EquiWorld Privacy Policy

Draft policy — publication is blocked. The release owner must assign a version, record the approved content hash, and obtain legal/privacy approval before release. No effective date has been assigned.

Effective date: not assigned — draft pending approval

Publication gate: This document is a draft and is not approved for publication. The release owner must assign a new effective version, record the exact content SHA-256, obtain legal/privacy approval, and verify the unauthenticated public copy before release. The September 1, 2026 public snapshot remains the last verified publication; do not represent this edited source as that identical content. Two substantive revisions are pending approval in this draft. The first is the RevenueCat and choice language. The second, added 2026-09-06, is the children's-data section, the corrected description of deletion and retention, and the per-provider disclosure — made because the previous text did not describe what the Service holds about a child who has no account, and described account closure in terms that did not match what happened to a guardian-created child profile. Retention that is not disclosed is not defensible retention, which is why this revision is being made before the product onboards real families rather than after. Task 573 reconciliation — 2026-09-06: existing factual statements in this draft are verified where cited in the appendix. The age-13 gate, parent reauthentication/versioned authorization, majority review, relationship- specific sharing, retention sweeps, annual contact confirmation, and emergency abuse controls are approved engineering targets but remain provisional in this policy until verified against an immutable release candidate. The parental-authorization method and seven-year signed/financial treatment also require qualified approval. Publication is fail-closed under scripts/verify-children-privacy-release.mjs.

EquiWorld Inc. ("EquiWorld," "we," "us," or "our") provides the EquiWorld mobile application, website, software, and related services (the "Service"). This Privacy Policy explains how we handle personal information when you use the Service. Questions, access, correction, deletion, or account-closure requests may be sent to privacy@equiworld.app.

Information we collect

We collect information you provide or direct us to process, including:

account and contact information, such as name, email address, phone number, date of birth where provided, role, service preferences, and profile photo;
barn, business, service, and public-profile information, including addresses and coordinates;
horse, ownership, care, health, veterinary, farrier, feed, treatment, scheduling, cost, and operational records;
child/rider, parent/guardian, emergency-contact, allergy, medical-condition, health-insurance, waiver, medical-release, signature, and billing information that a parent, guardian, barn, or other authorized user enters. The section "Children and riders who have no account" below describes this case in full, because it is a core part of how the Service is used rather than an edge case;
lessons, appointments, programs, events, attendance, transport, calendar, booking, and communication information, including a trainer's written lesson notes, skill ratings, and any photographs or video attached to them;
invoices, balances, expenses, refunds, receipts, payment status, and payment processor identifiers. EquiWorld does not receive or store raw card numbers or CVCs when payments are collected through Stripe;
files and content you deliberately select, capture, upload, record, create, or send, including photos, documents, PDFs, receipts, signatures, messages, and ride-journal audio, transcripts, and notes;
precise location when you grant foreground permission and use a location-based feature, including nearby-barn search, address or barn setup, trail sessions, and SOS/safety features; and
authentication, security, and service-operation information, such as sessions, verification codes, hashed account/IP identifiers, rate-limit state, request correlation IDs, and limited allowlisted route/outcome/error categories.

We also maintain first-party aggregate template-library counters (template, event type, date, and count). They are not linked to an account, device, IP address, cookie, or person. On your device, the app may keep login and preference data locally. Accelerometer readings used for local fall detection are not sent to or stored by EquiWorld unless you separately use a feature that submits information.

How we use information

We use information to provide, secure, maintain, and improve the Service; set up and administer accounts; manage barns and authorized relationships; deliver care, scheduling, safety, communication, payment, booking, and export features; respond to requests; prevent fraud and abuse; comply with law; and enforce our agreements. Access within the Service follows the applicable account, barn, horse, rider, guardian, provider, or financial relationship. Some barn profiles, listings, and booking fields are intentionally public when the user or barn makes them public.

