Privacy Policy

• Account information you give us: email address, password (stored as a hash), optional phone number, username, and for Dealers the business name, licence details you choose to provide, and the storefront contact details you choose to publish (phone, email, street address, website).
• Content you post: Listings, photographs, descriptions, terms of sale, messages you send through the Site, and reports you submit.
• Dealer inventory connections: if a Dealer connects a store platform or product feed, the feed address and access credentials the Dealer supplies (stored encrypted) and the product data it returns.
• Automatically collected information: our servers log your IP address, browser type, the page requested and the time, to run and secure the Site. Only if you accept analytics on our cookie banner, our analytics provider (PostHog) also collects the pages you view, clicks, the referring page, device and browser type and approximate location derived from IP, under a random identifier stored in a cookie. We do not record your sessions (no screen or session replay).
• Communications with us, such as support or legal emails.
• Dealer Early Access information you submit via the /dealers page: contact name, business name, email address, state, optional phone number, the consent text you agreed to, consent timestamp, IP address and browser type, and your preferences for calls and text messages.

We do not collect government identification, Social Security numbers, payment card or bank details, background-check information or firearms-transaction records. We are not a federal firearms licensee and keep no firearms records.

To operate the Site and your account; display Listings and the contact details Dealers choose to publish; deliver messages between users; send account and service emails; respond to enquiries and reports; enforce our Terms and Listing Rules; detect fraud, abuse and unlawful activity; improve the Site and its automated listing tools (photographs and Listing text you post may be used to test and improve those tools); and comply with law.

If you join the Dealer Early Access list and consent to promotional communications, we also use your contact details to send platform updates, launch notices and, if requested, a brief introductory call or text messages. We honour every unsubscribe or opt-out within one business day and record it. Consent and opt-out records are retained to demonstrate compliance with the CAN-SPAM Act and TCPA.

Listings, storefront pages, usernames, and any contact details a Dealer enters in their storefront settings are public and may be seen, copied and indexed by anyone, including search engines. Do not post information you do not want public.

• With other users: when you message a seller, your username and message are shown to that seller. Dealers' published contact details are shown to everyone.
• Service providers that process data for us under contract, each receiving only what it needs to perform its service for us:
  • Vercel: website hosting and content delivery.
  • Neon: database hosting.
  • Cloudflare: storage of photographs and files.
  • Resend: delivery of account and service emails.
  • Axiom: server logs and error monitoring. We do not use Sentry or any session-recording tool.
  • PostHog (United States): product analytics, only after you accept analytics on our cookie banner. If you decline, or your browser sends a Global Privacy Control or Do Not Track signal, PostHog is not loaded and receives nothing from your visit.
  • Inngest: background job processing. Upstash: caching and rate limiting. Pusher: live updates on auction pages.
  • AI model providers, reached through OpenRouter, that process Listing photographs and text for identification.
  • Payments: where the Site takes a payment, you enter card details on the hosted payment page of our payment processor (Elavon). We do not receive or store your card details.
  • Google: only if you choose to sign in with Google. The Google sign-in script loads on the sign-in and registration forms when that option is offered.
  • Have I Been Pwned (Pwned Passwords): when you choose a password, your browser sends the first 5 characters of a one-way hash of it to check it against known breached passwords. The password itself never leaves your browser.
• Legal: we may disclose information to comply with law, subpoena or court order; to respond to lawful requests from law enforcement, including ATF; to enforce our Terms; or to protect the rights, safety or property of GunMister, our users or the public.
• Business transfers: if GunMister is sold, merged or reorganised, information may transfer to the successor.
• Affiliate partners: some Listings are products sold by Guns.com, linked through the AvantLink affiliate network. Nothing is sent to AvantLink or Guns.com when you view such a Listing: there is no tracking pixel, and product photos are delivered from our own servers. Only when you click an affiliate link do the affiliate network and the retailer receive the information any website receives from a visit (your IP address, browser and device type, the time, and the page you came from) plus a code identifying GunMister as the referrer. We do not send them your name, email address or account details.

We do not sell personal information and do not share it for cross-context behavioural advertising. We do not run advertising trackers, tracking pixels or session recording on the Site. We do not sell, rent or share email addresses or telephone numbers with third parties for their independent marketing purposes.

