Privacy notice

Last updated: 5 November 2026

1. Who is responsible for your data

Liam Smart, a sole trader in the United Kingdom trading as "ML Gear Calculator", is the controller of your personal data under the UK GDPR and the Data Protection Act 2018. Contact: mlgearhelper@gmail.com.

We collect only what the site needs to work. We do not sell or share your data, and we do not use it for marketing, advertising or profiling.

2. What we hold and why

Data	Why	Lawful basis
Your email address (and a password hash held by Supabase if you use a password)	Creating and signing in to your account	Contract
Your Google account ID (and the email/name Google shares), only if you choose Google sign-in	Signing you in with Google	Contract
Saved loadouts (your gear builds)	Saving and loading builds on any device	Contract
VIP status and how it was unlocked (purchase or redeem code); for purchases, Stripe customer/payment IDs, amount, date and when you accepted the terms	Providing VIP; for purchases, accounting and handling refunds and disputes	Contract; legal obligation (tax records)
When you first used the optimiser, and how many times	Applying the no-refund-after-use rule for purchases	Contract
IP address and standard server request logs; redeem-code attempts	Security and rate limiting (stopping abuse and code guessing)	Legitimate interests (keeping the service secure)

3. Cookies and storage

We only use strictly necessary browser storage: the sign-in session that keeps you logged in ("stay logged in"). There are no analytics, advertising or tracking cookies, so there is no cookie banner. The free planner works without an account and keeps your build only in your browser (localStorage) and in the share link.

4. Who processes it for us

Supabase - database and sign-in (hosted in the EU: AWS eu-west-1, Ireland).
Cloudflare - hosting, the optimiser API, DNS and security (sees IP addresses and request logs).
Stripe - payments. We never see your card details. Stripe is also an independent controller for some payment data, such as fraud checks.
Google - only if you choose Google sign-in.

Our database is stored in the EU (Ireland), which the UK recognises as adequate. Some providers may also handle data elsewhere, for example in the USA. Where they do, the transfer is covered by UK adequacy regulations (including the UK-US Data Bridge) or the UK International Data Transfer Addendum.

5. How long we keep it

Account, Google ID and loadouts: until you delete your account.
Purchase records, including the optimiser-use record: 6 years after the end of the tax year of the purchase (HMRC record-keeping), kept in minimal form even after you delete your account.
Redeem-attempt and security logs: up to 90 days.

6. Your rights

You can ask for access, correction, deletion, restriction or portability of your data, and object to processing based on legitimate interests. Account → Download my data gives you a copy (JSON). Account → Delete account deletes your account and loadouts. For anything else email mlgearhelper@gmail.com; we reply within one month. You can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

7. Children

Accounts are not intended for children under 13.

8. Changes

We will post any changes here and update the date above.

Terms · Back to the planner