We do not sell personal information. We do not use personal information for third-party advertising, behavioral advertising, attribution, or cross-app/cross-company tracking. We do not use an IDFA or request App Tracking Transparency permission. We do not operate a user-level analytics or crash SDK.

Children and riders who have no account

Riders in this Service are frequently children. A parent or guardian can create a child rider profile, and a child with such a profile has no account of their own: they never sign in, never accept anything, and never see the app. An adult creates the record and an adult is accountable for it. This section describes that case specifically.

### What we hold about a child

name, date of birth, and riding level;
the barns and trainers the child is currently associated with;
lesson history, attendance, and the trainer's lesson notes about the child, which may include skill ratings and attached photographs or video;
emergency contacts — contact type, name, phone number, relationship, and any additional information entered, which frequently describes other people who have no account with us and have agreed to nothing;
safety contacts — name, phone, and email;
waiver, medical-release, and parent-document records, including who signed, when, the typed signature, the version signed, and the IP address the signature was submitted from;
competition entries, placings, and a trainer's recap comment; and
documents attached to the child's record, and invoices and payment records attached to the guardian.

Where a rider holds their own account, we also hold their trail-ride sessions, described under Location below. A child with a guardian-created profile and no account of their own cannot start a trail ride, and we therefore hold no trail-ride location history for that child.

### Who can see it

The child's guardians — anyone holding a current guardian link to the child. Guardian authority may also carry invoice authority and a stored payment method.
Barn owners and staff at barns the child is *currently* associated with, and trainers with a current association to the child. Access follows the current relationship, not a past one: when an association ends, access ends on the next request rather than when a login expires. Changing barns ends the old barn's access.
EquiWorld administrators, for support and operation of the Service.
Service providers a barn has granted access to — a veterinarian or farrier, for example — receive access to the horses at that barn, including a horse owned by a child and that horse's health and care records. A provider grant does not by itself give a provider access to a child's own rider profile, emergency contacts, or lesson notes.
Anyone holding an emergency-card link. A guardian can generate a printable emergency card. That card is reachable by a plain web link without signing in, and it shows the child's name and every emergency contact to whoever holds it. It is built this way deliberately, so that a card can be printed and carried and still work when someone is hurt and no one can sign in. It does not expire. A guardian can revoke it at any time in the app, and a revoked link stops working immediately. Treat the link as you would treat the card itself.

### Deleting a child's data

A guardian can delete a child's personal data in the app. This is available to the rider themselves or to a current guardian; a barn cannot delete a family's records, and a family does not lose their records by changing barns.

Deleted: the child's emergency contacts, emergency card links, safety contacts, guardian invitations and links, trail-ride sessions and their location history, competition recap cards, documents attached to the child, lesson notes about the child, and the child's barn and trainer associations. The rider record itself is anonymized — the name, phone, email, and date of birth are cleared.

Retained, and why:

Financial records — invoices, boarding and lesson payments, and related transaction records. Kept for accounting, tax, dispute, and chargeback purposes. They reference the anonymized rider record rather than an identified child.
Signed waivers, medical releases, and parent documents. Kept because a signed release is the record of the authorization it evidences; deleting it would destroy the proof of the very consent it documents. These records include the signing adult's typed signature and the IP address of signing.
Competition results.
A specific and important exception: where a waiver was signed on behalf of a child, the child's name remains recorded inside that signed waiver record. Anonymizing the rider profile does not alter a signed document. We state this plainly because a family should not have to discover it.
Backups retain data for their documented recovery windows, so a deletion is not effective in a backup until that backup ages out.

We do not delete records that another authorized person or barn controls, or that are needed to preserve another person's access or the integrity of a shared operational record.

### Requests about a child

A parent or guardian may contact privacy@equiworld.app to request access, correction, deletion, or account closure relating to their child, subject to verification and the shared-record and legal exceptions in this policy. The in-app rider export described under Your choices and requests lets a current guardian request the available record set for a child rider profile. The category report identifies records included and withheld. Contact us when the in-app route cannot be used, when you believe a category is missing, or when a request requires individual review.

