Privacy

What we do not collect

No phone number, no advertising identifier, and nothing from your phone's address book. The app never asks for them. Your friend list in Neigh (who you added) is kept with your account. Your clips, your horse's history and your settings live in storage on your device.

Location. The app never asks your phone where it is, and your phone is never able to tell us — there is no location permission in it and no way for one to be requested. If you switch on Paddock weather in Settings, the app asks our own server what the weather is, and our server works that out from roughly where your internet connection comes from — to the nearest town or so, used for that one question and never written down. What comes back to your phone is the weather and nothing else: no place, no town, no coordinates. The switch is off until you turn it on, turning it off again clears the last reading, and with it off nothing is asked at all.

Your account

Every reading is made on your phone, signed in or signed out, and nothing about the analysis changes either way. What the account changes is where your stable lives: it is what brings your horses back on a new phone. You do not need one to use the app. The first run ends by offering an account, and you can turn it down with Continue on this phone; on the iPhone app it asks once more, and Continue without one takes you into the app, while in a browser the first tap does. If you sign out or delete your account, the app shows its sign-in screen, and the same Continue on this phone link is on it: on the iPhone app it asks once more, as the first run does, and either way it takes you to your horses, signed out. Your horses and recordings stay on your phone, and closing the app and opening it again also opens to them, signed out. Either way the readings are the same.

If you do sign in, it is with Sign in with Apple, with Google, or with a 6-digit code we email you. With Apple or Google we are given the same three things: an identifier for your account, an email address, and your name if you chose to share it. From Apple the address is Apple's private relay if you chose Hide My Email, and the name arrives once, at the first sign-in only; from Google both arrive each time you sign in, and we ignore an address Google has not verified. With email we are given the address you type, and the code is how you show it is yours. Resend is the email service that sends the code: it is given that address and the code, and nothing else. The code works once, for ten minutes; we keep it only as a scrambled hash, filed under a scrambled copy of the address, and delete it within about an hour. We keep the rest to know whose stable is whose. We do not sell any of it, we do not use it for advertising, and there is no tracking across apps.

An Apple account and a Google account are two separate accounts, even when they use the same email address. Signing in with the other one gives you a new, empty stable rather than the one you already have. An email code is different, because it proves you read that inbox: it opens the account that already has that address — the one you used most recently, if an Apple and a Google account both have it — and keeps opening that one from then on. With no such account it makes a new one. An Apple account using Hide My Email has only its relay address, so it is found by that address and not by your usual one.

What is saved to the account: your stable. Your horses and what you told the app about them — name, sex, age, traits and the brag sheet you fill in (ribbons, details and family links between your own horses) — and how you drew and dressed each one: the breed, coat and markings of its picture and what it is wearing (the drawing, never your photo).

And the days you opened the app, so your streak is not lost. Signed in, the app saves the dates you used it — the date and nothing else, not the time or what you did — so that “days in a row” carries on if you delete the app or move to a new phone. They are yours, not your stable’s: someone you let work your stable never sees them, and they go when your account goes. All of this is what comes back when you sign in on a new phone.

What is not: your readings, their recordings and your horse photos. They stay on the phone that made them until you share. Recordings are read on this phone and stay on it — unless you attach one, yourself, to a care-team link (Plus plan, one reading at a time, five per horse, deleted when the link stops) or share sounds to the research corpus, one by a press or, once you have said yes to that, a few seconds around each horse sound the app picks out, named or not, with any voice talking during it. Signing in does not, by itself, upload a single recording; with Neigh Plus, the Memories backup below does, until you turn it off.

Backing up your Memories (Neigh Plus, on unless you turn it off). If you have Neigh Plus and are signed in on your own stable, what you keep in the app is backed up to your account without you having to do anything. Memories tells you once that it is on, and Stop backing up there turns it off; it then stays off until you tap Back up. While it is on, each photo you keep and each take the camera keeps — the picture or the recording itself, and for a take the app’s words about it — is saved to your account, so it comes back when you sign in after deleting the app or on a new phone. It is stored on Cloudflare’s servers, where we run the rest of the account, private to your account: nobody else can open it, and a care-team link or a friend never reaches it. Deleting a memory in the app deletes it from the backup too. Stop backing up in Memories deletes every copy from your account, and the ones on your phone stay. If Neigh Plus ends, the backup stops, and the copies are deleted 30 days after your account stops showing the plan; renew within those days and nothing is lost. Deleting your account deletes them straight away.

