Privacy Policy

Last updated: May 2026

GC Used Inventory Tracker ("the site", "we", "us") is an independent personal project that helps musicians track used gear listings at Guitar Center. It is not affiliated with, sponsored by, or endorsed by Guitar Center, Inc. This policy explains what information we collect, how we use it, and your rights regarding that information.

Information We Collect

Account information. If you create an account, we store your chosen username, an optional email address, and a hashed (never plain-text) version of your password. If you sign in with Google, we store your Google account ID and the display name Google provides. Your email address is never required and is used only for account recovery if you choose to provide it.

Preferences and scan history. To sync your data across devices, we store your watch list, want list keywords, favorited stores, saved searches, and the timestamp and item IDs from your most recent scan. This data lives on our server and is tied to your account.

Technical data. When you use the site, our server receives your IP address. We use it only for rate-limiting (to prevent abuse) and do not log or store it persistently. We also set an anonymous device ID cookie (gt_device_id) to count unique devices in aggregate — it contains no personal information.

Analytics. We use Google Analytics 4 to understand how visitors use the site in aggregate (page views, session counts, general geography). Google Analytics may set its own cookies in your browser. You can opt out using the Google Analytics Opt-out Browser Add-on.

How We Use Your Information

To provide the core tracker functionality (scan results, watch list, want list)
To sync your preferences across your own devices when you are logged in
To prevent abuse via rate limiting on scan and login endpoints
To understand aggregate site usage through analytics

We do not sell, rent, or share your personal information with third parties for their marketing purposes.

Cookies

Session cookie — keeps you logged in across browser sessions. Set by Flask, signed with a server secret, HttpOnly and Secure.
gt_device_id — anonymous device identifier for internal usage counting. Contains no personal information.
Google Analytics cookies (_ga, _gid, and related) — set by Google's analytics script to measure aggregate traffic.

Third-Party Services

Google Analytics — aggregate usage data. Google Privacy Policy.
Google Sign-In (OAuth) — optional login method. We receive your Google ID and display name only. We do not receive your Google contacts, Drive files, or any other Google data.
Railway — the cloud platform that hosts the site. Your data is stored on Railway's infrastructure in the United States.

Data Retention

Your account and associated data are retained until you request deletion. You can request that your account be deleted at any time by contacting us at the address below. Guest users (no account) have no data stored on our servers beyond the anonymous device ID cookie.

Children's Privacy

This site is not directed at children under 13. We do not knowingly collect personal information from children.

Changes to This Policy

If we make material changes to this policy, we will update the "Last updated" date at the top of this page. Continued use of the site after changes are posted constitutes acceptance of the updated policy.

Contact

Questions about this privacy policy or your data can be sent to: cboehmig@gmail.com