Privacy Policy

Last updated: 2026-07-11

Armanac is operated by Armanac LLC, a Wyoming limited liability company ("Armanac," "we," "us," or "our"). It is built by firearms owners, for firearms owners. We understand the sensitivity of the data you entrust to us. This Privacy Policy explains exactly what we collect, why we collect it, how we protect it, and what rights you have over your information. We do not sell your data. We do not run third-party analytics. We do not serve ads. Period.

1. Information We Collect

1.1 Account Information

When you create an Armanac account, we collect:

• Email address; used for passwordless sign-in, account recovery, and essential service communications. Your email is encrypted at rest.
• Your name; we ask for your legal first and last name so they can appear on the documents Armanac generates for you (such as insurance claim packets and estate or beneficiary paperwork). Your name is encrypted at rest.
• Date of birth; collected to confirm you meet the minimum age requirement of 18 years and to keep generated documents accurate. Your date of birth is encrypted at rest.

Armanac uses passwordless sign-in. There is no password to create, remember, or store. When you log in, we email you a one-time six-digit code that expires after 10 minutes; we keep only a one-way hash of that code, never the code itself.

1.2 Firearms Collection Data

You may voluntarily enter information about your firearms collection, including:

• Make, model, and caliber
• Serial numbers
• Estimated and current values
• Round counts, maintenance logs, and accessories or gear
• NFA items (suppressors, short-barreled rifles, and similar), including optional trust and beneficiary details
• Ammunition inventory
• Ballistic "DOPE" and zero records
• Photographs you choose to upload
• Acquisition, disposition, and beneficiary records

1.3 CCW Permit Data

If you use our reciprocity lookup features, you may provide:

• Permit-issuing state
• Permit type (resident, non-resident)
• Permit expiration date

1.4 Training and Range Data

You may log training sessions including:

• Date, location, and duration of sessions
• Firearms used and ammunition expended
• Drills performed and scores achieved
• Notes and observations

1.5 Payment Information

Subscription payments are processed exclusively through Stripe. We never receive, process, or store your credit card number, debit card number, bank account number, or any other card details. From Stripe we keep only what is needed to manage your subscription:

• Stripe customer and subscription identifiers
• Your plan tier and subscription status
• Current billing-period start and end dates

1.6 Automatically Collected Information

When you use Armanac, our servers automatically record:

• IP address (for security and abuse prevention)
• Browser type and version
• Device type
• Timestamps of access
• Pages visited within the application

We do not use third-party analytics services, tracking pixels, or advertising identifiers.

2. How We Use Your Information

We use the information we collect exclusively for the following purposes:

We do not use your data for:

• Advertising or ad targeting
• Sale to third parties
• Profiling or behavioral analytics
• Training machine learning models
• Any purpose unrelated to providing you the Armanac service

3. Who We Share Your Information With

We share your information only with the following parties and only as described:

3.1 Stripe (Payment Processor)

When you subscribe to a paid plan, your payment information is transmitted directly to Stripe, Inc. for processing. Stripe's handling of your data is governed by Stripe's Privacy Policy. We share your email address with Stripe to facilitate payment processing and receipt delivery.

3.2 Infrastructure Providers

Your data is stored on servers operated by our hosting provider within the United States. The hosting provider acts as a data processor under our instruction. Sensitive fields are additionally encrypted at the application layer (AES-256-GCM) before they reach the disk, on top of the provider's full-volume encryption.

3.3 Map Tiles (CARTO)

The background imagery on our maps is loaded directly by your browser from CARTO's public basemap servers. Like any web request, those tile requests expose your IP address and browser user agent to CARTO, and the tile addresses reflect the map areas you view. They carry nothing else: no account data, no permit data, nothing about your collection. We send CARTO nothing ourselves. CARTO's handling of these requests is governed by CARTO's Privacy Notice.

3.4 Email Delivery

Sign-in codes and service emails (security alerts, billing notices) are delivered through our email service provider, which processes your email address and message content for delivery only. We do not send marketing email.

3.5 No Other Third Parties

We do not share, sell, rent, or disclose your personal information to any other third parties, including:

• No advertising networks
• No data brokers
• No analytics providers
• No social media platforms
• No government agencies (except as compelled by valid legal process; see Section 7)

4. Data Security

Given the sensitive nature of firearms ownership data, we build security in at every layer:

• Encryption at rest: Sensitive personal fields are encrypted with AES-256-GCM before they are written to the database. This includes your name, email, and date of birth; firearm, NFA, and accessory serial numbers; NFA trust and beneficiary names; ammunition storage locations; your free-text notes; and your handload and load details (bullet, powder, and primer descriptions, plus lot numbers). Numeric ballistic figures (such as velocities, charge weights, and ballistic coefficients) are not encrypted.
• Uploaded files: Stored attachments (photos and documents) are encrypted at rest with a separate key. Photo uploads also have their embedded metadata (including any GPS location) stripped on upload.
• Encryption in transit: All data transmitted between your device and our servers is protected by TLS.
• Database security: The database is not reachable from the public internet and runs on encrypted, US-based infrastructure with regular security patching.
• US-based infrastructure: All servers and data storage are located exclusively within the United States. Your data never leaves US jurisdiction.
• Access controls: Production access is limited to authorized personnel over authenticated, encrypted channels.
• Passwordless sign-in: We do not use passwords, so there is no password to phish or leak. Login codes are single-use, expire after 10 minutes, and are stored only as one-way hashes.
• Session management: Your session is held in a signed, HTTP-only cookie that expires after 30 days. Signing out ends the session on that device.

