Effective date: 5 August 2026 Last updated: 5 August 2026
This Privacy Policy explains how Discovery Torch S.R.L. (“Discovery Torch”, “we”, “us”) collects, uses, and shares personal information when you visit gearqm.com (the “Site”) or use the GearQM mobile application (the “App”). The Site and the App are referred to together as the “Services”.
Who we are
Discovery Torch S.R.L. Valenii Somcutei 266, Maramureș County, Romania VAT: RO39898765 Email: contact@gearqm.com
Discovery Torch S.R.L. is the data controller for the personal data described in this policy.
The short version. We collect the account and gear data you give us, technical and usage data needed to run and improve the Services, and advertising identifiers used to show ads. Your gear and trip data is stored in the European Union. We never sell your data for money, but some advertising activity counts as a “sale” or “share” under certain US state privacy laws, and you can opt out at any time.
1. Who this policy applies to
The Services are intended for a general audience aged 13 and over. They are not directed at children under 13, and we do not knowingly collect personal information from them. See Section 11.
2. Information we collect
2.1 Information you provide
- Account information — email address, password (stored only as a salted hash), display name, and any optional profile details you add.
- Gear and trip content — the gear items, weights, packs, checklists, trip details, tags, notes, and photos you create in the App. This is your content; we process it to provide the Services and to sync it across your devices.
- Purchase information — if you buy a subscription or a one-off paid feature, the transaction is processed by Apple or Google. We receive confirmation of the purchase, its status, and a transaction identifier. We never receive your card number or full billing details.
- Support and correspondence — messages, your email address, and any diagnostic details you send us when you contact support, leave feedback, or report a bug.
2.2 Information collected automatically
- Device and technical data — device model, operating system version, app version, language, region, screen characteristics, time zone, network type, and a randomly generated installation identifier.
- Usage and event data — screens viewed, features used, sessions, interaction events, and performance timings.
- Crash and diagnostic data — stack traces, error logs, device state at the time of a crash, and related diagnostics.
- Advertising identifiers — the Google Advertising ID (Android) or the Identifier for Advertisers / IDFA (iOS, only where you have granted permission under App Tracking Transparency), plus limited data about ads requested, shown, viewed, and clicked.
- Affiliate and outbound link data — when you tap a link to a retailer, that retailer or its affiliate network may receive a referral identifier and record the click and any resulting purchase, so a commission can be attributed to us. See Section 5.
- Server and log data — IP address, request timestamps, user agent, referring URL, and pages or endpoints requested.
- Cookies and similar technologies (Site) — see Section 8.
2.3 Information we do not collect
We do not request location permissions, and the App does not collect precise or coarse geolocation. We do not collect contacts, health data, or biometric data. Camera and photo library access, if you grant it, is used only to attach images to your own gear items; your photos are not scanned or analysed for any other purpose.
3. How we use information, and our legal bases
Where the EU or UK GDPR applies, we rely on the legal bases set out below.
| Purpose | Categories used | Legal basis (GDPR) |
|---|---|---|
| Create and operate your account; sync your gear and trip data across devices | Account information, gear and trip content, device data | Performance of a contract (Art. 6(1)(b)) |
| Deliver core App and Site functionality, including offline use | Gear and trip content, device data | Performance of a contract |
| Process subscriptions and one-off purchases, and manage entitlements | Purchase information, account information | Performance of a contract |
| Respond to support requests | Correspondence, account and device data | Performance of a contract; legitimate interests (Art. 6(1)(f)) in supporting our users |
| Diagnose crashes, maintain security, prevent fraud and abuse | Crash data, device data, log data | Legitimate interests in a secure, functioning service; legal obligation where applicable |
| Understand feature usage and improve the Services | Usage and event data, device data | Consent where required by local law; otherwise legitimate interests in improving our product |
| Show advertising, including personalised advertising, and measure its performance | Advertising identifiers, device data, ad interaction data | Consent (Art. 6(1)(a)) in the EEA, UK, and Switzerland, and wherever else consent is required |
| Attribute affiliate referrals and commissions | Outbound click data, referral identifiers | Legitimate interests in funding the Services; consent where required |
| Send service messages (account verification, password resets, security alerts, billing notices, material changes) | Account information | Performance of a contract; legal obligation |
| Establish, exercise, or defend legal claims; comply with law | As relevant | Legal obligation; legitimate interests |
We do not use your gear and trip content to build advertising profiles, and we do not use it to train machine learning models.
