Effective: April 4, 2026 • Last Updated: August 28, 2026
Gear Guy is built by Warlock Tactical Group ("we," "us," "our"). This Privacy Policy explains how we handle information in the Gear Guy mobile application ("App") and the gearguyapp.com website ("Site"). Our core principle is simple: your data belongs to you, not us.
The Gear Guy App is designed with a zero-knowledge architecture. We do not collect, store, transmit, or have access to:
Your firearms inventory data, serial numbers, photographs, purchase records, or maintenance logs. Your builds, configurations, or saved loadouts — except a build you choose to share, described below. Your name, address, location, or device identifiers (except as described in Section 3 below). Usage analytics, crash reports, or behavioral telemetry.
All inventory data, serial numbers, photographs, and builds are encrypted with AES-256-GCM and stored exclusively on your device. We cannot access this data. We cannot recover it for you: if you lose your device, the data on it is gone unless you turned on one of the optional recovery paths described in Section 5. This is by design.
The one exception — builds you choose to share. Gear Guy can turn a build into a public link (gearguyapp.com/b/…) or a shareable image. This only ever happens when you tap Share. When you do, two things are uploaded to our Cloudflare storage: the build's parts list — the platform, the name you gave the build, and for each part its slot, catalog id, display name, price and finish — and a rendered image of that build. Nothing else travels with it: no account, no device identifier, no serial number, no photograph from your records, and no part of your inventory beyond the build you shared. Your IP address is seen briefly to limit abuse and is then discarded. Because the build's name is text you write yourself, don't put anything private in it. A shared build stays at its link until we remove it; email us and we will delete it.
On the Website (gearguyapp.com): If you submit your email address for beta access or newsletter signup, we store that email address. We do not use third-party email marketing platforms that track open rates or click behavior. We do not sell or share email addresses with any third party.
On the App — Photo Identification Feature: When you use the "Identify" feature, a downscaled copy of your photograph is transmitted to our secure identification service (hosted on Cloudflare Workers) for processing. The photograph is forwarded to a third-party AI service (Anthropic) for analysis and is not stored by us or Anthropic after processing. We do not log, retain, or associate photographs with any user identity. A per-install device identifier provided by Apple (identifierForVendor, which resets when you delete the App) is used solely for rate limiting — 5 identifications per day — and is not linked to any personal information.
On the App — Record Photos: When you add an identified firearm to your inventory, two images are generated from your photograph and stored on your device: a small thumbnail (about 100 pixels) for lists, and a copy of the photograph re-encoded at reduced resolution for the firearm's record page. Both are AES-256-GCM encrypted at rest alongside your other vault data, and both are deleted when you delete the photo from the record or delete the record. The photograph as originally captured is not retained by the App beyond the identification request. Neither stored image can be read without your device's vault key.
The App generates a device-local identifier (using the platform's standard device ID API) that is sent as a header with identification requests. This identifier is used exclusively to enforce the daily rate limit on the free tier. It is not stored in any database, not associated with any user profile, and not used for advertising, analytics, or tracking of any kind.
Serial numbers entered into the App are encrypted with AES-256 before being written to local storage. They are masked by default in the user interface (displayed as ****7842). Serial numbers are never transmitted off your device — not to our servers, not to any third party, not even during the photo identification process. If a serial number is visible in a photograph submitted for identification, we instruct our identification service to ignore it.
All persistent data in the App is encrypted with AES-256-GCM (Apple CryptoKit). The 256-bit vault key is generated on your device and stored in the iOS Keychain with device-only accessibility: it is not synced to iCloud Keychain and does not migrate to another device through a backup. There is no passphrase. By default there is also no recovery path: if the device is lost or erased, nobody — including us — can decrypt the vault. You may optionally turn on a recovery path in Settings: an additional copy of the vault key kept in your Apple iCloud Keychain (end-to-end encrypted by Apple; the vault data itself never leaves your device), or a one-time recovery key that you write down. We have no backdoor and no master key.
Anthropic (Claude AI): Photographs submitted through the identification feature are processed by Anthropic's Claude API. Anthropic's data retention policy states that API inputs are not used for model training and are not retained beyond the request lifecycle. See Anthropic's Privacy Policy.
Cloudflare: Our identification proxy and website are hosted on Cloudflare's infrastructure. Cloudflare may process standard web request metadata (IP addresses, request headers) as part of their service. See Cloudflare's Privacy Policy.
Apple: The App is distributed through the Apple App Store. Apple may collect its own data as described in its privacy policy. We do not receive personal information from Apple beyond aggregate download counts.
The gearguyapp.com website may add affiliate links to third-party retailers in future; any that appear will be disclosed as such. We earn no commission today, and the site carries no affiliate links. If you click an affiliate link once they exist, the retailer may set cookies on your browser and collect data according to their own privacy policy. Under any program we join we would receive only anonymized commission reports (total sales amount, not individual buyer identity). Affiliate links, where present, appear only on the website. The Gear Guy App contains no affiliate links today; see our Affiliate Disclosure.
Gear Guy is not intended for use by anyone under the age of 18. The App includes an age verification gate that must be completed before accessing any features. We do not knowingly collect data from minors. If you believe a minor has provided data to us, contact us and we will promptly delete it.
You may export an inventory report as a PDF from within the App. A full encrypted data export is in development. You may delete all data from the App at any time using the "Delete All Data" function in Settings. Deletion is immediate and irreversible. To request deletion of your email address from our website mailing list, contact us at the address below.
We will update this policy if our data practices change. Material changes will be communicated through the App and on this page. The "Last Updated" date at the top reflects the most recent revision.
For questions about this Privacy Policy or to request data deletion:
Warlock Tactical Group
Email: [email protected]
Web: www.gearguyapp.com