No system is perfectly secure. If we discover a breach affecting your personal data, we will notify you via email within 72 hours of confirmation and provide details about what data was affected and what steps we are taking in response.

5. Data Retention and Deletion

5.1 Active Accounts

We retain your data for as long as your account is active and you continue to use the service.

5.2 Account Deletion

You may delete your account at any time from your account settings. Upon deletion:

• Your firearms data, CCW data, and training records are permanently and irreversibly deleted within 30 days.
• Your email and account metadata are deleted within 30 days.
• Backup copies are purged within 90 days of account deletion.
• Stripe retains its own transaction records per its retention policy; we cannot delete data held by Stripe.

5.3 Deletion Requests (CCPA)

California residents and all other users may submit a verified deletion request. We will complete deletion within 45 calendar days of receiving a verified request. If additional time is needed (up to 45 additional days), we will notify you of the extension and the reason.

5.4 Server Logs

Automatically collected server logs (IP addresses, access timestamps) are retained for up to 90 days for security purposes, then permanently deleted.

6. Your Rights

Regardless of your state of residence, we provide all Armanac users with the following rights:

• Right to Access: You may request a complete copy of all personal data we hold about you. We will provide this in a machine-readable format (CSV exports, or an encrypted .armanac of your full account) within 30 days.
• Right to Deletion: You may request deletion of your account and all associated data at any time.
• Right to Export: You may export your full firearms collection, CCW data, and training records at any time from your account settings as CSV, or as an encrypted .armanac of your entire account. This is available on every plan, including free Recon.
• Right to Correction: You may update or correct any data in your account at any time through the application interface.
• Right to Opt-Out of Sale: We never sell personal information. There is nothing to opt out of. If this ever changes (it will not), we will provide a clear opt-out mechanism before any such change takes effect.
• Right to Non-Discrimination: We will never deny you service, charge you different prices, or provide different quality based on exercising your privacy rights.

To exercise any of these rights, contact us at contact@armanac.com. We will verify your identity before processing any request by confirming access to your registered email address.

7. Law Enforcement and Legal Requests

We take our users' privacy seriously and will resist overbroad or unlawful requests for user data. Our policy:

• Content data (firearms records, CCW data, training logs, collection details): We require a valid search warrant issued by a court of competent jurisdiction, supported by probable cause, and describing with particularity the data to be seized.
• Subscriber information (email address, IP address, account creation date): We may provide this in response to a valid subpoena or court order.
• User notification: Unless legally prohibited by a court order (such as a non-disclosure order under 18 U.S.C. 2705(b)), we will notify you of any legal request for your data before complying.
• Challenging requests: We will challenge requests that are overbroad, vague, or legally deficient.

We do not voluntarily provide data to any law enforcement or government agency. We do not maintain any "back door" access for government use.

8. Age Requirement

Armanac is intended exclusively for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under the age of 18. If we become aware that a user is under 18, we will promptly terminate their account and delete all associated data. If you believe a person under 18 has created an account, please contact us at contact@armanac.com.

9. California Residents; CCPA Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides you with specific rights regarding your personal information:

• Right to Know: You have the right to request the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collection, and the categories of third parties with whom we share it.
• Right to Delete: You have the right to request deletion of personal information we have collected. We will comply within 45 days.
• Right to Correct: You have the right to request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do not sell or share (as defined by the CCPA/CPRA) your personal information. We have never sold personal information and have no plans to do so.
• Right to Limit Use of Sensitive Personal Information: We use sensitive personal information (such as firearms serial numbers) only to provide you the service you requested.

To submit a verifiable consumer request, email contact@armanac.com with the subject line "CCPA Request." You may also designate an authorized agent to make a request on your behalf.

Do Not Sell My Personal Information: We do not sell your personal information. We have not sold personal information in the preceding 12 months. We will not sell your personal information.

10. Cookies and Local Storage

Armanac uses only the minimum cookies necessary to operate the service:

• Session cookie: A single, strictly necessary session cookie maintains your authenticated session. It expires when you log out or after 30 days. It also carries a CSRF (cross-site request forgery) prevention token that protects your account from forged requests.
• Download status cookie: When you download a generated PDF or backup, a short-lived cookie (60 seconds, containing no personal data) tells the page your download started so it can stop showing a progress indicator.
• Local storage: We store one interface preference (whether your sidebar is expanded or collapsed) in your browser's local storage. It stays on your device, is never sent to us, and contains no personal information.

We do not use:

• Third-party cookies
• Tracking cookies
• Analytics cookies
• Advertising cookies
• Social media cookies

Because we use only strictly necessary cookies, no cookie consent banner is required. You cannot opt out of session cookies and continue using the service, as they are essential for authentication.

11. International Users

Armanac is operated exclusively from the United States and is intended for users located in the United States. All data is stored on servers within the United States. If you access Armanac from outside the United States, you do so at your own initiative and are responsible for compliance with local laws. By using Armanac, you consent to the transfer and processing of your data in the United States.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes:

• We will update the "Last updated" date at the top of this page.
• For material changes (new data collection, new sharing partners, or changes to your rights), we will notify you by email at least 30 days before the changes take effect.
• Your continued use of Armanac after the effective date constitutes acceptance of the updated policy.
• If you disagree with any changes, you may delete your account and all associated data before the changes take effect.

13. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about how your data is handled, contact us:

• Email: contact@armanac.com
• Subject line: "Privacy Inquiry" for general questions; "CCPA Request" for California privacy rights requests; "Data Deletion" for deletion requests; "Data Export" for export requests.

We will acknowledge receipt of your inquiry within 3 business days and provide a substantive response within 30 days.