Do not submit information about a child unless you are authorized to do so.

For the candidate governed by this draft, self-registration by a person under 13 must be rejected by the server and directed to a guardian-managed child profile. Creation of that profile must require a valid date of birth, parent account reauthentication, and versioned authorization evidence before sensitive child data or sharing becomes active. These sentences are not approved public claims until the release evidence verifies the server behavior and a qualified reviewer approves the authorization method.

Service providers and disclosures

We disclose information to providers only as needed to operate the selected feature, process a transaction, protect the Service, or comply with law. Where a child's information can reach a provider, that is stated.

Replit provides hosting, deployment logging, PostgreSQL, and private application storage, and proxies our email and SMS provider calls. It processes the applicable stored records, uploads, exports, and limited operational data. This includes children's records, because it is where the Service runs.
Stripe processes card or bank information in its own payment interfaces. It may receive payment-related name, email, internal user-ID metadata, amounts, currency, transaction identifiers, and return URLs. We retain Stripe identifiers and transaction/audit records, not raw card numbers/CVCs. Payments concerning a child are made by the guardian, so what reaches Stripe is the guardian's payment details; a child's name can appear in an invoice description.
RevenueCat and Apple support the iOS digital-subscription flow. RevenueCat receives the internal EquiWorld user ID used as its App User ID and processes product/offering requests, purchase and restore results, customer information, and entitlement status. Apple processes the App Store transaction and Apple-account purchase relationship. This runs on the account-holder's own subscription and does not carry a child's records. RevenueCat is not used for real-world barn invoices or services. Subscription processing is a separate choice you can decline or withdraw, and subscription features remain unavailable while it is withdrawn. The exact production RevenueCat project settings, SDK-generated request fields, and provider retention and deletion settings must be verified for each release; EquiWorld does not claim a provider retention period that has not been confirmed.
Resend receives sender/recipient email addresses, subject, message content, verification codes, and any attachment sent through email features. A child has no email address in the Service, but a child's name and details can appear in an email body — a lesson reminder, a waiver-expiry notice, or a trail-ride safety alert — and that content reaches Resend.
Twilio, if enabled, receives sender/recipient phone numbers, the full SMS body, verification codes, delivery status/SID, and inbound opt-out content. As with email, a child's name and details can appear in the message body, and an emergency or overdue-ride alert can carry a rider's name and location description. Emergency and safety contacts you enter are the recipients of those messages.
Anthropic is used only for optional AI document extraction that you initiate and separately allow. Replit's managed Anthropic integration routes the submitted document text, selected image, or up to five rasterized PDF pages to Anthropic's Claude service to suggest structured fields.
OpenAI is used only for the optional AI ride journal that you initiate and separately allow. OpenAI can receive recorded ride-journal audio for transcription and resulting transcript/prompt content for a suggested structured summary. For both AI purposes, consent is recorded against the exact disclosure text you were shown; if that purpose's provider or disclosure changes, your consent becomes stale and is requested again. Consent is checked immediately before every provider call or explicit retry and can be withdrawn. Submitted content can include horse, care, veterinary, financial, or journal information, and will include a child's information if you submit a document or recording that contains it. Nothing is written to a record until a person reviews and confirms it. Do not submit content to these features unless you want that processing. Our internal handling of document extraction is documented separately in our AI document extraction security and retention policy.
OpenStreetMap Nominatim receives address text or coordinates for barn address geocoding, address autocomplete, and reverse geocoding. OpenStreetMap Overpass receives coordinates and a search radius for nearby-barn search. Some of these requests are made directly from your device, so your device's network address reaches those services rather than ours. These are barn and address lookups; they do not carry rider identity.
weather.gov and Open-Meteo receive barn coordinates for enabled weather/safety features. No personal identity is sent.
what3words, if enabled, receives precise trail or SOS coordinates to return a location reference. It receives coordinates only, not identity — but those coordinates are a rider's position at that moment.
Apple and Expo provide app distribution and device permission/media frameworks. Apple photo, camera, microphone, and location permissions are controlled by your device settings; EquiWorld receives media only when you choose to submit it.
A calendar provider you select (for example Apple Calendar, Google Calendar, Outlook, or another iCal client) can receive the child-lesson title, date/time, status, barn name/address, trainer, arena, notes, and the secret iCal feed URL. This carries a child's lesson schedule to a provider you choose. Disconnecting calendar sync deletes our connection and invalidates that URL; the provider's copy is governed by its own practices.

