Privacy Policy

WhoHasGear helps teams track who has which piece of equipment. This page explains exactly what we store, why we store it, and how to get rid of it. We don't sell your data, we don't run ad networks on it, and we don't buy contact lists.

Who we are

WhoHasGear (“we”, “us”) operates whohasgear.com. For questions about this policy or about your data, contact us at chomeroller@gmail.com or through our contact page. We are the data controller for account data, and a data processor for the inventory data you put into your workspace.

What we collect

Account information

When you create a workspace with email we store your name, email address, workspace name, and a hashed version of your password. Passwords are hashed with PBKDF2 (100,000 iterations) — we never store or transmit them in readable form and nobody at WhoHasGear can see them.

Sign in with Google

If you choose Sign in with Google, Google provides your name, email address, and Google account identifier so we can create or authenticate your WhoHasGear account. We use that information only for authentication. We do not store Google access or refresh tokens.

Your inventory data

Whatever you add: item names, tags, categories, locations, values, notes, photos you upload, and the custody history of each item (who checked it out, when, and when it came back). This is your data. You can export all of it to CSV at any time from the Assets page, and you can delete it.

Borrower names

When someone scans a printed label and checks an item out, we record the name they type and the due date. Borrowers do not need an account and we do not collect their email address, phone number, or location. If you tell us to delete a person's name from your custody history, we will.

Technical data

Standard web server logs (IP address, browser type, pages requested, timestamps) kept for security and abuse prevention. A single essential cookie, whg_session, keeps you signed in for 30 days. We use Plausible for cookie-free, aggregate traffic analytics. Plausible receives a sanitized page path, referral source, browser, operating system, device type, and approximate location derived from the request. It does not use cookies, track you across sites, or store your raw IP address or full user-agent string. Invite, unsubscribe, scan, and asset identifiers are excluded or replaced before a pageview is sent.

Payment information

We never see your card. Payments run entirely through Stripe. We store only a Stripe customer ID, a subscription ID, your plan, and the amount and date of payments. Card numbers, CVCs, and billing addresses are handled by Stripe under their own privacy policy.

Why we collect it

• To run the service — you can't track equipment without storing the equipment list.
• To keep your account secure — sessions, password hashing, abuse detection.
• To take payment — only if you choose a paid plan or the $1 trial.
• To reply to you — if you email us or use the contact form.
• To understand site usage — aggregate, cookie-free pageview trends through Plausible.

We do not use your inventory data to train machine-learning models, and we do not share it with anyone outside the subprocessors listed below.

Who processes your data

We keep this list short on purpose:

• Cloudflare — hosting, database (D1), file storage (R2), and email routing. Your data is stored on Cloudflare infrastructure.
• Stripe — payment processing, only if you subscribe or start a trial.
• Google — authentication, only when you choose Sign in with Google. Google provides the basic account details described above under its own privacy policy.
• Plausible Analytics — cookie-free, aggregate website traffic measurement. Plausible processes sanitized page paths and limited technical data in the European Union.
• Resend — transactional and onboarding email delivery when those messages are enabled. Resend receives the recipient address and message content needed to deliver email.

That is the complete list. No data brokers, no ad platforms, and no analytics resellers.

How long we keep it

• While your account is open: as long as you keep it.
• After you delete your workspace: removed from our live database within 30 days.
• Server logs: up to 90 days.
• Payment records: retained as long as tax and accounting law requires.
• Contact-form messages: up to 12 months, then deleted.

Your rights

Wherever you live, you can ask us to: show you what we hold about you, correct it, delete it, or export it. If you are in the EU/UK you have these rights under GDPR; if you are in California you have them under CCPA/CPRA. We apply them to everyone regardless of where you are, because having two standards is silly.

Email chomeroller@gmail.com and we will respond within 30 days. We will never charge you for a request or make you jump through hoops. We do not sell personal information, and we never have.

Security

• All traffic is encrypted with HTTPS/TLS.
• Passwords are hashed with PBKDF2, 100,000 iterations, never stored in plain text.
• Session cookies are HTTP-only and secure.
• Uploaded photos are served only to signed-in members of your workspace, or through the specific scan page for a labeled item.
• Payment card data never reaches our servers.

No system is perfectly secure. If we ever discover a breach affecting your data, we will tell you promptly and directly — not bury it in a status page.

Public scan pages

Printed QR labels link to a page that anyone holding the label can open without an account. That page shows the item's name, tag, photo, current status, and who has it — because that is the entire point of a checkout label. It does not expose your other inventory, your team list, your values, or your account. These pages carry a noindex tag so search engines don't list them.

Children

WhoHasGear is a tool for organizations and is not directed at children under 13. If a school uses it, students may appear as borrower names entered by staff; we collect nothing else about them and never contact them.

International transfers

Our infrastructure runs on Cloudflare's global network, so data may be processed in the United States and other countries. Cloudflare, Stripe, and Resend maintain safeguards for international transfers. Plausible processes analytics data in the European Union.

Changes to this policy

If we change anything material, we will update the date at the top and email account owners. Continuing to use WhoHasGear after a change means you accept the updated policy.

Contact

Questions, deletion requests, or anything else: chomeroller@gmail.com or the contact form.