Dark Horse Stables Privacy Policy

Last updated: 24 June 2026

Dark Horse Stables ("we", "our", "us") is operated by AI Brain Forge based in New South Wales, Australia, and runs a social fantasy-sport horse-racing competition app for private friend groups. This policy explains what information we collect, how we use it, and your choices.

1. Information we collect

• Account details: your chosen display name, username, and a password (stored only as a one-way bcrypt hash — we never see your password).
• Club activity: your picks, scores, chat messages, cosmetics claimed, and achievements earned.
• Device data: your device sends a standard IP address and user-agent header when talking to our API; we use these only for rate limiting and error diagnosis.
• Purchase & gift records: if you make an in-app purchase, Apple or Google sends us a transaction receipt. If you buy or gift an item on the web, our payment processor (Stripe) tells us the purchase succeeded and we store a purchase record (the item bought, amount, currency, and Stripe's transaction/session references). We never see or store your payment card details — those are entered directly into Stripe, Apple, or Google.
• Gift-recipient email: if you send another person a gift, you provide their email address (and an optional message). We use it only to email that person their gift code, and we store it on the gift record so the gift can be redeemed and supported.
• Contact email (optional): if you add an email address to your account, or use a magic link / password reset, we store that address and use it to send you account and gift-related emails. An email address is optional for play.
• Push notification tokens: if you allow notifications, your device registers a push token (and its platform — iOS, Android, or web) with us so we can send you alerts. You can revoke this at any time in your device settings.

2. How we use it

We use your data to run your club's competition — to record picks, compute leaderboards, and display chat inside your club — and to process the purchases, gifts, emails, and notifications described above. We do not sell your data. We do not use your data for advertising. We do not share your data with third parties except with the service providers required to operate the app (see “Service providers” below) or as required by law.

3. User-generated content

Chat messages and custom notes you enter are visible to other members of your club. You can delete your own messages, mute members you don't want to see, and report messages that violate our community rules.

4. Payments & gifts

Premium items are cosmetic only. On mobile, purchases are handled by Apple's App Store or Google Play; we receive a transaction receipt to unlock your item. On the web, purchases and gifts are handled by Stripe, our payment processor. You enter your card details directly into Stripe's secure checkout — we never receive or store your card number. We store a purchase record (the item, the amount and currency, and Stripe's transaction and session references) so we can grant your entitlement, support you, and handle refunds.

When you gift an item, you give us the recipient's email address and an optional message. We email that person a gift code so they can redeem it, and we keep the email address and message on the gift record so the gift can be redeemed and supported. We do not use gift-recipient email addresses for marketing.

5. Push notifications

If you allow notifications, your device registers a push token with us, which we use to send you alerts (for example when you've been overtaken, a race is about to lock, or it's time to set your picks). Android and web notifications are delivered through Google Firebase Cloud Messaging (FCM), and iOS notifications through Apple's push service (via FCM). We store the push token and its platform; we never put sensitive content in a notification. You can turn notifications off at any time in your device settings, and every notification is also kept in your in-app inbox.

6. Service providers

We share the minimum data needed with the providers that run the app on our behalf. They process it only to provide their service to us:

• Stripe — web payment processing (you enter card details directly into Stripe).
• Apple App Store / Google Play — in-app purchases on mobile.
• Resend — sending account and gift emails on our behalf.
• Google Firebase Cloud Messaging and Apple Push Notification service — delivering push notifications.
• Sentry — optional, consent-based error diagnostics.
• Our hosting provider — running the servers and database.

7. Data retention & deletion

You may delete your account at any time from Settings → Danger Zone. When you delete your account, we permanently remove your profile, chat messages, picks, and any other personally identifying data from our database within 30 days. Aggregate leaderboard history belonging to your club may be retained by your club's organiser.

8. Children

Dark Horse Stables is strictly an 18+ service and is not directed at anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe we have, please contact us to remove it.

9. Security

We transmit all data over HTTPS. Passwords are stored only as bcrypt hashes. Authentication tokens are signed JWTs. No system is perfectly secure, so we encourage you to use a unique password for your account.

10. Contact

Questions about this policy, or requests to access or delete your data, can be sent to privacy@darkhorsestables.com.au.