Privacy Policy

Ranch Assistant by CrestFlow Digital. Updated October 31, 2026.

CrestFlow Digital develops and runs Ranch Assistant. Each barn owns and controls its records; we store and process them on the barn's behalf.

Request account deletion, or ask a privacy question at support@crestflow.io.

What we keep and why

We keep account names, sign-in names, roles, optional contact details and sign-in history to manage access. Passwords are stored as protected hashes.

The barn enters horse details, care records, client names and contact details, lesson and appointment records, amounts owed and received, notes, documents and photos. When the barn uses texting through Twilio, we also keep those texts, the clients' replies and each client's texting consent. We keep these to provide the barn's recordkeeping tools. Connected-service credentials are stored encrypted.

When Ask is available, we keep assistant questions and answers in the barn's records. Security records include sign-in attempts, session IP addresses and browser details, and a history of changes, so we can protect accounts and trace changes.

We do not sell personal data or use it for advertising or profiling. The app has no advertising or analytics trackers and does not read your phone's contacts or location.

Where data goes

Hostinger hosts our server, including each barn's separate database and uploaded files. Cloudflare R2 stores encrypted backups. Connections to the app are encrypted in transit. CrestFlow administers the server to operate, secure and support the service.

OpenAI: When Ask is enabled, submitting a question sends that question and a text snapshot of relevant barn records to OpenAI. The snapshot can include horse details, care due dates, client names and events in the next seven days, including events imported from Google Calendar. For those events it includes the title, time, linked client and horse names, and recorded outcome. Amounts owed are included only for an owner. Answers do not change the barn's records.

Google Calendar: When you connect Google, we request your account identity and email address, permission to see your calendar list, and read-only permission to view events on calendars available to that account. Ranch Assistant syncs events from calendars you assign a role: Lessons, Appointments, Staff or Other. Calendars set to Off do not sync. Each time you turn a calendar from Off to a role, the app reads the calendar list and checks that calendar's events before accepting the change. We do not create, change or delete Google events or calendars, or read your Google inbox or Drive files.

We keep calendar-list identifiers, names, colours, access details and main-calendar and hidden flags until you disconnect or replace the Google account. We also store your calendar roles and the sync state, including the last attempt, last success and errors. Upcoming counts use events already imported and their sync state; we do not fetch event previews for calendars set to Off.

We store event titles, descriptions, locations, start and end times, all-day and cancellation status, and event, calendar and recurring-series identifiers needed to keep the imported records up to date. We process attendee email addresses to match existing clients; we do not store an attendee email list with the imported event.

Turning a calendar Off does not delete its imported records. Events you have worked on, including ones with recorded outcomes, fees or share links, stay visible; unused imports leave Today and Schedule. When the app can recognise the same event on two calendars, it shows one copy. Possible duplicates that need a decision are marked for review.

Disconnecting Google in More > Connections stops future calendar syncing and removes the connection's stored credentials, sync state, cached calendar list and saved calendar roles. We also ask Google to revoke access. You can remove access directly in your Google account settings if that request fails. Events already imported stay in the barn's records, under the retention and deletion rules below; disconnecting does not delete them.

Open-Meteo receives the town or ZIP entered for weather lookup, and the barn's map coordinates and time zone for forecasts. We do not send it client names or barn records.

Resend processes and delivers the optional Monday email to the one address the barn owner chooses. It is off by default; the owner opts in through the barn's settings and can turn it off there. The email contains client names, horse names, record types, dates, amounts owed and counts. It does not contain event titles, descriptions, locations, attendees, calendar names, notes, or client phone numbers or email addresses.

When a barn uses texting through Twilio, Twilio processes and delivers texts from the barn's own number and passes back clients' replies and delivery receipts. It receives the client's phone number, the words of each text and when it was sent. When a barn uses this service, we remove the words from Twilio's record of each text after 30 days.

The app can also prepare a draft that a barn sends from its own phone. That text does not go through Twilio. We cannot tell whether it was sent or whether it arrived, and we do not receive replies, including STOP. Responses made through the lesson link are still recorded.

Supabase for sign-in and password reset, and Resend for account emails, are configured but are not yet used for Ranch Assistant sign-ins or password resets. Stripe is planned for a later service and receives no data from this app today. Before those uses begin, we will update this policy and tell the barn owner at the email address on the owner's account, where one is on file.

Texts from the barn

These terms cover the Crossroads Ranch LLC Lesson Texts program.

When a barn uses texting, it can send clients lesson confirmation texts with a link to confirm or cancel. Each lesson text is sent from the barn's own number when the barn taps Send. The barn first reads the client a short notice and asks for permission to send an opt-in request text. The barn sends that text once when the owner logs the client's spoken yes. The client must reply YES to that text before receiving lesson texts. A valid YES is answered by one sign-up confirmation. Saying no does not affect lessons or care. Message frequency varies, usually one text per lesson, plus two texts when the client signs up. Message and data rates may apply. Reply STOP to stop texts at any time, or HELP for help.