Providers may process data under their own terms and privacy policies. Their retention and deletion controls can differ from ours, and we do not state a retention period for any provider that we have not confirmed against that provider's active agreement and configuration. We may also disclose information to authorized users in the applicable barn or relationship, to professional advisers, in a merger or similar transaction, or when reasonably necessary to comply with law, protect rights and safety, or investigate fraud or security incidents.

Required hosting, account security, email verification, and processing needed to complete a transaction cannot be withdrawn while the account or requested transaction continues. Optional features are separate: you can decline or withdraw AI processing for each purpose, decline or withdraw subscription processing, revoke location or media permissions in device settings, disconnect calendar sharing, and manage or opt out of SMS where offered. You can manage an Apple subscription through Apple. Withdrawing an optional choice stops future EquiWorld requests for that purpose; it does not by itself delete information already held by a provider, another authorized user, a backup, or a record subject to the retention limits below.

Location, files, and audio

Foreground location is optional. You can decline or revoke permission in device settings, although location-based features will not work without it. A one-time nearby search is not intentionally stored by EquiWorld; trail-session and barn coordinates are stored with the relevant session or barn. We do not use background location in the Service.

Trail sessions record where a rider is. A trail-ride session stores the starting position, the most recent position, and a trail of the most recent location points taken during the ride, together with a what3words reference. This applies to any rider who starts a trail ride, including a rider who is a minor and holds their own account. A rider can share a live link to their ride and can revoke that link. If a rider triggers SOS, or does not check in by their planned return time, their current location and a link to their live ride are sent to their safety contacts and to the owners of the barns they are associated with, whether or not the rider had otherwise chosen to share location with that barn. This is deliberate — it is the point of the feature — but it means a barn owner can receive a rider's position in an emergency.

We do not currently enforce a time limit on stored trail-ride location history. A short, defined retention window is proposed and is pending approval; this policy will state the period once it is in force, and will not state one before then. A rider or their guardian can delete this history at any time through the deletion described above.

Files, photos, documents, signatures, and audio are collected only when you choose to provide them. Their visibility follows the resource or audience to which they are attached, which may include a barn, horse, guardian, provider, chat, community, or public surface. Temporary ride-journal audio is deleted after transcription; the transcript and structured journal fields may remain.

Barn-discretionary coaching, feed, program, and scheduling records can be configured as not visible to the horse owner or family. Medical records, horse-health events, treatment plans, and owner documents cannot be hidden by a barn-wide default; exceptional per-record withholding must carry a reason and be audited. For a rider export, the category report identifies the number withheld without revealing protected contents.

Retention, exports, and account closure

We retain information for as long as needed for the purposes above, to operate the records and relationships you use, and to meet legal, accounting, dispute, security, and audit obligations. Specific operational periods that are enforced today include:

verification codes expire within minutes, and are deleted when used or when an account is closed;
a signed-in session is valid for 30 days and is revoked on logout, password change, and account closure;
pending or failed durable uploads are swept after one hour;
an export download link expires after 24 hours; its private archive is retained for up to seven days so it can be renewed, then is deleted; deleting export history deletes the retained private object;
AI extraction review fields are retained for at most 30 days while awaiting review, and raw model responses are not retained;
aggregate template counters are pruned after 365 days; and
operational logs are searchable for 30 days and kept in encrypted archives for no more than 90 days, and development logs are retained for seven days. These are hosting-configuration periods rather than application code, and are confirmed against the deployment for each release.

