What we collect, and what we don't.

Reading the site

You do not need an account to search the directory, read a company’s record, or look at grades. While you are just reading, the only thing recorded about you is that a page was viewed. We do not learn your name or your email from that, and it is not connected to an account.

Like every website, our hosting provider processes the technical details of your request, your IP address, browser and the page you asked for, in order to deliver the page and to block abuse. We do not build a profile from that or connect it to an account.

How the site knows roughly where you are

The directory can show results near you. To do that we read an approximate city and state from the network location of your request, which our host attaches to it before it reaches us. That is why you are never asked for location permission.

This is metro-level and often wrong: a VPN will place you in another state entirely. We use it only to label and order search results on the page you are looking at. It is not stored and not attached to your account.

If you create an account

An account is only needed to post something. When you create one we store:

• Your email address and password, held by our authentication provider. Passwords are stored hashed. We never see them and cannot recover them for you.
• Or, if you use Sign in with Apple, the identifier Apple returns. If you choose Apple’s Hide My Email, we only ever see the relay address.
• A display name, which you choose and which is shown publicly on anything you post.

What you post

• Reviews: your rating, your written comment and your display name. These are public, on the business’s page, and your rating is counted into that business’s Consumer Grade.
• Evidence submissions: the action you are reporting and the source link backing it. If an editor verifies it and it enters the record, the entry and its source become public. Your identity does not.
• Photos you upload to a business listing. These are public.
• Reports you file on someone else’s review. These are private and go only to moderators.

Files you attach to a submission

When you report an action you can attach the document behind it: a filing, a policy page, a screenshot. Those files upload into a private area, under your account, that the public cannot browse.

But be clear about where they end up: if an editor verifies your submission and the action goes into the record, the files attached to it become publicly readable, because they are the receipt the entry rests on. Attach the document that proves the corporate action. Do not attach anything showing your own name, address or account details, crop it out first.

Files on submissions that are rejected, or still pending, stay private to you and to the editors reviewing them.

Claims and verification: read this part

Two flows ask you to describe your credentials in your own words, in a text box:

• Claiming a business listing: you describe your connection to the business so an administrator can check it.
• Applying for a verification badge: permit holder, veteran, law enforcement, firearms-industry professional or instructor.

Whatever you type there is stored in our database as you wrote it. A permit number, a department, a license number or a service record says something about your life that a shopping site has no business holding, so write the least that will let us check, and leave the numbers out unless we ask.

What we do with it: this text is readable only by you and by site administrators reviewing your application. It is never published, never shown next to your reviews, and never shared with the business you are claiming. If your application is decided and you would like the text removed, email 2a@free2carry.com and we will clear it.

How we measure the site

We use third-party analytics software to see how the site is being used: how many people opened a page, which sections get read, roughly what part of the country visitors are in, and whether they arrived from a search engine or a link. We look at it to decide what to build next and, increasingly, to answer people who ask how big the audience is.

What it does not tell us is who you are. The reports we see are counts and percentages. There is no name, no email address, and no way to click a number and find the person behind it. It is not joined to your account if you have one, and it is not joined to anything you have posted.

We do not use it to build an advertising profile of you, and we run no advertising on this site. We separately keep our own simple counts of how often a business or brand page was opened, which is what produces the view figures an owner sees on a claimed listing. Those counts are deduplicated with a key that is re-salted every day and deleted nightly, so they cannot be used to follow anyone from one day to the next.

What we do not collect

• No advertising trackers. There is no ad pixel, no ad network and no retargeting on this site. Nothing follows you here from another site, and nothing follows you away from it. We do measure page views, which is described under How we measure the site.
• No device location. We never call your browser’s location API, so you never see a permission prompt from us.
• No card numbers. Reading the site is free. A business owner can pay to upgrade a listing, and the card form in that checkout is served by our payment processor and embedded in our page: what you type goes straight to them. No card number, expiry or security code ever reaches our servers or our database. All we are told back is that a payment succeeded, which listing it was for, and the amount.
• No contacts, no address book, no browsing history from outside this site.

Cookies and browser storage

We set no advertising cookies. What is stored is:

• An analytics cookie, holding a random number that lets our analytics software tell a returning visit from a new one, so ten pages read in one sitting count as one person rather than ten. It is not tied to your account and carries nothing about you. Blocking it changes nothing about how the site works.
• Your sign-in session, kept in your browser’s local storage so you stay signed in. Signing out removes it.
• Your theme choice, if you change it. A single preference value.
• A preview-access cookie, while the site is in pre-launch preview. It holds no information about you and disappears at launch.

None of these follow you to other sites, so there is no consent banner to click. If you would rather not be counted at all, any content blocker will stop the analytics script, and the site is built to work exactly the same without it.

Who else handles your data

We use a small number of service providers to run the site. Except for the analytics provider, which is noted below, they process data on our instructions and are not permitted to use it for their own purposes.

• Our database, sign-in system and file storage: everything described in the sections above lives here.
• Hosting and content delivery: handles the technical request data described above.
• A mapping service: turns a place name into coordinates when you search by location. Only the location text you type is sent, from our server rather than your browser, and it is not tied to your account.
• An analytics provider: receives the page-view measurements described under How we measure the site, along with the technical details of the request such as browser, approximate region and referring link. This is the one provider on this list that also operates under its own terms rather than purely on our instructions, which is why it is named as an exception above.
• A payment processor: only if a business owner buys a listing upgrade. They take the card details directly and tell us the payment succeeded. We never see the card.
• Sign in with Apple: only if you choose it, and only to sign you in.

We will also disclose information if we are legally required to, or where it is necessary to investigate abuse of the site or a threat to someone’s safety.

We do not sell personal information and we do not share it for advertising.

Data about companies and candidates

Most of what is on Free2Carry is not about you at all. Business listings, corporate actions and campaign-finance records come from public sources (public mapping data, Federal Election Commission filings and Senate lobbying disclosures) and the record of what a company did is published as a matter of public interest. Candidates for public office are covered in their public capacity.

If you believe a record about a company or a candidate is wrong, that is what the Corrections Policy is for, and we would rather hear from you than not.

How long we keep things

• Your account and profile: until you delete the account.
• Reviews, submissions and photos: until you or a moderator remove them. Verified actions that entered the graded record stay, because the record is the point. They are about the company, not about you.
• What you wrote on a claim or verification application: only as long as needed to decide it, and we will clear it sooner on request.

Deleting your account

Email 2a@free2carry.com from your account address and we will delete your account, your profile and your uploaded documents. Reviews you wrote are removed with it.

You can also ask us for a copy of what we hold about you, or to correct it. Depending on where you live you may have additional rights under state or national privacy law; ask and we will honor them.

Security

Access to the database is restricted per-user at the database itself, not merely in the application, so one signed-in account cannot read another’s private records. Uploaded claim and verification documents sit in private storage that is not publicly reachable.

No system is perfect. If you find a security problem, please tell us at 2a@free2carry.com before disclosing it publicly, and we will work with you.

Children

Free2Carry is not directed at children and accounts are for adults. We do not knowingly collect information from anyone under 13. If you believe a child has created an account, tell us and we will remove it.

Where this applies

The site covers United States businesses and is operated from the United States, and your information is processed there.

Changes

If we change this policy we will change the date at the top. If a change materially affects what we collect or who we share it with, we will say so on the site rather than quietly editing the page.

Contact

Questions about any of this: 2a@free2carry.com.