Privacy policy

Effective date: 2026-08-11 (closed-beta edition) · Last updated 2026-08-11

This policy explains what Dressage Performance Initiative (“DPI,” “we”) collects, why, and what you can do about it — whether or not you have an account. We have tried to write it so a rider can actually read it.

1. The honest headline

DPI is built on publicly published horse-show results. We compile results that shows and their scoring vendors already publish on the open web, and we organize them into rider profiles with rankings, analytics, and score forecasts.

That means: DPI probably has a profile about you even if you never signed up. Today the database holds roughly 21,000 rider profiles built this way, and nearly all of them belong to people who have never created an account. We think you should hear that from us plainly, and §3 explains what you can do about it — including how to get out.

2. What we collect

a. Public competition results (everyone in the corpus)

Results compiled from sources that publish them:

• Show scoring vendors — Fox Village, Horse Show Office, and Show Secretary result pages, collected by an automated weekly job covering the prior week.
• Rider self-submissions — USDF lifetime score reports uploaded by the rider, and Equestrian Hub scoresheet links shared by the rider.
• We do not scrape USEF or FEI systems. Federation data arrives only by rider self-submission or, in the future, formal partnership.

These records contain what the show published: rider and horse names, show, date, class/level, judges, scores, placings — and in some sources movement-level marks. We also hold federation member IDs and dates of birth where a source included them; these are not shown publicly (§3, D35). [VERIFY before publication — whether any collected source fields beyond those listed are stored; member IDs and DOB are confirmed present per the D-d/D35 record.]

b. Account data (members only)

Email address, display name, a hashed password (never the password itself), the timestamps of your Terms/Privacy acceptance, your referral code and referral activity, your claimed profile, goals, and settings.

c. Content you submit

Uploaded score reports, shared scoresheet links, corrections, data-issue reports, and dispute reports — with the timestamps and context needed to review them.

d. Technical data

Server logs (IP address, request, timestamp) for security and operations; a first-party authentication cookie when you sign in; and cookieless, aggregate page analytics (§11). We do not collect precise location, contacts, or advertising identifiers.

3. If you never signed up: your profile, and how to remove it

What exists. If you have competed in US dressage, DPI may show a public profile page with your name and your published competition results, plus analytics computed from them. Public profile pages are indexed by search engines; our sitemap lists rider pages.

What we keep out of public view.Date of birth and federation member IDs (USDF/USEF/FEI numbers) are removed from the public rider payload; they are visible only to the profile’s verified owner and to our administrators. Public profiles are additionally limited to basic, non-sensitive stats for anonymous visitors. (Approved 2026-08-11, D35 — payload redaction plus slimmed public profiles; this paragraph must match the deployed state before this text publishes.)

How to get out. Email support@equestrianperformanceinitiative.com from any address, tell us the profile is you (we may ask a simple verification question to avoid removing someone else’s record), and ask for removal or de-indexing. We will act within 30 days. An in-product removal request surface is being built; email works now.

What removal does. Our default is to de-list the page from search engines and our sitemap and suppress the public profile page, while retaining the underlying result rows so aggregate statistics stay correct. Where a governing state law grants you a right to full deletion, we honor it. We cannot remove the show’s original publication of the results, and results already blended into aggregate statistics (e.g., a class average) may persist in aggregate, non-identifying form.

4. Children and minors

Competition results published by shows include riders in youth divisions (junior, young rider, children, pony). Our compiled corpus therefore includes minors’ public competition records. Here is our posture, stated plainly:

• Accounts: DPI accounts require a minimum age of 18 during the closed beta (same rule as ToS §2 — the invite-only, founder-controlled cohort makes this trivially satisfiable, and it is the maximally safe default while COPPA counsel is deferred per D34). We do not knowingly let anyone under 18 create an account, and we close accounts we discover are underage.
• What we don’t do: we do not knowingly collect personal information fromchildren (COPPA’s trigger); the youth data we hold was published by shows about their entrants, not submitted by children to us. We do not show dates of birth or federation IDs publicly (D35, see §3), do not sell anyone’s data (§7), and run no behavioral advertising.
• What we do: youth results appear in public profiles and rankings like any other published result — public records aboutminors still exist in the corpus, and the D35 payload redaction and slimmed public profiles govern what of those records is exposed. A parent or guardian can use the §3 removal mechanism on a minor’s profile, and we will prioritize those requests.

