Privacy Notice

This notice explains what personal data GearManifest ("the Service") collects, why, and what rights you have. It applies to everyone who creates a GearManifest account.

1. Who is responsible for your data (the "controller")

GearManifest is operated by Simo Parviainen, as a private individual based in Finland — GearManifest is not currently operated through a registered business (no toiminimi, no Y-tunnus / Business ID). For data protection purposes, Simo Parviainen is the GDPR data controller for GearManifest.

• Name: Simo Parviainen
• Operating as: a private individual in Finland (no registered business / Y-tunnus)
• Contact for privacy questions and data-rights requests: Hi@polkuopas.fi

This email address is the controller's designated contact point for all privacy questions, data-subject-rights requests, and complaints under this notice.

2. What data we collect

We collect only what the product needs to work. Specifically:

Account data

• Your email address, used to send you a magic-link sign-in email. We do not use passwords.
• Display name (optional, set in Settings).
• Your preferred weight unit (g/kg/oz/lb) and preferred currency — display preferences only, stored so the app remembers your choice.
• Two fields (bio, location) exist in our database schema as stubs for a possible future profile feature. They are not currently exposed anywhere in the product and, if unused, hold no data about you.

Gear and build data

This is the core content you create in GearManifest:

• Gear items — the things in your inventory: name, brand, model, weight, price, your own notes, category, condition, and (if you used the AI lookup) a confidence marker showing whether a field came from you or from an AI estimate.
• Wishlist items — gear you've marked as "wished" rather than owned. These are stored as regular gear items with a wished status; we're calling this out explicitly so it's clear wishlist entries are not silently treated as something other than your inventory data.
• Builds — named loadouts you create (e.g. "3-day summer trip"), including trip context you choose to record: trip type, season, group size, duration, and free-text notes.
• Build items — which gear items belong to which build, and per-build overrides (e.g. whether an item is worn vs. packed, or a consumable) for that specific build.

Imported lists. If you import a gear list from a CSV file, GearManifest reads the file in your browser. The file itself is never uploaded or stored by us. Only the rows you review and confirm are sent to us and saved, as gear items and a new pack in your account. We use the same basis as the rest of your gear data, Art. 6(1)(b) GDPR (providing the service you asked for). Imported items are kept like any other gear data for as long as you keep your account. They are included in your data export and removed when you delete your account. Please don't import files containing other people's personal information.

AI SKU-lookup inputs

When you use the "look up specs" feature on a gear item, GearManifest sends the product name and model you typed — plus, only if you started the lookup from a specific gear category or item type, a closed-vocabulary hint naming that category/item type from our fixed lists — to Google's Gemini API to fetch likely specifications (weight, etc.). This request is made from our server, not your browser, and does not include your email, account ID, free-text notes, or any other information that identifies you. Google processes this API request and may keep the request and response for a limited period for abuse monitoring; see "Processors," below.

What we do not collect

We do not collect payment information (GearManifest has no paid tier in its current version), government ID numbers, precise device location, or biometric data.

3. Why we process your data (lawful basis)

• Account, gear, and build data — processed under Art. 6(1)(b) GDPR (necessity for performance of a contract): this data is what lets us provide the inventory and build-planning service you signed up for. We don't have a separate consent flow for this because the processing is the product.
• AI SKU-lookup data — the same basis (Art. 6(1)(b)): looking up specs is a feature you actively trigger, and only the minimum data (product name/model) needed to answer your request is sent.
• Product analytics (PostHog) — GearManifest currently runs PostHog configured to store no persistent identifier on your device: no cookies, no localStorage, memory-only session state, no identify() calls linking events to your account, and autocapture turned off. This configuration is designed so that nothing is stored on or read from your device for analytics, so we do not show a cookie banner for it. We do not rely on any consent exemption for analytics. We use it only for aggregate counts of how the product is used, and not to track you across sites or to profile you. To the extent this minimal, non-persistent processing touches personal data at all (e.g. transient, session-scoped event data), we rely on our legitimate interest (Art. 6(1)(f) GDPR) in understanding aggregate, non-identifying product usage to improve GearManifest, weighed against the low impact on you given the cookieless, non-identifying configuration. You can object to this processing at any time; see "Your right to object to analytics" in Section 6. If PostHog's configuration ever changes to use persistent identifiers, cookies, or account-linked tracking, we will introduce a proper consent mechanism before making that change, and this notice will be updated.
• We do not rely on a vague "legitimate interest" basis for your core account, gear, or build data — that data has a specific contractual basis as described above.