Refusals are cleared by themselves. A reading that named nothing — a refusal — is deleted from your phone 48 hours after it was saved, by default, recording and all. You choose the time in Settings, and Keep them turns it off entirely. A refusal you tapped Keep this one on, and any refusal you marked as a miss, is kept for good. Readings that named a call are never cleared this way, at any age and under any setting.

Your horse’s calls in the paddock. When a reading names a whinny, a snort or a nicker from one of your horses, the app keeps up to three seconds of it on this phone, a few of each, so your paddock horse can play it. They are never sent, and friends never get them. Deleting the reading, the horse or your account deletes them.

The exceptions are sharing, which you choose every time, and your Memories backup. Readings leave this phone when you have decided to show them to somebody, and a recording leaves it only when you attach that one recording yourself or, with Neigh Plus, in your Memories backup, which is on unless you turn it off.

Sharing a horse with your care team. When you share a horse with a vet or a trainer by link (a plan feature), that horse’s readings — the app’s words about each kept clip — and its training sessions (which routine, how it went, how long) are sent to your account so the link can show them. The link shows the horse’s name and readings and nothing about you. Stop sharing on the horse’s page and the readings are deleted from the account.

Putting a recording on that link. On a reading’s own screen you can attach the recording behind it, one at a time, so the person holding the link can hear or watch what the app was reading. Nothing is attached unless you press Attach on that reading; a link carries at most five, and it is the recording as you kept it rather than an extract. Anyone who has the link can play what you attached, so attach what you would send that person. Attached recordings are stored separately from the sounds people share with the research corpus, are never reviewed by us and are never used to teach anything. Take one off, stop sharing the horse, let the link reach its ninety days, delete the horse or delete your account, and the recording is deleted from the account with it.

One kind of sharing is written here before it is switched on. Staff seats, the next paragraph, are built but not yet on in the app you have; there is nothing on your screen to put somebody on your stable with. They are here so the promise is on record before the switch is turned, and this page will say when it is. Adding a friend, the paragraph after that, is on.

Letting someone work your stable (not yet on). You can let a trainer, a barn manager or whoever looks after your horse use your stable (a plan feature). They sign in with their own account. From then on your stable’s readings — again the app’s words about each kept clip — are saved to your account so that everyone working the stable sees one journal, and their entries carry their name. They do not see your plan, your billing, your email or how you sign in, and they cannot rename or delete your account. You can take them off at any time; what they already wrote stays in the journal, because it is your record of your horse. A seat carries the words only: the recording behind a reading is attached one at a time, by hand, to a care-team link, so a reading somebody else added has no sound to play back on your phone.

Adding a friend. You and a friend can each see the other’s horses in the paddock — the little drawn ones, out in a field. You add a friend by sending them a code, which works once and expires in a week, or by typing their exact username if they have chosen one. Nobody has a username until they choose one in Settings, it is kept on our account server with your account, and you can remove it at any time. There is no other search: the app never lists or suggests people, a name has to match exactly, and nothing in the app can look up a person by email address. When they use your code or ask by your username, it sends you a request, and you are not friends until you accept it. Before you answer, you can open the request to see who is asking: their name, their username if they chose one, the month they joined Neigh, the day they asked and how many friends you have in common (a number, never who), and nothing else, and the person you ask can see the same about you. Either of you can say no before then: you can deny the request, and they can take it back. What a friend sees is your horses in their paddock with your name beside them, and, when they open one, its profile: its drawing, sex, age, how many fields your paddock has open, the ribbons and details you added to its brag sheet, and two counts about you — how many friends you have and your current day streak. A friend never sees a reading — not a sentence, not a call name, not a date, not a recording, not a photo, not a note, and never who your other friends are. Either of you can undo it at any time and it ends for both of you, and nothing is kept afterwards to say you were ever friends.

Reporting and blocking someone in Friends. You can report a friend, or someone asking to be one, and you can block them. A report sends us who you reported, the reason you picked and any note you typed, and our server keeps a copy of what you could see of them at that moment: their name, and their horses’ names and brag-sheet words. Only our team reads it, to decide whether to take them out of Friends; they are not told who reported them. A block keeps a note that you blocked them, so the app can refuse their requests; they are not told, and you can undo it in Settings. Deleting your account removes your blocks, and your name from any report you made or that was made about you.

Deleting the account. Profile → Account → Delete account, inside the app. It removes your account and everything saved to it — including any recording you had attached to a care-team link and your Memories backup — and disconnects the app from Apple or Google, whichever you used. Recordings and photos kept on your phone stay on your phone. Your subscription is separate and is not touched by any of this, which also means deleting your account does not cancel it: only Apple can stop an App Store subscription, so cancel there first if that is what you want. If you had joined someone else's stable, your seat goes and your name comes off anything you wrote there. You can also just sign out, which ends the session on this phone and deletes nothing.