Some categories have no enforced time limit today, and we would rather say so than imply a limit we do not enforce: trail-ride location history, emergency and safety contacts, uploaded files that remain attached to a live record, financial records, signed waivers and parent documents, authentication security events, and internal audit records of visibility changes. Emergency contacts are deliberately not expired, because a contact that disappears on a schedule is a safety failure. For the others, defined periods are being set and will appear here once they are enforced rather than merely intended.

The Task 573 candidate is intended to replace that baseline with these periods: precise completed-ride location detail after 90 days (retaining a minimal non-location session stub); eligible unlinked-child data after a warned 90-day recovery window; ended session rows after 90 days; unused verification codes after 24 hours; authentication security events after 180 days; and visibility audit records after the relationship plus 24 months. Emergency and safety contacts are reconfirmed annually rather than deleted automatically. Seven years for signed and financial records is provisional and subject to identifier minimization where record integrity permits. None of these periods may be published as an active control until candidate enforcement is verified; the seven-year treatment additionally requires qualified approval.

Ready files remain while referenced by an owning record and are retired when a supported owning record is replaced or deleted and no live reference remains. Closing an account does not by itself delete uploaded files: a file may be attached to a barn or horse record that continues to exist. Financial transaction, webhook, signed-document, security, and audit records can require longer retention. Backups and provider systems may retain data for their documented recovery or retention windows.

The in-app account-closure flow requires your current password and typing DELETE exactly. Once completed, it revokes active sessions, deletes verification codes, and anonymizes the account and directly linked rider profile, including contact information and the login credential. Barn owners must first transfer every barn they own.

Closing your account does not remove a child rider profile you created. A child profile is a separate record with no account of its own, and account closure does not reach it. Use the child-data deletion described under Children and riders who have no account to remove a child's data. If you close your account without doing so, contact privacy@equiworld.app.

Account closure also does not erase records that another authorized person or barn controls, records needed to preserve another person's access or the integrity of a shared operational record, or information we must retain for financial, tax, accounting, signed-document, audit, security, fraud-prevention, dispute, legal-hold, or legal-compliance purposes. A stable anonymized account tombstone and payment identifiers may therefore remain. We will explain the applicable outcome and any retained or referred records in response to a verified request.

Your choices and requests

You may update available profile and record information in the Service. Depending on your role, an authorized barn owner or other record controller may need to correct or delete barn-controlled or shared records. You may request access to, correction of, deletion of, or export of personal information, or initiate account closure, by emailing privacy@equiworld.app. We verify requests before acting and may ask for information needed to confirm authority. You can also disconnect a calendar subscription, manage notification/SMS preferences, and change device permissions through your device settings.

Creating an account does not authorize optional AI processing, location sharing, calendar sharing, SMS, or a subscription purchase. Before registration email delivery, the web registration screen explains that Replit stores the submitted account details and Resend receives the email address, verification code, and delivery content. A separate feature action or choice applies where optional processing is offered.

The in-app export has three scopes. The personal horse export covers horse, care, training, document, and related financial records available to you. Barn owners can generate owner-authorized barn exports. A separate rider export covers an identified rider's available profile and associations, emergency and safety contacts, guardian relationships, parent documents, waiver assignments and signatures, lessons and lesson notes, trail-ride history, show recap cards, competition registrations and results, and rider documents. A rider may request their own rider export, and a current guardian may request one for their linked child even if the child has no account or horse.

Rider archives may contain sensitive contact, allergy, medical or health information, typed signatures and signing metadata, photographs or video, and precise trail locations. Store downloaded archives securely and share them only with authorized recipients.