We may also produce and license aggregated, anonymized, non-identifying statistics about gear trends — for example, which categories or types of gear are commonly owned or wished for — to industry partners. These statistics are always about many users in aggregate; they never include, and are not derivable back to, any individual's inventory, username, email address, or any other identifier. We will never sell or license your identity or your email address. We will only use or share your individual inventory, as opposed to aggregated statistics, if you have separately and specifically agreed to it, and you can withdraw that agreement at any time.

4. Who else processes your data (our processors)

We use the following service providers ("processors") to run GearManifest. Formal Data Processing Agreements (Art. 28 GDPR) are not yet in place with every processor listed below. We will update this notice once they are, and we will not claim signed agreements exist until they do.

The accounts with Supabase and PostHog are held by Simo Parviainen personally, the same person who is the controller named in Section 1.

On Google (Gemini API) and international transfer: GearManifest's SKU-lookup feature calls the Gemini API through the founder's Google Cloud Billing account, which makes this a Paid Service under Google's terms (an active Cloud Billing account is required for Gemini API access to count as "paid" — see docs/adr/0005-sku-lookup-provider-and-ai-as-reviewed-suggestion.md). For Paid Services, Google's terms state that Google does not use our prompts or responses to improve its own products, and that it processes them under its Data Processing Addendum for Products Where Google is a Data Processor rather than under the looser terms that apply to Google's free/unpaid API tier. Source: Gemini API Additional Terms of Service (effective March 23, 2026), read 2026-09-21.

No personal data is intended to reach Google: the request carries only a product name and model and, at most, a category hint from our fixed lists, never your email, account ID or notes. Google decides where it processes these requests, and that may be outside the EEA. Where it is, Google's Data Processing Addendum for its paid services provides the transfer safeguards (EU Standard Contractual Clauses or an equivalent mechanism). We therefore do not claim that this processing stays inside the EEA. Google's own terms also note that even for Paid Services it may log prompts and responses for a limited time for abuse-prevention purposes, and that this data "may be stored transiently or cached in any country in which Google or its agents maintain facilities". As with the other processors on this page, no formal DPA has yet been separately accepted for this feature (Section 4's opening note applies here too). As always, please don't put personal information into the free-text fields you send to the lookup feature.

5. How long we keep your data

• While your account is active, we keep your data for as long as you keep your account — there's no automatic expiry on an active account.
• If you delete your account, your data is fully and permanently removed from our active systems within 30 days. We also keep daily database backups for disaster recovery; a backup still holding your data is deleted automatically within 7 days, so nothing remains restorable after that — well inside the 30-day figure above. (Point-in-time recovery is a separate feature and is not enabled.)

6. Your rights and how to exercise them

Under GDPR you have the right to access, correct, export, delete, restrict, and object to our processing of your data, and the right to withdraw any consent you've given. In practice:

• Export your data: self-service export (JSON or CSV) from your account settings, available now. If you would rather we did it for you, email Hi@polkuopas.fi.
• Delete your account and data: self-service account deletion from your account settings, available now. It triggers the 30-day full purge described above. If you would rather we did it for you, email Hi@polkuopas.fi.
• Anything else (access, correction, restriction, objection): email Hi@polkuopas.fi. We will respond within one month of your request, as required by GDPR; in complex cases we may extend this by a further two months, and we'll tell you if we do.

Your right to object to analytics

Our product analytics (Section 3) rests on our legitimate interest. You have the right to object to that processing at any time, on grounds relating to your situation, separately from anything to do with cookies or consent. To object, email Hi@polkuopas.fi. Because the analytics does not identify you, we usually cannot find the events that came from your device; if you object we will tell you what we can and cannot do about it in our reply, within the same one-month period as any other request.

7. Complaints

If you believe we've mishandled your data, we'd like the chance to fix it — email Hi@polkuopas.fi first. You also have the right to lodge a complaint directly with Finland's data protection authority:

Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) https://tietosuoja.fi/en/home

8. Cookies and similar technologies

The cookie that keeps you signed in

GearManifest uses one essential cookie: the Supabase authentication session cookie, which keeps you signed in. This is strictly necessary for the Service to function and is exempt from consent requirements under ePrivacy Art. 5(3).

