Headgate Privacy Policy

Who this is about

Headgate is ranch record-keeping software. A ranch signs up, and the people that ranch invites use it to keep track of their cattle, their health and treatment records, their pastures and their money. This page describes what the software stores, where it is kept, and the handful of outside services any of it is ever sent to.

There is no public sign-up. An account is created for a ranch by the operator of Headgate, and the ranch decides who else gets a login.

What a ranch stores

Whatever its people type in and photograph. In practice that is:

• Animals — tags and names, breed, sex, dates of birth, weights, parentage, purchase and sale records, and where each one is.
• Health and treatment records — products given, doses, routes, who gave them, and the withdrawal dates that follow.
• Photographs and documents — animals, equipment, receipts, genetics reports, bills of sale, and anything else attached to a record.
• Money — purchases, expenses, sales, contacts, and the per-animal cost and return figures worked out from them.
• People — each user's email address (which is also their username) and the name they chose to display. Accepting the terms of service records the typed name of whoever accepted and the network address the acceptance came from.
• Places, roughly — ZIP codes: the ranch's mailing ZIP, a ZIP per pasture for rainfall, and a buyer's ZIP on a bill of sale. The software never asks the phone or the browser for its location, and there is no map of where anybody has been.

Where it lives

Each ranch has its own database on the operator's server. No ranch can see another ranch's records — that separation is the shape of the system, not a setting.

Backups are taken before every upgrade and every night. The nightly copy is encrypted before it leaves the server and stored off-site with Cloudflare R2, where nobody can delete it for its first 30 days. Off-site, nightly copies are kept 35 days, weekly copies 91 days and monthly copies about 13 months (400 days); an archive copy made at your request is kept until you ask us to remove it. Only the operator holds the key that opens them. (Backup schedule as of 2026-10-07.)

Who it is shared with

Headgate does not sell ranch data, does not trade it, and does not use it to advertise anything. Nothing about one ranch is shown to another. Records leave the server only in the specific cases below.

Cloudflare

Every request reaches the software through Cloudflare, so Cloudflare handles the connection and sees the usual details of a web request: the address asked for, the network address it came from, and the browser or app making it. Cloudflare also injects its own small measurement script into pages it serves, which reports page-load timings back to Cloudflare. That script is Cloudflare's, not Headgate's; it carries no ranch records.

Google and Anthropic — only with the AI features in use

Headgate has two optional features that need a large language model: the assistant that answers questions about the herd, and reading a photographed receipt so the expense form fills itself in. Both are answered by Google (Gemini) or Anthropic (Claude), depending on how the ranch is set up. If that provider is down, the same request can be answered by the other one instead, when a key for it is set up as a backup; the answer says when that happened.

When somebody uses them, the relevant records go to that provider with the question: animal names and tags, breed, sex, dates of birth and weights; the products, doses, routes and withdrawal days on the treatment records the question touches; the withdrawal restrictions and vaccinations currently due; and, where the question is about money, per-animal cost and return figures. Reading a receipt uploads the photograph of the receipt itself.

Nothing is sent to either provider unless one of those two features is used. Neither feature is required to use any record screen in the software, and a ranch can leave them switched off.

Open-Meteo — weather and ZIP lookups

Pasture rainfall is read from Open-Meteo, a free weather service. For each pasture with a rainfall ZIP set, the ZIP is sent once to turn it into a point on the map, and the daily rainfall is then fetched for coordinates rounded to two decimal places — about three quarters of a mile, deliberately, so the request does not describe a particular place. If market prices are switched on, the ranch's mailing ZIP is sent the same way to work out which sale barn is nearest. Nothing about an animal, a person or the ranch's name goes with either request.

National Beef Wire and USDA — market prices

With market prices switched on, Headgate fetches the latest sale report for the barn the ranch picked from National Beef Wire or the USDA's public market news, and the weekly auction summary for its state from the same USDA service. Every request carries an identifier for the report being asked for — a barn number, a state report — and nothing else. Neither request says who is asking or what they own.

The email relay

When Headgate sends email — a new ranch's welcome, a password-reset link, an account-deletion request — it goes through the operator's mail provider, which necessarily sees the recipient's address and the message.

Alerts — nothing leaves the ranch

When alerts are switched on, the iPhone app asks this server what is due over the next week and the phone then shows those reminders by itself, from its own clock. Nothing is sent to Apple, and there is no push service and no third party in it at all — which is also why the reminders still arrive with no signal.