Exports follow the same authorization and visibility rules as the Service. Emergency and safety contact names and details are included because they form part of the rider's safety record, so the recipient must protect those other people's information too. Bearer tokens, token hashes, payment credentials, account identifiers, IP addresses, and other security material are excluded. Unrelated guardian, trainer, staff, barn, and internal account identifiers are removed while relevant relationship status is retained. Horse health/care records, documents, and lesson notes marked not visible to the rider or guardian are counted but their contents are withheld. The rider-export preview and archive report included and withheld or redacted categories; a withheld count confirms that records exist but does not reveal their contents.

Email privacy@equiworld.app if self-service is unavailable, you believe the export is incomplete, or your request requires individual review. We verify identity and guardian authority before acting. Shared records, third-party rights, legal holds, and applicable legal exceptions may require manual and legal/privacy review. We do not claim that every case can be resolved automatically or that a particular withholding rule applies under every law.

Security and changes

We use reasonable administrative, technical, and organizational measures designed to protect information. No method of transmission or storage is completely secure. Please protect your credentials and notify us promptly of suspected unauthorized use.

We may update this Privacy Policy. We will post the updated policy with a new effective date and, where required, provide additional notice or obtain consent.

Contact

EquiWorld Inc. Privacy: privacy@equiworld.app

---

Strip this appendix before publication. It exists so a reviewer can check every factual assertion above against the code rather than against someone's memory, and so the next person to edit this policy can see what each sentence rests on. Paths are relative to the repository root; api/ abbreviates artifacts/api-server/src/, db/ abbreviates lib/db/src/schema/schema.ts.