We do not use any non-essential cookies. Our analytics (PostHog) is configured to be cookieless and store nothing on your device — see Section 3 for how analytics works and how to object. This is a deliberate, documented configuration choice, not an oversight.

Settings we save in your browser

Cookies are not the only way a site can keep something on your device. GearManifest saves one setting in your browser's own storage (localStorage). It does nothing but remember a choice you made in the app. It does not identify you, it is not read by our analytics, and it is never sent to us or to anyone else.

You set the theme in Settings, under Appearance. Nothing is saved until you pick Light or Dark there; choosing "System" removes the entry again.

Signing out does not remove it, because it is not tied to your account — it belongs to the browser. To remove it, choose "System" in Settings or clear this site's data in your browser's own settings. The app then goes back to its default, which is to follow your device's own light or dark setting. Clearing it does not affect your account or your gear.

We do not ask for your consent before saving this, because it does nothing except carry out a choice you made in the app. Under ePrivacy Art. 5(3) that holds only if we tell you the choice is kept, which is what this section does. If we ever save anything else on your device, it will be listed here.

Trying GearManifest before you sign up

If you build a gear list on the /trial page without an account, that list is saved only in your browser's own storage (localStorage), under the key gearmanifest:trial:v1. It holds the items you add there — name, brand, category, weight, and your worn/consumable/quantity choices — and one randomly generated id used only to avoid saving the same list twice if you create an account afterwards. It contains no name, email address, or anything else that identifies you, and it is a different kind of storage from the theme setting above, so it gets its own line here rather than being folded into that table.

This is strictly necessary for a service you explicitly asked for — building and seeing a gear list before creating an account — so it is exempt from consent requirements under ePrivacy Art. 5(3), on that specific footing, stated here rather than assumed to carry over from the essential cookie or the settings above.

Nothing in it is sent to us, or to anyone else, unless and until you choose to create a free account, at which point it is saved to your new account and cleared from your browser. The trial page also has its own "Clear this list" button, which removes it immediately, at any time, whether or not you go on to create an account. Clearing this site's data in your browser removes it too.

Returning you to what you were doing, after you sign in

If you follow a link that requires signing in first — for example, a crew invite link — GearManifest briefly remembers, in your browser's own storage (sessionStorage, under the key gm-signin-next), the address of the page it should return you to once you've signed in, so you land back on that page instead of the general dashboard. It holds nothing but that one address (the page path and any query string in the link you followed). It does not hold your name or email address. If the link you followed was a crew invite link, the stored address includes the invite code that is part of that link, so treat it as you would the link itself.

This is strictly necessary for the sign-in flow you asked to complete, so it is exempt from consent requirements under ePrivacy Art. 5(3) on that footing. Unlike the settings above, sessionStorage clears itself automatically when you close that browser tab — GearManifest does not need to do anything further to remove it, and it is never sent to us or to anyone else.

8a. Sharing with a Crew

If you join or create a Crew, other active members of that Crew can see: your display name, and — only for the specific gear items you choose to share — that item's name, category, and weight, and who is currently carrying it. They cannot see your price, your notes, or any item you haven't shared.

Crew invites are link-only: we never collect or store an invitee's email address to send an invite.

Sharing an item is something you actively choose, item by item, from your own inventory — it is not on by default.

If you leave a Crew, or are removed from one, the items you shared stop being visible to that Crew immediately; your own inventory and builds are never affected. If you leave voluntarily, a fresh invite link can bring you back into the same Crew later. If you are removed by the Crew's creator, that is final for that Crew — no invite link, old or new, will let you back in.

Deleting your GearManifest account (Section 5) removes your own Crew memberships and anything you shared, in the same purge. If you created a Crew, deleting your account also deletes that Crew entirely — including every other member's membership in it and everything they shared into it. There is currently no way to transfer a Crew to someone else first, so creating one means your account is the one whose deletion ends it for everyone in it.

Your data export (Section 6) contains your own gear and builds only — it does not include items other Crew members have shared with you.

8b. Children

GearManifest is not intended for anyone under 16, and we do not knowingly collect data from them. If you believe a child has created an account, email Hi@polkuopas.fi and we will delete it.

9. Changes to this notice

We'll update this notice as the product changes. Material changes will be reflected here, with the "last updated" date above changed to match.

10. Language

This notice is published in English. If we also publish it in Finnish, the version in the language of the site you are using applies to you. This does not take away any right you have under the mandatory law of your country of residence.