What lives on the server now
Arms Room's personal collection storage has moved to the native iOS app. The web app still has account, billing, admin, shared catalog and stateless AI relay routes, but the old web armory, ammo, missions, friends, share and export surfaces are retired.
The route boundary is enforced in code and the retention boundary is enforced by migration: old personal collection rows are purged, and new writes to those endpoints return 410 Gone.
Your account
Email address
Our database
Display name, @handle, profile photo and theme accent
Used for account/profile screens and owner/admin support. The retired friends surface is blocked from normal web use.
Our database
Password
Stored as a scrypt hash. If you lose it, we reset it; we cannot look it up.
Our database
Verification, login and password-reset codes
Codes are short-lived and single-use. The clear code exists when generated and when emailed, but the database stores only a hash.
Our database as hashes; email provider during delivery
Sessions, account status and owner/admin notes
This includes sign-in sessions, suspension state, plan grants and the reason an owner wrote for a manual account change.
Our database
Google sign-in tokens
Only if you chose Continue with Google. Email/password sign-in does not involve Google.
Our database
Plan, AI meter and Stripe customer/subscription ids
Enough to enforce plan limits and open Stripe's billing portal. Card numbers never touch our servers.
Our database
Your collection
Current firearms, serials, ammo, photos, range trips and maintenance logs
The native app is the source of truth. Web inventory pages redirect to /local-only, and old personal collection APIs return 410 Gone.
The iOS device's local store
Missions, ranks, reminders and local exports
Progress and backups are computed from the local store. The server-side reminder cron is retired.
The iOS device
Temporary Sergeant Steel roster summary
The iOS app sends a device-built summary with a question. We do not write that summary or the chat transcript to our database.
One AI request
Scan-to-add image
The image is processed for the answer and is not stored by Arms Room.
One AI identification request
Shared firearm and accessory catalog
The catalog is reference data: make, model, caliber/type and related notes. This release anonymizes old submitter links while keeping the shared entries.
Our database
Retired web collection rows from older releases
A migration clears old Postgres armory, ammo, share, friend, mission, reminder and page-view rows. The tables remain only so older code can compile while the routes are retired.
Purged by migration
Usage, AI and billing
Web page-view analytics
/api/v1/track is a no-op and the browser beacon is no longer mounted. Historical rows are cleared by the retirement migration.
Nowhere in our app database
IP address and browser metadata
Our app no longer writes a visitor hash to Postgres. Vercel and other infrastructure still process ordinary request metadata because that is how web hosting works.
Web host/runtime logs
Sergeant Steel message count
One monthly counter per account, used for plan limits. It is not a transcript.
Our database
Card number
Checkout and card management are hosted by Stripe.
Nowhere in Arms Room
Transactional emails
Sign-in codes, password resets, verification and deletion confirmations include your email address.
Resend
Who can see what
Owner/admin dashboard
The owner can see account/admin tooling and the ship log. Normal users do not get the Admin nav item, and /admin returns 404 unless the signed-in email is authorized.
Owner account only
Updates, pushes and ship log
Release/update panels were removed from the user dashboard and moved into the owner admin page.
Owner/admin only
Other users
The web friends and public share surfaces are retired. Normal users can browse the shared catalog and manage their account; they cannot see another user's collection.
Shared catalog only
Who else sees any of it
These are the only companies user data reaches from the live web/native flows.
Anthropic
Sergeant Steel
When you ask Sergeant Steel in the iOS app: your message plus a temporary roster summary built on the device. When you use scan-to-add: the photo you took. We do not write either one to our database.
Sign in with Google
Only if you chose Continue with Google. They see that you signed in to Arms Room, and — because your profile picture is served from their servers — your browser fetches it from Google on every page you load, which shows them your IP address. Nothing about your collection ever reaches them. Sign in with an email and password instead and Google is not involved at all.
Resend
Email delivery
Your email address and transactional account emails such as sign-in codes, password resets and deletion confirmations.
Stripe
Billing
Your email, name and account id. Card details go directly to Stripe, not through us.
Supabase
Database hosting
Account, admin, billing, shared catalog and any historical retired web collection rows that have not been deleted yet.
Vercel
App hosting
Requests to the site, as any web host does.
What we never do
- Sell your data or share it for advertising.
- Run ad networks, tracking pixels, third-party analytics or session recorders.
- Use the web app as a backup copy of a user's firearms, serial numbers, ammo, logs or photos.
- Show updates, pushes or owner/admin controls to ordinary users.
What you control
Use the iOS export. Collection backups are made from the local device store, not from a server export endpoint.
Delete your account. Account deletion removes sessions, account-owned server rows and any historical collection rows that still exist for that account. Your current local iOS data remains on your device until you export or remove it there.
Check the boundary. The public local-only page names the retired surfaces, and this page changes in the same release if the storage model changes.
Something on this page looks wrong? Review your settings, or have the owner check the admin console.