Analysis happens on your device

When you analyze a clip, the audio is processed by code running on your phone. The clip is not uploaded. If a future feature ever needs to send anything to a server for a deeper reading, the app will name the provider, say exactly what would be sent, and ask you first, on every installation, before the first byte moves. Having an account does not change this: the analysis is the same code on the same phone.

"Hear what I say while recording" (Settings, on unless you turn it off) lets the app hear what is happening from what you say ("feeding time"). It listens only while a take is actually recording, never to a clip you picked. In the iPhone app the words are recognised on the phone, and the app refuses to use a recogniser that cannot work on the phone. In a browser, the browser's own speech service may process your voice while a take records. Either way the app keeps only the few words it matched to a situation, shown on the reading's card; it never stores a transcript. Your phone asks for the speech permission by name before any of this can start.

It works in every language the app itself is available in. If you ever set the app to a language it cannot match words in, it does not listen at all and the switch is not shown — it will not spend a microphone permission on a recording it could not read.

When the app speaks a horse's line aloud, it plays a short pre-recorded file that shipped with the app (or uses your phone's own speech voice); nothing about you or your horse is sent anywhere to say it.

Usage counts

One count is sent whatever you answer. Each time the app is opened it tells our server so, and whether this is the first time that day and the first time ever. That is the whole message: no install number, no session number, no time from your phone, and nothing about you or your horse, so it cannot be used to tell one person’s visits from another’s. To know whether it is the first time that day, the app keeps the date of its last opening on your phone, and that date is never sent. Our server adds the count to the day’s total and passes it to PostHog in the same form, without making a profile of anyone. It is how we know how many people use the app at all, including the people who say no to everything below.

Crash reports are sent whatever you answer. When something in the app breaks, it sends a crash report to our server, which passes it to Sentry, an error-reporting service, so we can fix it. A crash report is the error’s message, at most 120 characters; where in the app’s code the error happened, as the names of the app’s own functions and the file and line numbers in the app’s code, never your content; the version and build number of the app; and the name and version of your phone’s system (“iOS 18.5”). Before it is sent, the app takes out of the message and the code locations anything that could point to a person or a place: web addresses, emails, long numbers and codes, and the names of folders on your phone. A code location names only the app’s own file, never a web address or a folder on your phone, and code that is not the app’s (a browser extension, for instance) is left out. Unless you have said yes to the usage counts below, it carries no install number, no session number and no time from your phone, it is not kept for later if there is no signal, and it is not linked to you or to your account. It never contains your audio, your words, your horse’s name, or a photo or video.

Everything else waits for your yes. The app asks whether it may send anonymous usage counts: which screens and controls were used, which look a photo or video was taken with, whether a tap was undone straight away, whether an analysis found something, how long a Live session ran, how warm the phone got during it and how long a shared video took to make, tagged with a random install number. With the same switch on, a crash report (above) also carries that install number, and the error is counted with the other usage counts. Never your audio, your words, or anything you can be identified by. Saying no changes nothing about how the app works, and the switch is in Settings, under “Usage counts”. If your phone has no signal when one of these is due, the app keeps it on the phone for up to a day and sends it once the signal is back; turning the switch off deletes any it is still keeping.

The same switch also records how the app moved on screen. So that we can see where people get stuck, the app can record its own screen while you use it — which screen you were on, what you tapped, how things moved. Every word is blanked out before the recording leaves your phone: your horse’s name, anything you typed, and everything the app said about a sound all leave as rows of dots, and every picture, photograph and sound-picture is removed and replaced by an empty box. What is left is the shape of the app and where your finger went, which is the part that tells us a button is in the wrong place. Nothing is recorded until you say yes, turning the switch off in Settings stops it straight away, and the same “never your audio, your words, or your horse’s name” promise covers it.

Who else sees them. Three companies handle these counts for us, and none is given anything more than what is described here. PostHog is the analytics service that stores the counts, and the blanked-out screen recordings described above, so we can see which parts of the app people use and whether they come back; the random install number is what it uses to tell one phone’s counts from another’s, and it is never joined to your account, your email, or your horse. Sentry is the error-reporting service that receives the crash reports described above, so we can see what broke, together with which version of the app it happened in and the name and version of your phone’s system (“iOS 18.5”, never the model, the full browser description, or anything that tells one phone from another); the install number is never sent with it. If the app was recording a session when the error happened, Sentry is also given that recording’s session number, so that an alert about a broken screen can be taken to the recording of it. That number is a random one made for a single sitting, it is not the install number, and it expires with the session — but it does mean those two services hold records that can be lined up with each other, and we would rather say so than not. Neither is given your audio, your words, or your horse’s name, because the app never sends those to us in the first place.