| Assertion in the policy | Verified at | | --- | --- | | Rider export is limited to the rider or a current guardian, reports included/withheld categories, and persists its rider target for job retries | api/dataExport.ts; api/riderPrivacyAuthorization.ts; db:exportJobs | | A child profile is created by a parent with name, level, date of birth; the rider has no user_id | api/routes/routes.ts:10788-10816 | | Rider record fields, including nullable date_of_birth | db:480-499 | | Access follows current relationships; ending an association ends access on the next request | api/authorization.ts:92-182 | | Barn owners reach riders currently associated with their barns; trainers reach riders they are currently associated with | api/authorization.ts:107-131; canAccessRider :241-245 | | Guardians reach their linked children | api/authorization.ts:162-179 | | Service providers get barn scope, not rider scope; they reach horses at a granted barn | api/authorization.ts:152-160; canAccessHorse :247-256 | | Guardian can read a child's emergency contacts | api/routes/routes.ts:13098-13117 | | Emergency card is unauthenticated, returns child name and all contacts, does not expire, is revocable, revoked links stop resolving | api/routes/routes.ts:13355-13366; db:1614-1626; api/storage.ts:4571-4578, :4584-4593 | | Deletion is restricted to the rider or a current guardian | api/routes/routes.ts:13294-13307 | | What deletion removes, and rider-row anonymization including date_of_birth | api/storage.ts:4506-4555, specifically :4520-4533 and :4537-4544 | | What deletion retains, and why | api/storage.ts:4499-4504; response body api/routes/routes.ts:13312-13319 | | A child's name survives inside signed waiver records (onBehalfOfName) | db:2346-2361; absent from the erase path at api/storage.ts:4520-4533 | | Parent documents hold typed signature and IP address | db:1588-1600 | | Lesson notes hold trainer assessment, skill ratings, mediaUrls; default not visible to owner | db:1693-1703 | | Recap cards hold event, rider name, horse name, placing, comment — no photo column | db:1788-1799 | | A trail ride can only be started by the authenticated rider for themselves; a guardian-created child (null user_id) cannot have one | api/routes/routes.ts:12117-12146; location update rejects a session that is not the caller's, :12197-12224 | | Trail sessions store start/last coordinates, what3words, and the last 100 GPS points | db:1443-1479; api/routes/routes.ts:12212-12220 | | Share link can be rotated and revoked | api/routes/routes.ts:12156-12195 | | SOS discloses location and share link to safety contacts and to barn owners | api/routes/routes.ts:12264-12316; overdue path :12846-12858 | | No retention limit on trail-ride sessions; only deletion removes them | api/storage.ts:4525 is the sole delete against the table | | Account closure anonymizes riders matched by user_id only — a child profile has none | api/storage.ts:643-712, rider update :677-683 | | Session validity 30 days; revoked not deleted | api/storage.ts:590-599, :611, :624, :633, :670-672 | | Verification codes expire in 15 minutes, deleted on use and at closure | api/storage.ts:442-465, :494-502, :673-675 | | Durable uploads swept after one hour | api/lib/durableUploads.ts:91; api/routes/uploadedFiles.ts:304-308 | | Export link 24 hours, archive 7 days | api/dataExport.ts:18-19, :702-730 | | AI review fields 30 days; raw responses not retained; daily sweep | api/routes/routes.ts:159-160, :242-263; api/storage.ts:5739-5786 | | Template counters pruned at 365 days (env-configurable default) | api/waiverLibrary.ts:2007-2018; scheduled api/routes/routes.ts:11684-11704 | | Two separate AI consent purposes: Anthropic for document extraction and OpenAI for ride journals; each is versioned by disclosure content hash and re-requested when stale | lib/db/src/aiConsent.ts; enforcement artifacts/api-server/src/aiConsent.ts | | Subscription processing is a separate consent purpose, provider RevenueCat | lib/db/src/aiConsent.ts:34-39 | | RevenueCat is configured client-side with an app user ID; no server-side RevenueCat call exists | artifacts/equiworld/lib/revenuecat.tsx:36; no match for RevenueCat in api/ | | Stripe is called server-side | api/routes/routes.ts:13405 | | Twilio receives the SMS body | api/sms.ts:274 | | Resend calls are proxied through the Replit connector | api/email.ts:23-50 | | Nominatim geocoding, server-side | api/routes/routes.ts:1558 | | Nominatim autocomplete and reverse geocoding, direct from device | artifacts/equiworld/components/AddressAutocompleteInput.tsx:55; artifacts/equiworld/lib/overpass.ts:177 | | Overpass nearby search, direct from device | artifacts/equiworld/lib/overpass.ts:94 | | weather.gov | api/routes/routes.ts:11899, :11922, :11945 | | Open-Meteo | api/routes/routes.ts:15002 | | what3words receives coordinates | api/routes/routes.ts:12007-12013 | | Owner-entitled medical, health, treatment, and document categories cannot be hidden by a barn-wide default; discretionary categories remain configurable | api/visibility.ts; api/__tests__/ownerEntitledVisibility.test.ts | | Rider privacy authority is deliberately limited to self or a current guardian and is shared by subject access and deletion | api/riderPrivacyAuthorization.ts; rider export/deletion routes |

Unverified, and to be confirmed before publication:

Task 573 candidate implementation and independent results, including age, parental authorization, majority review, sharing lifecycle, emergency-card abuse controls, and every new retention sweep.
Task 358-equivalent rider/guardian symmetric export/deletion evidence in the same immutable candidate.
Qualified approval of the parental-authorization method, provisional seven-year signed/financial treatment, and final public policy.
Operational log retention (30/90/7 days) is a hosting-provider setting, not application code. Confirm against the deployment configuration.
Every provider-side retention and deletion setting. None is claimed in the policy text, which is the correct posture until each is confirmed against the active agreement.
Backup and point-in-time-recovery windows; see docs/DATABASE_RECOVERY_RUNBOOK.md.

Related internal documents: docs/childrens-data-position.md, docs/data-retention-schedule.md, docs/subject-access.md, docs/ai-document-extraction-security.md, docs/privacy-safe-observability.md.