Privacy Policy

1. Who We Are

Gearuum (the "Service") is operated by Corentin Cocoual, doing business as "Gearuum App" ("Gearuum," "we," "us"). For the purposes of Quebec's Act respecting the protection of personal information in the private sector, the person in charge of the protection of personal information is Corentin Cocoual, reachable at contact@gearuum.com.

2. Information We Collect

• Account information: name, email address, and profile picture, obtained when you sign in with Google OAuth.
• Gear content ("User Content"): photos, descriptions, categories, and other details you upload about your outdoor equipment, including kits you create or share.
• Payment information: when you subscribe to a paid plan, billing details and card information are collected directly by our payment processor, Stripe. Gearuum does not receive or store your full card number.
• Usage and analytics data: product usage events, pages viewed, features used, device and browser information, and approximate location derived from your IP address, collected via PostHog.
• Authentication data: session tokens and login timestamps, managed via Supabase.

3. How We Use Your Information

We use the information above to: provide and operate the Service (e.g., display your gear inventory, process AI-assisted gear recognition, enable kit sharing); process payments and manage subscriptions; maintain account security and detect fraud or abuse; understand product usage to improve the Service; and communicate with you about your account or changes to the Service.

4. Legal Basis for Processing

We process account and gear data because it's necessary to provide the Service you've signed up for (contractual necessity). We process analytics data based on your consent, which you can withdraw at any time via the cookie preferences described in Section 6. We process certain data (e.g., fraud detection) based on our legitimate interest in keeping the Service secure.

5. Third-Party Service Providers

We share information with the following service providers, each acting on our behalf and only for the purposes described:

• Google (OAuth sign-in): authenticates your account. See Google's Privacy Policy.
• Google Cloud Vision (AI image processing): processes uploaded gear photos to extract details. Google does not use this content to train its models and does not persist images beyond the time needed to process them.
• OpenAI (AI gear-data extraction, via API): processes gear-related text and image data to extract structured details. OpenAI does not use API data to train its models by default, and retains API inputs/outputs for up to 30 days for abuse-monitoring purposes only.
• Supabase (database, authentication, file storage): stores your account data, gear content, and authentication tokens.
• PostHog (product analytics): collects usage data and sets cookies as described in Section 6.
• Stripe (payment processing): handles billing and card data directly; see Stripe's Privacy Policy. Stripe may also collect device and behavioral data for fraud-prevention purposes.

6. Cookies

PostHog sets cookies to recognize your browser and collect usage analytics. Essential cookies (e.g., session/authentication) are required for the Service to function. Analytics cookies are used only with your consent, collected via the cookie consent banner presented on your first visit; you can withdraw consent at any time through that banner or your browser settings.

7. International Data Transfers

Some of our service providers (Google, OpenAI, Supabase, PostHog, Stripe) may process or store your information outside Quebec and Canada, including in the United States. Where this occurs, we rely on these providers' contractual and technical safeguards to protect your information to a standard equivalent to what's required under Quebec law.

8. Data Retention

We retain your account and gear data for as long as your account is active. If you request deletion of your account (by contacting contact@gearuum.com), we retain your data for up to 30 days from your request to allow for account recovery, after which it is permanently deleted — except where longer retention is required by law (e.g., billing records, which Stripe retains per its own policies). Analytics data is retained per PostHog's standard retention settings.

9. Data Security

We use industry-standard measures to protect your information, including encryption in transit, database-level row security (Supabase RLS) restricting access to your own data, and access controls on our infrastructure. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security — see the Beta Program Notice above regarding the invite-only phase specifically.

10. Your Rights

Depending on where you live, you may have the right to: access the personal information we hold about you; correct inaccurate information; request deletion of your information; receive a copy of your data in a portable format; object to or restrict certain processing; and withdraw consent at any time. To exercise any of these rights, contact contact@gearuum.com.

• Quebec residents may also file a complaint with the Commission d'accès à l'information du Québec (CAI) if you believe your rights under Law 25 have not been respected.
• EU/EEA residents may lodge a complaint with their local data protection supervisory authority.
• California residents have rights under the CCPA/CPRA, including the right to know what personal information we collect and the right to delete it. We do not sell or share personal information as defined under the CCPA.

11. Children's Privacy

The Service is not directed at children. Consistent with our Terms of Service, you must be at least 18 years old to use the Service, and we do not knowingly collect personal information from anyone younger.

12. Automated Processing

We use third-party AI services (Google Cloud Vision, OpenAI) to extract structured details from photos you upload. This is content-processing assistance, not automated decision-making that produces legal or similarly significant effects on you, and we do not use it to build profiles for automated decisions about you.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We'll post the updated version here with a new "Last updated" date and make reasonable efforts to notify you of material changes.

14. Contact

Questions about this Privacy Policy or your data? Contact us at contact@gearuum.com.