For texting help, email support@crestflow.io. Carriers are not liable for any delayed or undelivered messages.

We do not sell mobile information, including phone numbers, texting opt-in data and consent. We do not share this information with third parties or affiliates for marketing or promotional purposes.

We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes.

Through Optional Support access, CrestFlow Support cannot see clients' phone numbers or the words of their texts. The barn's staff cannot see them either.

Twilio's backups may keep the words of a text for up to 30 days after the app removes them from Twilio's records. If a barn disconnects its account while texts are still at Twilio, those texts remain in the barn's own Twilio account.

Optional Support access

When this feature is enabled, a barn owner can let CrestFlow Support into that barn for 24 hours, 72 hours or 168 hours after confirming their password. Support can read horses, permitted records, the schedule, care due and client names. It cannot change records or view money, documents or client contact details. Record titles and permitted free-text fields can still contain information the barn entered there.

Resend delivers a single-use sign-in link to CrestFlow's support mailbox. The email contains the barn name, the access end time and the link. The owner can end access at any time; otherwise it ends at the time shown. This optional access is separate from CrestFlow's administration of the hosting service.

Every barn-data request Support makes after it is let in is listed, including refused ones. Requests turned away before that (expired or mismatched sign-in, security checks, or maintenance) are not listed.

The owner can see this Support activity in the barn's settings. It records the kind of request, its time and outcome, and a record or horse identifier where relevant. Background requests can be shown separately.

Help requests

When this feature is enabled, a signed-in owner or staff member can write to CrestFlow from More, Get help. A request keeps the message, any follow-ups, CrestFlow's answers, the screen it was sent from, the browser family and an optional "best way to reach you". Only the sender and CrestFlow read it; a barn owner does not see a staff member's requests.

When a request is sent, Resend delivers a short notice to CrestFlow's support mailbox. It names the barn and contains no message text.

A request with no new message for 30 days is closed. A closed request is deleted a year after it closed, or sooner when the sender's account is deleted.

Account help from CrestFlow

CrestFlow can make a one-time set-password link for an owner or staff member, cancel a waiting link, or sign someone out of every device. Each is recorded in the barn's own records, and the owner sees it under Account help from CrestFlow in the barn's settings. Help requests are never listed there.

Sharing and your device

The barn controls who has access to its records. A share link can be opened by anyone who has it, so share links only with intended recipients.

The app saves its screens, styles and icons, plus small display preferences, on your device. It does not cache barn records for offline reading. When the server cannot be reached, changes cannot be confirmed as saved. Copies you download or share outside the app remain wherever you keep them.

How long we keep it

We keep the barn's records, change history and assistant conversations while the barn has an account, unless they are deleted sooner.

Sign-in attempts are deleted after 24 hours. Sessions last up to 30 days. Signing out ends that session's access immediately.

Support activity is kept for 90 days. Support sign-in links and session records are cleared 30 days after expiry, use or revocation, as applicable. Grant records are kept for one year after access ends. An hourly clean-up applies these limits, including to barns on hold; it waits during backups, maintenance or server downtime and catches up on its next run.

A deletion is carried out within 30 days of the request. Backups containing the data are removed within 90 days after the deletion is carried out. These copies are retained temporarily for recovery.

When a barn uses texting through Twilio, we delete the words of each sent or received text from the app's records after 30 days. The record of a client's texting consent, and of when each text was sent and delivered, stays with the barn's records. Copies of the words in backups remain until the backups are removed within 90 days.

While a Monday email is being sent, our server keeps a copy of it and the address it is going to. Once sending has finished, whether it was delivered, refused or cancelled, an hourly clean-up deletes that copy and address after at least 48 hours. The clean-up waits while the server is down, while a backup or maintenance pause is running, or while the barn's account is on hold, and deletes them on its next run. A note of each week's result, without the email's content or the address, is kept for 400 days.

Separately, the address the owner saves for the Monday email stays in the barn's settings until the owner changes or removes it. The barn's settings history, which is not shown to staff or clients, keeps each address saved there for as long as the barn's records are kept.

A backup taken while a copy is held contains it; backups are removed within 90 days. Resend keeps its own copy of sent emails in its email logs for 30 days.

Deleting an account

To ask, email support@crestflow.io from the account's email, or choose More > Delete account in the app to open the instructions. You do not need the app installed to make a request. If you sign in with only a user name or cannot access that email, contact us so we can confirm your identity another way.

Deleting a staff account removes its sign-in access and personal account details. Records made for the barn remain with the barn, without the former staff member's account identity. Deleting an owner's account closes the whole barn and removes its records, files and sign-ins. We keep a minimal record that the deletion was completed.

See account deletion for the steps, what is retained and the time limits. For access to, correction of, or deletion of information a barn holds about you, contact the barn or our support address.

Age

Ranch Assistant is not for anyone under 18. A barn may enter records about young riders as part of running its activities; the barn controls those records.

Changes and contact

The date at the top shows when this policy changed. The barn owner is told about material changes at the email address on the owner's account, where one is on file.

CrestFlow Digital: support@crestflow.io.