour these requests regardless of whether a particular law applies to you.

If this policy changes in a way that affects what we collect or who can see it, we will say so rather than quietly updating the date at the top.

Questions, requests, or concerns: dj@buildstallion.com.