Siri — what Apple hears, and what we do

Saying "Hey Siri, Headgate heat" is a conversation with Apple's Siri, and what you say to Siri is handled by Apple under Apple's own privacy terms; Headgate is not part of that and never receives a recording. What reaches this server is the finished text of what you named — an animal, and a note if you dictated one — sent to this ranch's own records and nowhere else. The iPhone holds a key for that in its Keychain; it is listed on the Settings page, and it is turned off the moment anybody signs out. Siri cannot delete anything, and it cannot record a death.

It can now record a treatment, a calving and a sale, and all three are read back to you in full — the product, the dose and the date the withdrawal clears, or the buyer, the head and the figure — before anything is saved, and none of them goes anywhere near an AI provider. A product you have not entered in your own medication library is refused rather than guessed at, because a treatment with no label behind it has no withdrawal date. A sale is booked as unpaid until you say the cheque cleared, and only somebody whose sign-in is allowed to see the ranch's money can record one by voice at all. Anything saved by voice can be taken back for a day by saying "Headgate undo".

"Headgate log" and "Headgate ask" — where the words go

These two are the only voice phrases that use the AI assistant, and they use the one you configured under Settings › AI Assistant. The text of what you said is sent to that provider, exactly the way a question typed into Ask Headgate is, along with the same kind of record extract Ask Headgate sends. Nothing is sent to any provider if you have not set one up; those two phrases simply say so, and the other eight keep working — "Headgate treated" and "Headgate calved" included, which never reach a provider at all. The provider never writes to your records — it proposes, Headgate checks every part of it against your own animals and pastures, reads it back to you, and saves nothing until you say yes.

Voice at the chute — Apple's speech recognition

The Voice switch on the chute screen uses Apple's own speech recognition, which Headgate asks to run on the iPhone itself wherever the phone supports it — which is also why it works in a set of pens with no signal. What you say at the chute is turned into text on the phone and acted on there; it is not sent to any AI provider, and no recording is sent anywhere or kept. The microphone is on only while the switch is on, and iOS asks your permission the first time you turn it on.

What is not happening

• No advertising, no advertising identifiers, and no tracking of anyone across other apps or websites.
• No analytics or measurement code of our own, and no third-party scripts, fonts or images loaded from anybody else's servers. Everything the pages need is served from the same place as the pages.
• No device location. The software never asks for it.
• No crash or error reporting to a third party. Faults are recorded in a log file on the operator's own server. If that ever changes, this page changes with it.
• No sign-in through Google, Facebook, Apple or anyone else. Passwords are checked against this system and nowhere else.

How long it is kept

A ranch's records are kept for as long as that ranch is using Headgate — which is the point of the software: the value of a herd record is that it is still there in five years.

When a ranch asks for its records to be deleted, they are removed from the live system within 30 days and the ranch's database is taken out of service. Copies already in backups are not reached into; they age out on their own schedule: nightly copies within 35 days, weekly copies within 91 days and monthly copies within about 13 months. An archive copy made at your request is kept until you ask us to remove it.

A user who is removed from a ranch keeps their name on the records they entered, because a treatment record has to say who gave the treatment. Deleting the account itself removes the login and the email address, and leaves those records in place with no name attached.

Asking for your account or your ranch to be deleted

Sign in, open My account, and choose Delete my account or ranch. That records the request and sends it to the operator, who completes it within 30 days and confirms by email. Export your records first if you want to keep a copy — Settings has a one-click export of everything, and deletion cannot be undone.

If you cannot sign in, use the contact below and say which ranch and which email address the request is for.

Cookies

One cookie, and it is the sign-in session. It carries no advertising identifier and is not readable by any other site. Signing out ends it.

Children

Headgate is software for running a cattle operation. It is not directed at children under 13, and accounts are created for ranches by the operator rather than by anyone signing themselves up.

Keeping it safe

Connections are encrypted. Passwords are stored as one-way hashes, never as passwords. Each ranch's data is in its own database, and what a person can reach inside a ranch depends on the role their ranch gave them. Off-site backups are encrypted before they leave the server. No system is perfect, which is why the export in Settings exists and why keeping your own copy occasionally is a reasonable habit.

Changes to this page

If what Headgate collects or who it is shared with changes, this page is updated and the date at the top moves. Material changes are also put in front of the ranch the next time it signs in.

Contact

Questions about any of this, or about your own records: [email protected].