5. How we use data

• Profiles and rankings — assembling results into rider/horse profiles, leaderboards, and rating systems. Results under formal dispute are excluded from public rankings pending resolution (decided 2026-08-11, D36).
• Analytics and forecasts — movement-level analytics, judge context, score trends, and calibrated score-range forecasts. Forecasts are ranges, not promises, and we do not publish bare per-person win probabilities.
• Qualification planning— mapping a rider’s record against qualification requirements for goals they set.
• Verification— a result is marked “verified” only when the rider has linked or submitted their own USDF or FEI competition history and it corroborates the result we found from the show’s published source (D33). Vendor-scraped data alone is never “verified,” and bare self-assertions never confer it; linking your federation history is what verifies your matching results.
• Operating the service — accounts, email verification, the referral program, support, security, and debugging.
• We do not use your data for third-party advertising, and we do not train or sell general-purpose models on it for others.

6. Our lawful basis

United States. We compile information that was publicly published by competition organizers and their scoring vendors, and we process it for the legitimate business purpose of sport analytics and record-keeping. Several state privacy laws exempt or reduce obligations for publicly available information. We have not yet made a formal determination of which state privacy laws apply to us at our current size (most carry volume or revenue thresholds); that determination is owed at the counsel pass. We honor the rights in §10 regardless of whether a statute compels it.

Europe.DPI is offered in the United States and does not target the EU; the closed beta’s cohort is founder-invited and US-based. We do not claim GDPR machinery we do not have.

7. Sharing — who sees your data

We do not sell personal data. We do not share it for targeted advertising. We share data only with the service providers that run the product, and with authorities when the law genuinely requires it.

Current processors (verified against code/configuration 2026-08-10):

Public data is public: anyone can view public profile pages, and search engines index them.

8. Retention

• Public competition results — retained indefinitely as a sport record, subject to §3 removal requests. Public competition records are governed by the removal-request process, not account deletion (see §10’s honesty clause).
• Account data — for the life of the account, then deleted within 30 days of account deletion, except records we must keep (e.g., payment/tax records once payments exist, fraud evidence).
• Server logs — 90 days.
• Database backups — pruned on a 14-day retention cycle (verified in configuration: BACKUP_RETENTION_DAYS=14), so deleted data leaves backups within ~14 days of deletion.
• Support and dispute correspondence — 24 months after resolution.

9. Security

Passwords are stored only as hashes. Traffic is encrypted in transit (HTTPS). Access to production systems is limited to the operator. Payment card data, when payments open, is handled by Stripe and never touches our servers. No system is perfectly secure; if a breach affects your personal data we will notify you as state breach-notification laws require.

10. Your rights

If you have an account:

• Access and correction — see and correct your account data and profile from settings, or by email.
• Deletion of your account — request it any time; we delete account data within 30 days per §8.
• Honesty clause — account deletion is not record deletion. Deleting your account removes your login, email, goals, and claims. It does not automatically remove the public competition record— that profile exists independently of your account (you claimed it; you didn’t create it). If you want the public record removed too, say so in the same request and §3’s removal process applies. We will always tell you which one we did.

Whether or not you have an account:

• Correction and disputes — report an incorrect result from the result page or by email; formally disputed results come out of public rankings pending resolution (D36).
• Removal/opt-out of the public profile — §3.
• State-law rights — where a state privacy law grants you access/deletion/portability rights against us, we will honor them; contact §12.

We do not discriminate against anyone for exercising these rights.

11. Cookies and analytics

• Visitors (not signed in): zero cookies. No cookies, no local storage, no third-party scripts. This was verified in-browser in the 2026-08-09 review, and it is why the site shows no cookie banner — there is nothing to consent to.
• Signed in: one first-party authentication cookie that keeps you logged in. Essential only.
• Analytics: we use Vercel Analytics in cookieless mode — aggregate page counts, no cookies, no cross-site tracking, no advertising use. (This disclosure is new; the previous live policy omitted it — LEG-05.)

12. Contact

Dressage Performance Initiative

Privacy requests: support@equestrianperformanceinitiative.com

13. Changes to this policy

We may update this policy. Material changes get notice — email to account holders and a site notice — at least 14 days before taking effect. Dated prior versions available on request.

By creating an account you also agree to the Terms of Service.