Privacy Policy

GearCred is operated by Windy Point Media, LLC (“we”, “us”). This policy explains what personal information we collect when you use GearCred, how we use it, and the choices you have. It covers shoppers, creators, and brand users.

What we collect

Everyone with an account

• Email address and password. Passwords are handled by our authentication provider and stored only in hashed form; we never see them.
• Your name, if you provide it.

Shoppers

• The activities and interests you choose, your email preferences, the creators and brands you follow, the posts you save, and the gear lists you create.
• If you turn on earning links: the links you make, their clicks and sales, what you earn, and your payout records. Payout and tax details go to Stripe, not to us.

Creators

• Public profile details: display name, bio, profile photo, and links to your social accounts.
• The posts you publish: photos, captions, video embeds, and the gear you tag.
• Contact and business details: phone number, tax identification number (for commission payments and tax reporting), and shipping address (for product samples you request).
• Your approximate location, rounded to about 10 km, if you share it from your device for weather-based post ideas. Without it we use your shipping ZIP, if you added one, the same way.
• Commission and payout records, and your promo code requests.
• If you connect Instagram or TikTok, the data described in those sections below.

Brand users

• Your name, email, and the brand you represent, plus content you upload such as your brand logo.

Activity on GearCred

• When someone clicks a gear link, we record which link was clicked and when, the browser's user agent (browser and device type), and a visitor code made by scrambling the IP address and browser together with a key that changes every day. We don't store the IP address itself. We use this to show creators how their recommendations perform, to filter out bots and repeated clicks, and, if you make an earning link for a product, to credit a creator whose link for it you clicked in the last 30 days.
• We count page views on GearCred with our own code, not an outside analytics service. For each view we record the page, the referring site and any campaign tags in the link, the kind of device (phone, tablet or computer), a random visitor ID kept in your browser's storage, an ID for the visit that ends when you close the tab, and, if you're signed in, your account. If you were shown a product in a creator's post and later make a link for it, we use these page views to credit that creator.

Instagram

If you are a creator and choose to connect your Instagram professional account, you sign in with Instagram and approve access. We then receive and store:

• Your Instagram user ID, username, and account type.
• An access token that lets us read your profile and media on your behalf. It is stored encrypted and is never shown to anyone.
• The list of your recent posts, which we show only to you so you can choose which ones to bring into GearCred.

Nothing from Instagram is published on GearCred unless you choose a post and publish it. When you import a post, we copy its photos and caption into your GearCred post so it keeps working if Instagram's links change. We never post to Instagram, and we do not access your messages, followers, or insights.

You can disconnect at any time in Account Settings, which deletes the stored token and Instagram details. You can also remove GearCred from Instagram under Settings, Apps and websites. See Data deletion.

TikTok

If you are a creator and choose to connect your TikTok account, you sign in with TikTok and approve access. We then receive and store:

• Your TikTok open ID, username, and display name, so we can show which account is connected.
• An access token and refresh token that let us read your profile and list your videos on your behalf. They are stored encrypted and are never shown to anyone.
• The list of your recent videos (title, cover image, link and date), which we show only to you so you can choose which ones to bring into GearCred.

Nothing from TikTok is published on GearCred unless you choose a video and publish it. When you import a video, we save its cover image and link, and show it on your post with TikTok's own embedded player. We never post to TikTok, and we do not access your messages, followers, or analytics.

You can disconnect at any time in Account Settings, which revokes our access at TikTok and deletes the stored tokens and TikTok details. You can also remove GearCred in the TikTok app under Settings and privacy, Security, Apps and services. See Data deletion.

How we use it

• To run GearCred: show creator profiles and posts, keep your follows, saves and lists, and let you log in.
• To build affiliate links and attribute sales, so creators, and shoppers who turn on earning links, are paid commissions.
• To handle requests between creators and brands, such as promo codes and product samples.
• To pay creators and shoppers with earning links, and meet tax obligations.
• To send the emails you've chosen to receive, and essential account emails such as password resets.
• To keep GearCred secure and prevent abuse.

We do not sell your personal information, and we do not use it for third-party advertising.

Who we share it with

• The public: creator profiles, published posts, tagged gear, and public gear lists are visible to anyone. Shopper accounts are not public.
• Brands: when a creator requests a promo code or product sample from a brand, that brand sees the creator's name, public profile, GearCred activity (posts, clicks and sales), follower counts from accounts the creator connected, the request and any messages about it, and for samples, the shipping address provided. Once the brand approves a request, the brand sees the creator's email and the creator sees the brand's contact email, so they can talk directly.
• Affiliate networks and retailers: when you click a gear link you are sent to the retailer through an affiliate network (such as AvantLink, Impact, CJ, Rakuten, Partnerize or Awin), which receives the click under its own privacy policy.
• Service providers that host and run GearCred for us, including Supabase (database, authentication, file storage), Replit (hosting), Anthropic (AI that reads the photos and caption of a post you create or import to suggest the gear in it), logo.dev (brand logo images), Open-Meteo (weather forecasts, which receive only your rounded location or ZIP), SendGrid (email), and Stripe (payouts: the identity, bank and tax details you enter during payout setup go to Stripe, not to us). They process data only on our behalf.
• Meta: if you connect Instagram, the connection is made through Meta's systems under Meta's terms.
• TikTok: if you connect TikTok, the connection is made through TikTok's systems under TikTok's terms.
• Legal reasons: when required by law, or to protect the rights and safety of our users or GearCred.

Cookies

We do not use advertising cookies. We use cookies and your browser's storage for these things:

• Essential: keeping you signed in, securing sign-in, and remembering your cookie choice. These are always on.
• Creator credit: when you arrive through a creator's post, profile or gear list, we remember that creator for 7 days so they get credit for what you buy through GearCred. Nobody gets credit for their own purchases.
• Visit counting: an anonymous id in your browser's storage so we can count visits. It is never shared with advertisers.

Choose Essential only to turn off creator credit and the lasting visit id. Retailers and affiliate networks you visit from GearCred set their own cookies to credit the creator who referred you; their own policies cover those.

Cookie settings

Your choices and rights

• Edit your profile, preferences, and email settings at any time in your account settings.
• Delete your account from your settings page. See Data deletion for what is removed.
• Ask us for a copy of your data, or to correct or delete it, by emailing info@gearcred.com.

Depending on where you live (for example California, or the EU and UK), you may have additional rights, including to know what we hold, to delete it, and to object to certain uses. We honor these requests regardless of where you live.

Retention

We keep your information while your account is open. When you delete your account we remove it from our live systems right away; copies in backups are overwritten within 30 days. Commission and tax records may be kept longer where the law requires.

Security

We protect data with access controls and encryption in transit, and we encrypt stored social account tokens. No system is perfectly secure, but we work to keep yours safe.

Children

GearCred is not intended for anyone under 16, and we do not knowingly collect their information. Creator accounts require you to be 18 or older.

Changes

If we change this policy we will update the date above, and tell you directly for significant changes.

Contact

Questions or requests: info@gearcred.com. Windy Point Media, LLC.