RevenueCat, the service that keeps our subscription records, is told that the app was opened, with the phone’s model, its system and app versions and its country, so we can see how many people who try the app go on to buy a plan. On an iPhone it is also given a number Apple assigns to this app on that phone, and Apple’s own note of which Apple Search Ads campaign, ad group and keyword, if any, the app was installed from; Apple makes that note without an advertising identifier and without asking to track you. Until you buy a plan RevenueCat knows the phone only by a random number of its own. If you buy one while signed in, it links that number to your account, as described under “Paying”.

What we keep ourselves. Our own server keeps the install number only as a one-day hash, for two days, to count how many phones used the app that day; the number itself is never stored on our side.

No advertising or tracking kit runs inside the app. Nothing in the app sets a cookie, reads your browsing, follows you to other apps or websites, or is shared with an advertiser or a data broker. The counts still go to our own server first, and the forwarding to PostHog happens there. The screen recording is the one thing that goes from your phone to PostHog directly, because a recording of a screen cannot be made anywhere but on the screen; it is made by PostHog’s recorder, which is part of the app, and it has been set up to keep no cookie, to record nothing unless you have said yes, and to blank out every word and picture before any of it leaves. We also tell PostHog not to store your phone’s internet address or work out where you are from it.

Shared sounds are a choice, made once or made every time

You can choose to share a single sound to help the recognition improve. Before anything is sent, the app shows exactly what would leave your phone: that one sound (the audio itself); its measurements (how long it is and a high-band ratio); whether you recorded it in the app or picked it from your files; the call the app named and the tone it gave that reading; your thumbs up or down on it, if you gave one; your word for it if you gave one; what was happening if you chose to say; the moment you pressed Send; and the app’s version number. A person reviews shared sounds. They are used to review and teach the recognition system, and for nothing else. They are not sold and not given to advertisers.

Or you can say yes once. The box on the sign-up screen (unticked until you tick it), the first press of Send on that card, or the switch in Settings called “Share my horse’s sounds” gives a standing yes. After it, every horse sound the app picks out, named or not, is shared on its own after the reading, anonymously: the same few seconds of sound around the call that the card would send, never the whole recording, with the same measurements and your word for it if you gave one, and the date you said yes in place of the moment you pressed Send. The question about what was happening is not asked. A take where the app heard a person speaking is shared the same way, so if someone was talking during a call, their voice can be in those few seconds. Never the bundled sample. A short line under the reading says how many sounds went. The switch in Settings turns it off; off stops future sounds and cannot recall ones already sent.

Video is a separate line under that switch, off unless you turn it on, and it covers only the same few seconds around each call, never the whole video. Today the app can prepare that window but the research corpus does not yet accept video, so nothing video leaves the phone until it does; this page will say so when that changes.

Separately, and only if you switch it on — the unticked box on the sign-up screen, the one-line ask under your first answer, or the switch in Settings — you can send the ANSWERS you give when the app asks "does that fit what you saw?": your yes, no or unsure; the call the app named and the phrase it offered; whether that phrase was a deliberate control (one offered knowing it did not fit, so the app can tell how often people say yes to anything); anything you typed in your own words when you disagreed; the situation you picked, if you did, and whether it was asked before or after the phrase; and roughly how long you took. No audio and no video go with those, and nothing in them says it was you. This is a separate switch from sharing a sound because it is a different kind of information: consent to send a recording is not consent to send something you wrote. It is off until you turn it on, and turning it off stops anything further being sent.

Shared still photos are a choice, and off until you say yes

You can choose to share a few still photos from your takes so the looks (the glasses, hats and ears the app draws on your horse) fit better. It is off unless you say yes. The app asks once, while you set it up, under the heading Help improve the looks?; if you set the app up before that question existed, it asks once on the result screen after a take where your horse wore a look, and never while you are filming. Not now is a no that is not asked again. You can change it any time in Settings, under Share still photos to improve the looks.

Only for adults. Before the question, the app asks once whether you are 18 or older. If you answer No, or do not answer, you are not asked to share photos and none are sent. Your answer is kept on your phone with your choice about photos, and it is not sent to us or to anyone else.

