Privacy Policy

1.Information We Collect

We collect the following types of information:

• Account information: name, email address, and authentication data provided via Supabase.
• Inventory data: details of your cameras, lenses, accessories, maintenance records, loans, categories, and any photos or attachments you upload.
• Billing information: billing-related data (such as subscription status, Stripe customer IDs, and non-card metadata) processed via Stripe. We do not store full card numbers or CVV; those are handled directly by Stripe.
• Your clients' information: if you use GearDex's business features, the details of your own clients that you enter or that they send you (see Your Clients' Data).
• Usage data: log and analytics data about how you use the Service—pages viewed, actions taken, and device/browser information.

2.How We Use Your Information

We use your information to:

• Provide, operate, and improve the Service.
• Manage subscriptions, billing, and payments via Stripe.
• Authenticate you and secure your account via Supabase.
• Send service-related emails, such as login links, security alerts, and subscription or billing notices.
• Respond to support requests and communicate about updates to the Service.

3.Service Providers & Data Processors

We rely on trusted third parties to power GearDex, including:

• Supabase for database storage, authentication, and real-time updates.
• Stripe for subscription billing and payment processing.
• Resend for transactional email, emails you send to your clients, and receiving your clients' replies so they appear in your conversations.
• Hosting provider (such as Vercel) for application hosting.
• PostHog for product analytics, including the anonymous page view counts described in Cookies & Analytics below.
• Google Analytics for traffic analytics, only after you accept analytics cookies.

These providers process data on our behalf and are contractually restricted from using your information for their own purposes beyond delivering their services to us.

4.Cookies & Analytics

Anonymous page views (always on). To see where visitors come from, we count page views without cookies: the page you visit, the site that referred you, and campaign tags in the link (such as utm_source). Nothing is stored on your device and no identifier follows you between visits. PostHog counts unique visitors with a hash of your IP address and browser that changes every day, and does not keep the IP address.

Full analytics (only if you accept). If you choose Accept All, PostHog uses cookies and local storage to measure how the Service is used across visits, including feature usage, errors, and session replays with text and form inputs masked, and Google Analytics measures traffic. If you sign in, this analytics is linked to your account.

If you decline, analytics stays anonymous: we only count page views as described above, and no analytics cookies or storage are set. Your choice is saved on this device for 12 months. To change it sooner, clear this site's data in your browser and the cookie banner will ask again.

Necessary storage. We store your sign-in session and your cookie choice on your device so the Service works and remembers your preference.

5.Google Calendar

If you connect Google Calendar, we ask Google for three permissions and use them only to run your bookings:

• See your list of calendars, so you can choose which ones count as busy and which one receives bookings.
• See when you're busy or free on the calendars you choose, so clients can't book over your existing commitments. We never read event titles, descriptions, locations, or attendees.
• Create, change, and delete events on calendars you own, which we use only to add your bookings, move them when they're rescheduled, and remove them when they're canceled. We don't change events we didn't create.

We store your Google account email, the permissions you granted, the calendars you chose, busy time ranges, and the IDs of the events we create. Your Google tokens are encrypted at rest. We don't sell Google user data, share it with anyone other than the service providers above, use it for advertising, or use it to train AI models. People at GearDex don't read it unless you ask us to while helping you, it's needed for security, or the law requires it.

You can disconnect Google Calendar at any time from Scheduling. Disconnecting revokes our access and deletes your stored tokens and busy times. You can also remove GearDex's access from your Google Account settings.

GearDex's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6.Your Clients' Data

When you use GearDex's business features (Clients, Pipeline, Scheduling, Money and your Site), GearDex processes information about your clients on your behalf:

• Contact details: names, email addresses, phone numbers, companies and notes you add.
• Inquiries and messages: what clients send through your Site, the emails you send them from GearDex, and their replies. Replies to those emails are received by our email provider at a reply address unique to the conversation and added to that conversation.
• Bookings: sessions they book, times, locations and answers to your booking questions.
• Documents and signatures: quotes, contracts and invoices you send them, and when a client signs a contract electronically, an audit record of their typed name, email, IP address, device, the time of signing, the consent they gave, and a fingerprint of the exact text they signed.

For this information you are the controller and GearDex is your processor: we use it only to provide these features to you, never to market to your clients or for advertising, and we don't sell it. If one of your clients contacts us to see, correct or delete their information, we'll refer them to you; you can export or delete it from your Clients records, and we'll help when you ask. Client data is kept while your account holds it and is deleted along with your account.

7.Data Retention

We retain your account and inventory data for as long as your account is active and as needed to provide the Service.

If you delete your account, we will remove or anonymize your personal data within a reasonable period, subject to any legal or accounting obligations (for example, retaining limited billing records for tax and audit purposes).

8.Your Rights & Choices

Within the app, you can:

• View and update your profile information.
• Export your data from the Settings → Data & Privacy section.
• Request deletion of your account and associated data.

If you have questions or would like to exercise additional rights (such as access, correction, or deletion of data that cannot be managed in the UI), you can contact us using the email address listed below.

9.California Privacy Notice

If you are a resident of California, you have certain rights under California law (including the California Online Privacy Protection Act and, where applicable, the California Consumer Privacy Act). While GearDex is a small business and may not meet all statutory thresholds, we aim to honor reasonable requests to:

• Access the personal information we hold about you.
• Request correction or deletion of your personal information.
• Opt out of any sale of personal information (we do not sell your personal data).

You can exercise these rights by contacting us, and we will respond in a reasonable timeframe.

Do Not Track: Your browser may send "Do Not Track" signals. We currently do not respond to these signals but limit tracking to what is necessary to operate and secure the Service.

10.Security

We use reasonable technical and organizational measures to protect your information, including TLS encryption in transit and access controls on our database and infrastructure.

However, no online service can be 100% secure, and you are responsible for keeping your login credentials safe.

11.Children's Privacy

GearDex is intended for use by adults. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us so we can remove it.

12.Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. If the changes are material, we may also notify you via email or in-app notifications.

13.Contact Us

If you have any questions about this Privacy Policy or how we handle your data, you can contact us at:

Email: geardex.help@gmail.com