4. Advertising
The App displays advertising supplied by third-party ad networks. These networks act as independent controllers or, in some cases, joint controllers for the data they collect through their SDKs, and their own privacy policies apply:
| Network | Entity | Privacy policy |
|---|---|---|
| Google AdMob | Google Ireland Limited (EEA/UK) / Google LLC | https://policies.google.com/privacy |
| InMobi | InMobi Pte Ltd | https://www.inmobi.com/privacy-policy/ (EEA: https://www.inmobi.com/privacy-policy-for-eea/) |
| BidMachine | BidMachine Inc. | https://www.bidmachine.io/privacy-policy |
| Smaato | Smaato Inc. (Verve Group) | https://www.smaato.com/privacy/ |
Your controls:
- In the EEA, UK, and Switzerland, we ask for your consent through an IAB TCF-compliant consent management platform before any personalised advertising or non-essential analytics takes place. You can change or withdraw that choice at any time in App → Settings → Privacy.
- On iOS, personalised advertising based on the IDFA occurs only if you allow tracking when prompted. You can change this in Settings → Privacy & Security → Tracking.
- On Android, you can reset or delete your advertising ID in Settings → Privacy → Ads.
- BidMachine offers a direct SDK opt-out at https://bidmachine.io/sdk-opt-out/.
- Industry opt-outs are available at https://youradchoices.com and https://www.networkadvertising.org/choices/.
If you opt out of personalised advertising, you will still see ads, but they will be non-personalised. Advertising is not shown on the Site.
5. Affiliate links
Parts of the Services contain links to retailers and manufacturers. If you follow such a link and make a purchase, we may earn a commission at no additional cost to you. Once you leave the Services, the destination site’s own privacy policy governs any information it collects, including cookies and identifiers it sets to track the referral. We receive aggregated or pseudonymised reporting about clicks and completed purchases — typically order value and commission — and not your name, address, or payment details.
6. How we share information
We share personal information only as described here. We do not sell personal information for money.
Service providers (processors) acting on our documented instructions, under a data processing agreement:
| Provider | Purpose | Location of processing |
|---|---|---|
| Supabase | Account authentication, database hosting, data sync, transactional account emails | European Union (eu-west) |
| Google (Firebase Analytics) | Product analytics | EU and United States |
| Google (Firebase Crashlytics) | Crash and stability reporting | EU and United States |
Other recipients:
- Advertising and affiliate networks, as described in Sections 4 and 5. Under some US state privacy laws, sharing advertising identifiers for targeted advertising is treated as a “sale” or “share”. See Section 10.3.
- Apple and Google, in connection with app distribution, subscriptions, and one-off purchases.
- Legal and safety disclosures, where required by law, legal process, or a valid government request, or where necessary to protect our rights, our users, or the security of the Services.
- Business transfers, in connection with a merger, acquisition, financing, or sale of assets, subject to this policy continuing to apply to the transferred information.
7. International transfers
We are established in Romania, and your account data and gear content are stored on infrastructure located in the European Union.
Some of our providers and advertising partners are established outside the EEA, including in the United States, India, and Singapore, and personnel there may access data in the course of providing support or serving ads. Where we transfer personal data outside the EEA or the UK, we rely on an appropriate safeguard, generally the European Commission’s Standard Contractual Clauses together with the UK International Data Transfer Addendum where relevant, or on the recipient’s certification under the EU–US Data Privacy Framework where applicable. You may request a copy of the relevant safeguards by writing to contact@gearqm.com.
8. Cookies and similar technologies (Site)
The Site uses:
- Strictly necessary cookies — security, load balancing, and remembering your cookie choices. These are set without consent because the Site cannot function without them.
- Analytics cookies — to understand how the Site is used, via [SITE ANALYTICS PROVIDER]. Set only with your consent where consent is required.
- Affiliate cookies — to attribute referrals to retailers. Set only with your consent where consent is required.
The Site does not display advertising and does not run advertising cookies.
You can withdraw or change consent at any time through the cookie settings link in the Site footer, and you can block or delete cookies in your browser settings. We honour Global Privacy Control (GPC) signals as a valid opt-out of sale, sharing, and targeted advertising where the law requires it.
