Privacy Policy

This policy applies to GearDepot — the marketplace at geardepot.com — and to everyone who browses, buys, or sells here. GearDepot is a United States marketplace and accounts are available to US residents only.

Account information. Your name, email address, and — if you choose to add one — a phone number and profile photo. If you sign in with Google or Facebook, we receive your name and email address from that provider; we never receive your password. If you create a password with us instead, we store only a cryptographic hash of it.

Seller and identity verification. Sellers who accept payment complete onboarding with our payments provider, Stripe, which collects the identity and bank details it needs to pay you and to meet financial regulations. Those details go to Stripe directly. Sellers may also submit proof of ownership and equipment serial numbers; serial numbers are masked in public views and shown in full only to the owner, our staff, and the buyer after a completed purchase.

Transactions. Orders, offers, shipping and billing addresses, delivery tracking, payout status, and dispute records. We never see or store your full card number — card details are entered directly into Stripe’s payment form.

Content you create. Listings, photos, specifications, reviews, and messages to other members. Location metadata is stripped from uploaded photos before they are stored.

Technical information. IP address, device and browser information, and server logs. We use these to keep the marketplace secure, to apply rate limits, and to diagnose errors.

Analytics and attribution. We assign every visitor — signed in or not, and whether or not you ever click an ad — a random analytics id that lasts 90 days, and use it to record which pages and steps you reach as you browse, buy, and sell, and where you drop off, so we can measure and improve those flows. If you arrive from one of our ads, we also store the click identifier the ad network attached to that visit (for example Google’s gclid or Meta’s fbclid) so we can tell which advertising brought you here. This id is pseudonymous — it does not carry your name or contact details.

Approximate location. When you visit, our hosting platform tells us the approximate area your connection comes from (country, and for US visitors the state and city — never your street address, and we do not keep your IP address). We use it to show gear listed near you, to pre-fill the city, state, and ZIP in shipping and address forms so you have less to type (you can change anything we pre-fill), to estimate shipping before you sign in, and to see, in aggregate, which regions our visitors come from. You can tell us where you shop instead with the “Shopping near” control on the homepage; that choice is kept in a first-party cookie (gd.loc, one year) that records only the state and city you picked. You can also turn location use off entirely under “Privacy choices” in the footer or at /privacy/personalization; that choice is stored the same way.

Personalized recommendations. We may use the listings you view, save, add to your cart, make offers on, message about, or buy on GearDepot — together with the categories, brands, and price ranges of that gear — to order listings on the homepage, in “Similar gear”, and on category pages around what you seem to be shopping for. This is done by GearDepot itself, on our own systems; no third party receives it, and it never changes a listing’s price, seller, condition, availability, or shipping, or the results of a search for a specific item. Signed-out activity is kept under the same random analytics id and, if you later sign in on that browser, is associated with your account. You can switch personalization off, or clear the history behind it, at any time at /privacy/personalization or in your account settings; we keep the underlying activity for 90 days and then delete it.

Off-platform deals are the main way people get defrauded in this category, so messages between members are automatically screened for attempts to move a transaction off GearDepot and for other policy violations. Screening is done by pattern matching and, where an AI provider is configured, by sending the message text to that provider for classification — the providers we use for this are listed under “Who we share information with” below. A message that is blocked is still stored — it forms the moderation record, and our staff may review it when investigating a report or dispute.

Treat member-to-member messaging as monitored. Do not send information there that you would not want reviewed by our trust and safety staff.

• To operate your account, listings, orders, and payouts.
• To run protected checkout: holding payment, opening the inspection window, releasing funds, and handling refunds and disputes.
• To screen listings automatically before they publish, to review them when a check flags one, and to verify sellers through our payments provider before they are paid.
• To detect fraud, abuse, and attempts to circumvent the marketplace.
• To measure how people move through the site — which pages and steps they reach, and where they drop off — and which advertising and campaigns brought them here, so we can improve the experience.
• To personalize the order of listings you see, based on the gear you browse, save, and buy here — only if you have not switched personalized recommendations off.
• To send transactional email you need — verification, order updates, offers, disputes, and payout notices.
• To send product updates and marketing email — including Devon's founder updates about what we shipped — only if you asked for them. We record when and how you opted in, every message carries a one-click unsubscribe, and we stop as soon as you use it.
• To meet our tax, accounting, and legal obligations.