What is sent. After a take where your horse wore a look, at most three still photos from that take, picked at moments where the app looked for your horse’s head. Each is saved again as a plain picture no bigger than 1280 pixels, with the camera’s details (place, time, phone model and any other hidden data) taken out on your phone and again on our server. With them go where the app placed your horse, its ears and the points of its head in each photo, which look it wore, the app’s version, and the date you said yes. Never the video, never any sound, never your name, your account, an install number or where you are. A take shot on the front camera, or one the app can tell is mainly of a person, is never shared. Anyone or anything else in shot can still be in a photo: people in the background, the barn, a number plate. So share takes you would be happy for us to see.

Why, and who sees them. They are used to check and teach the part of the app that finds your horse’s head, so the looks sit in the right place, and for nothing else. Only people at Neigh look at them. They are stored on Cloudflare’s servers, where we run the rest of the app, in storage with no public address; no part of the app shows them to anyone. They are not sold, not given to anyone else and not used for advertising. Nothing sent with them names you or your account, so they are not linked to you.

How long we keep them. Two years. Every shared photo, and what was sent with it, is deleted automatically two years after it reaches us.

Stopping, and deleting what you shared. Turning the switch off in Settings stops any further photos straight away; it cannot recall ones already sent. To have those deleted too, use Delete photos I shared in Settings. Each time photos are sent, our server gives your phone a random receipt number for them, the only thing that ties them to your phone, and that button sends the receipts back so we delete those photos and refuse the same pictures if they are ever sent again. The receipts are kept on your phone and in its backup. If you deleted the app before asking, write to us (below) with the date you shared and a description or a photo of your horse, and we will find and delete them by hand.

Your feedback is read by our team only

Profile has a feedback page where anyone signed in can send us a bug report, a piece of feedback or a feature request. Only the Neigh team reads what you send: no other user can see your posts, and you see only your own, with the status we set on each. We keep its title, its details and the name on your account (or “A Neigh user” if there is none) so we can follow it up. Nothing else goes with it — no recordings, no readings, no horses. You can delete your own posts at any time, and deleting your account removes every post you made.

Paying

A purchase is handled entirely by the App Store, and we never see your card. There is no other way to pay, and no page of this app collects card details. What we keep is what the store tells us about the subscription - its identifiers, its status and its renewal date - so the app can tell whether your plan is paid for and so you can restore it. If you were signed in when you paid, the plan is tied to your account. Nothing about your horses or your recordings is ever part of a payment.

The store’s record of each purchase also goes to RevenueCat, a service that keeps subscription records for us, so we can see renewals, refunds and cancellations in one place. It receives the product you bought, the store’s own record of that purchase, your phone’s model, system and app versions and country, on an iPhone a number Apple assigns to this app on that phone, and, if you were signed in, your account’s number. RevenueCat decides nothing about your plan: whether it is paid for is still read from the store.

Apple handles the sale of that purchase for us, so cancelling it and asking for a refund happen with Apple rather than with us; the terms say how. Doing either tells us nothing new about you. What reaches us afterwards is the same subscription status the app already reads, which is how the app knows the plan has stopped.

Where a plan cannot be bought yet, the app offers to take an email address and tell you once, on the day it can. The early-access page on our website asks the same thing, and offers an optional phone number beside it. If you leave either, we keep that address, the phone number if you gave one, the name of the plan or page you asked from, and which of the languages we answer in we replied to you in — and they are kept only to send that one message. Ask us and we will delete it.

Deleting your data

Everything local is yours to delete: clearing the app's storage removes it. Refusals also go on their own, 48 hours after they were saved by default — see Refusals are cleared by themselves above for the control and the exceptions. If you have an account, deleting it in the app removes what was saved to it — see above. If you shared a sound and want it removed from the corpus, contact us with the approximate date of sharing and we will delete it; shared sounds are not joined to your account, so tell us roughly when. Still photos you shared are deleted on their own after two years, and Delete photos I shared in Settings deletes them sooner; see Shared still photos above.

Children

Neigh is not directed at children under 13. An account holds an Apple or a Google identifier, an email address (and, if an email code has opened it, that address as the way in), a name if one was given, a friends username if one was chosen, the provider token that lets the app disconnect itself from Apple or Google when you delete the account, when it was last used, the sessions of the phones signed in to it and their friend list, and nothing else about a person: no age, no location, no behavioural profile, and no profile of anyone of any age is built.

Contact and changes

Questions or deletion requests: info@cipherandrow.com. Most of what this app holds never leaves your phone, so deleting the app or clearing its data removes it; write to us for anything you have shared with us on purpose, and use Stop backing up in Memories, or delete your account, for a Memories backup. If this policy changes, the date below changes with it, and material changes will be shown in the app before they apply.

Last updated: 2026-10-12