9. Retention
| Data | Retention period |
|---|---|
| Account information and gear/trip content | For as long as your account is active, then deleted within 30 days of account deletion |
| Backups containing deleted data | Purged on the normal backup rotation, within 35 days |
| Crash and diagnostic data | 90 days |
| Analytics and usage event data | 14 months |
| Advertising and ad interaction data | Per the relevant network’s retention policy |
| Support correspondence | 24 months after the matter is resolved |
| Transaction and invoicing records | As required by Romanian tax and accounting law, generally 10 years |
Aggregated or anonymised data that can no longer be linked to you may be retained indefinitely.
10. Your rights
10.1 Access, export, and deletion — available to everyone
You can access and export your gear and trip content directly in the App.
You can permanently delete your account and all associated data at any time in the App, under Settings → Account → Delete account. Deletion removes your account record, gear and trip content, and synced data from our production systems within 30 days, and from backups within 35 days.
If you no longer have access to the App or cannot complete deletion in-app, email contact@gearqm.com from the address associated with your account and we will process the deletion on your behalf. Note that deleting the App from your device alone does not delete data held on our servers.
Records we are legally required to keep, such as transaction records for tax purposes, are retained for the periods set out in Section 9 even after account deletion.
10.2 EEA, UK, and Switzerland
You have the right to: access your personal data; obtain rectification of inaccurate data; request erasure; request restriction of processing; object to processing based on legitimate interests, including profiling for direct marketing; receive your data in a portable format; and withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
To exercise these rights, use the in-app controls or email contact@gearqm.com. We respond within one month, extendable by two further months for complex requests, and we will tell you if an extension applies.
You may lodge a complaint with a supervisory authority. Ours is the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, Romania — www.dataprotection.ro. You may also complain to the authority in your country of residence or workplace.
We do not carry out automated decision-making that produces legal or similarly significant effects.
10.3 United States
Depending on your state of residence — including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, and other states as their laws take effect — you may have the right to:
- Know and access the categories and specific pieces of personal information we collected, the sources, the purposes, and the categories of recipients
- Delete personal information we hold about you
- Correct inaccurate personal information
- Obtain a portable copy of your personal information
- Opt out of the sale or sharing of personal information and of targeted advertising
- Opt out of profiling in furtherance of decisions producing legal or similarly significant effects (we do not engage in this)
- Be free from discrimination for exercising any of these rights
Sale and sharing disclosure. In the preceding 12 months we collected the categories of personal information described in Section 2 — identifiers, commercial information, internet and network activity, and inferences drawn from usage. We disclosed identifiers and internet activity information to the advertising partners listed in Section 4 for cross-context behavioural advertising, which the CCPA and similar state laws treat as “selling” and “sharing”. We do not knowingly sell or share the personal information of consumers under 16. We do not collect sensitive personal information for any purpose that would require a limitation-of-use notice.
To opt out, use the “Do Not Sell or Share My Personal Information” control in App → Settings → Privacy, the equivalent link in the Site footer, or enable Global Privacy Control in your browser.
To exercise other rights, email contact@gearqm.com. We verify requests using the email address associated with your account. Authorised agents may submit requests with written proof of authorisation. We respond within 45 days, extendable once by a further 45 days where permitted. If we deny your request, you may appeal by replying to our decision or emailing contact@gearqm.com with “Appeal” in the subject line; we will respond to appeals within 45 days.
11. Children
The Services are not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has provided us with personal information, contact contact@gearqm.com and we will delete it promptly. In the EEA and the UK, where the applicable national age of digital consent is higher than 13, users below that age should not use the Services without the consent of a parent or guardian. We do not serve personalised advertising to users we know to be under 18.
12. Security
We protect personal information using encryption in transit (TLS), encryption at rest for our databases and backups, hashed password storage, row-level access controls restricting each account to its own data, staff access limited on a need-to-know basis, and regular dependency and infrastructure updates. No system is perfectly secure, and we cannot guarantee absolute security. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify ANSPDCP within 72 hours and affected users without undue delay, as required by Art. 33 and 34 GDPR.
13. Changes to this policy
We may update this policy from time to time. We will change the “Last updated” date above and, for material changes, provide additional notice through the App or by email before the change takes effect. Where a change requires it, we will ask for your consent again.
14. Contact
Discovery Torch S.R.L. Valenii Somcutei 266, Maramureș County, Romania VAT: RO39898765 Email: contact@gearqm.com
We have not appointed a Data Protection Officer, as our processing does not meet the criteria in Art. 37 GDPR. As we are established in the European Union, no representative under Art. 27 GDPR is required.