We do not sell your personal information. We share it with service providers who process it on our behalf, and only as needed to run the marketplace:

• Stripe — payments, seller payouts, identity verification, and sales-tax calculation.
• Clerk — account sign-in, verification codes, and two-factor authentication.
• Cloudflare — photo and document storage, plus bot protection on our forms.
• Resend — delivery of transactional email, and of product updates and marketing email you opted in to.
• Shippo — shipping rates, labels, and tracking (shared with the carrier you select).
• Google Maps Platform — address autocomplete when you enter an address.
• Sentry — error monitoring.
• Neon — database hosting.
• Vercel — application hosting and approximate visitor location.
• Meta (Facebook) — measurement of our advertising. If you arrive from one of our ads, we tell Meta which steps you completed (for example, that you created an account) so we can tell which ads work. We send your email address, phone number (if you gave us one) and your account identifier only as irreversible cryptographic hashes, never in readable form, along with your IP address and browser type. We apply Meta's Limited Data Use setting, which restricts how they may process this information for residents of states that require it.
• Anthropic — automated review of listing content and of member-to-member messages, to screen for policy violations and attempts to move a transaction off the marketplace, and to help draft listing descriptions from what a seller enters. Content is sent for the check and is not used to train their models.
• OpenAI — the same automated listing and message review as above, where that provider is selected. Content is sent for the check and is not used to train their models.

We also share information with the other party to a transaction — a seller sees the shipping address for an order they must fulfill, and a buyer sees the storefront details of the seller they are buying from. We may disclose information when the law requires it, or to investigate fraud, safety, or a violation of our Terms of Service.

You can delete your account from your account settings. Deletion removes your profile and takes your listings down. Records tied to completed transactions — orders, payments, payouts, and disputes — are retained in anonymized form because we are required to keep accounting and tax records and because the other party to a transaction has their own record of it. Deletion cannot be undone.

You can download a copy of your personal data at any time from your account settings.

• Access and correct your profile information in account settings.
• Export your data as a file from account settings.
• Delete your account, subject to the retention rules above.
• Turn off non-essential email in your notification settings. Transactional messages about your orders cannot be turned off while you have active transactions.
• Unsubscribe from product updates and marketing email at any time — use the link in any such message, or turn them off in your notification settings. Unsubscribing there never affects transactional email about your orders.
• Enable two-factor authentication to protect your account.

Depending on where you live, you may have additional rights over your personal information. Contact us at contact@geardepot.com and we will respond.

Payment credentials never touch our servers. Passwords are stored hashed. Two-factor authentication is available on every account, serial numbers are masked in public views, and administrative actions are recorded in an audit log. No system is perfectly secure, so please use a strong, unique password and enable two-factor authentication.

GearDepot is not intended for anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has created an account, contact us at contact@geardepot.com.

We use cookies that are necessary to run the site — keeping you signed in, remembering your cart before you sign in, and protecting our forms from automated abuse. Blocking these will break sign-in and checkout.

We also set an analytics cookie for every visitor — not only if you arrive from one of our advertisements — that assigns a random id lasting 90 days. We use it to understand which pages and steps people reach as they browse, buy, and sell, and where they drop off, so we can improve those flows. If you do arrive from one of our advertisements, we additionally record which ad or campaign brought you here, including the click identifier the ad network attached to that visit, so we can measure whether our advertising works. These include cookies set by Meta (Facebook). Blocking any of these will not affect your ability to use the site, buy, or sell.

If you switch personalized recommendations off, we set one more cookie (gd.personalize, one year) that only records that choice, so it is honored on this browser whether or not you are signed in. See /privacy/personalization.

If we make a material change we will update the effective date above and, where the change is significant, tell you by email or in the app.

Questions about privacy: contact@geardepot.com.