When you first visit, a banner asks whether you accept analytics. Accept and Decline are equal choices. Until you choose, and whenever you decline, the Site runs no analytics and loads nothing from any third party for that purpose. You can change your choice at any time with the Cookie settings link at the bottom of every page or open Cookie settings here. If you withdraw consent, analytics stop at once and the analytics cookies and stored data in your browser are deleted.

Global Privacy Control and Do Not Track. If your browser sends a Global Privacy Control (GPC) or Do Not Track signal, we treat it as a Decline for that browser: analytics stay off, including the events our servers would otherwise send about your actions.

Cookies and browser storage we use:

• Strictly necessary (always on, set by us): a sign-in cookie keeps you signed in until you sign out or it expires; a security cookie protects forms against cross-site request forgery; gm-age-ok records that you passed the 18+ gate (30 days); gm-consent records your analytics choice (12 months). Your browser's local storage also keeps your theme, recently viewed Listings and sign-in status between tabs; these never leave your browser.
• Analytics, only after you accept: PostHog sets a cookie named ph_<project key>_posthog on gunmister.com and a matching local storage entry, holding a random identifier, for up to 12 months. If you are signed in, analytics events are linked to your account ID (not your email address).

Our servers may also send analytics events about actions you take (for example signing in or publishing a Listing) to PostHog, but only when your browser carries your Accept. Operational and security logs are kept regardless of your choice, as described in section 6.

Affiliate links. When you click an affiliate link, the affiliate network (such as AvantLink) and the retailer may set their own cookies on their websites to record that the visit came from GunMister and to credit us if you make a purchase. Those cookies are governed by their privacy policies. Our pages place no affiliate cookie or pixel before you click. See our Affiliate Disclosure.

• Account data is kept while your account is open and for up to 2 years after closure, unless we need it longer to comply with law, resolve disputes or enforce our Terms.
• Listings and photographs are kept for as long as the Listing is displayed and thereafter in our records for up to 5 years.
• Messages are kept for up to 2 years.
• Server and analytics logs are kept for up to 13 months.
• Dealer Early Access records (DealerLead rows) are kept for as long as the early-access programme is active and for 5 years thereafter to document consent. Communication opt-out records (ContactSuppression rows) are kept indefinitely so we do not accidentally contact a person who has opted out.
• We may keep de-identified data indefinitely.

We use encryption in transit, hashed passwords, encrypted storage of Dealer feed credentials, access controls and monitoring. No system is perfectly secure, and we cannot guarantee security.

You can update your account details, delete Listings, and close your account from your account settings. You can opt out of non-essential emails using the link in each email. To access, correct, delete or obtain a copy of your personal information, or to ask a question, email privacy@gunmister.com. We will verify your request and respond within 45 days. Residents of states with consumer privacy laws (including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others) may have additional rights, including the right to appeal a decision by emailing the same address; we will honour them where they apply. We do not discriminate against anyone for exercising privacy rights.

California residents. Under the California Consumer Privacy Act, as amended, you have the right to know what personal information we collect, use and disclose (the categories are described in sections 1 to 4); to delete it; to correct it; to opt out of its sale or sharing; and to limit the use of sensitive personal information. We do not sell or share personal information as those terms are defined, and we do not use sensitive personal information for purposes that would give rise to the right to limit. We honour Global Privacy Control as a valid opt-out request. You may use an authorised agent, and we will verify the request. Email privacy@gunmister.com to make a request. We will not discriminate against you for exercising any of these rights.

To unsubscribe from all promotional email from GunMister, click the unsubscribe link in any promotional email or email support@gunmister.com. To stop promotional text messages, reply STOP to any message from us or email the same address. We process opt-outs within one business day and retain the record permanently.

The Site is for adults. We do not knowingly collect information from anyone under 18. If you believe a minor has provided information, email privacy@gunmister.com and we will delete it.

Our servers and service providers are located in the United States. Site staff may access data while travelling outside the United States, under the same controls.

We will post any changes here with a new effective date and, for material changes, notify account holders by email or on-site notice.