Privacy Policy

Last updated: October 16, 2026

This policy explains what Yardstick Outfitters collects and how we use it. Short version: we collect what we need to find gear in your size, we don't sell your data, and you can ask us to delete it anytime.

What we collect

• Email address, when you join the waitlist, subscribe or create an account. If you join the waitlist, we also keep the optional answers you give (categories you're interested in and whether you'd pay for a membership), your referral code, and which referral code (if any) you joined through, so we can count referrals.
• Session and sign-in data: hashed session tokens, hashed one-time codes, and basic device info (hashed IP, user agent) for security.
• Confirm-before-buy requests you save on your account page (deal snapshot only; we do not place orders from this list until you approve a real purchase flow later).
• Body measurements and preferences you choose to save to your account: unit preference (in/lb or cm/kg), height, weight, chest, waist, inseam, hips, arm length, head, hand and foot measurements, plus your fit profile (men's, women's or unisex, used only to choose which brand size chart applies), optional bust, underbust and natural-waist measurements, optional thigh, calf, knee, bicep and forearm measurements, whether you wear knee braces and which brace (and your knee measurement over the brace), preferred brands, categories, maximum budget per item and your "Prefer Made in USA" setting. Measurements you enter on the home page stay in your browser (localStorage) and aren't sent to us.
• Fit Reports you choose to file: the item (brand, model, size, year, where you got it, kept or returned), a snapshot of your measurements, fit ratings by body area, what you wore it with (boots, knee braces, armor, layers), your notes, and our review status. We use them to improve sizing, decide rewards, and show combined anonymous counts. We never publish your name or email with a report.
• Membership records: plan, status, renewal dates and Stripe customer and subscription IDs. Auto-purchase is not live yet; if it launches, we'll also keep records of orders we place for you.
• Payment information is entered directly with Stripe. We never see or store your full card number.
• Basic usage data through Cloudflare Web Analytics, which is cookieless and doesn't track you across sites.

How we use it

• To match your size to brand charts and find deals.
• Once auto-purchase launches (it isn't live yet): to place orders you approve or that match your auto-buy rules, sharing only what the retailer needs (such as name, shipping address and size).
• To run memberships, send service emails and, if you opt in, the newsletter.
• To keep the site secure and improve it.

Who processes it

• Cloudflare hosts the site, stores our database, provides cookieless analytics and may send our emails.
• Stripe processes payments.
• Resend delivers our sign-in and service emails. It receives your email address and the content of those emails.
• Google Fonts: our pages load fonts from Google's servers, so Google receives your IP address and basic browser information when a page loads, under Google's Privacy Policy. No Google cookies are set by our pages.
• Retailers will receive order details when we buy on your behalf, only once auto-purchase launches (not live yet).
• Affiliate networks may see that a purchase came from our link; we don't send them your measurements.

We don't sell or rent your personal information, and we don't share it for cross-context behavioral advertising.

AI assistants (MCP server)

Our public MCP server for AI assistants (yardstickoutfitters.com/mcp) serves only public information: fit guides, brand size data and public deal listings. It has no sign-in and can't access accounts, saved profiles or deal requests. If an assistant sends measurements with a size question, we use them only to calculate the answer and don't store them in our database. As with any web request, our host Cloudflare processes the requesting IP address for delivery, security and rate limiting.

Cookies

We use a single essential session cookie (ys_session) when you sign in. It is HttpOnly, Secure and SameSite=Lax, lasts up to 30 days, and stores a random token (not your email or measurements). We use it only to keep you signed in. If you arrive through a referral link, we store the referral code (not personal information) in your browser's local storage and a first-party ys_ref cookie for up to 30 days so the right rider gets credit when you join. Our analytics don't use cookies. Stripe checkout and retailer sites may set their own cookies under their policies.

Sign-in

Accounts use passwordless sign-in: a one-time link and code emailed to you. We store a hashed token and hashed code, not the raw values, and they expire in 15 minutes.

Retention and deletion

We keep personal information only as long as we need it for the purposes in this policy. Account, profile, saved-deal and Fit Report data are kept while your account is active. Combined anonymous counts may be kept after your account is deleted. Waitlist signups are kept until launch or until you ask us to remove them. Sign-in links and codes expire after 15 minutes, sessions after 30 days, and hashed-IP rate-limit records are deleted after about an hour. Payment and tax records are kept as long as tax and accounting rules require. Email [email protected] to see, correct or delete your data, and we'll respond within 45 days.

Do Not Track

We don't track you across other websites over time and don't use advertising or cross-site tracking cookies, so our practices are the same whether or not your browser sends a Do Not Track signal. Apart from the service providers listed above, we don't let third parties collect personal information about your activity on our site.

Security

Data is encrypted in transit and stored with Cloudflare. No system is perfectly secure, but we limit access to what's needed.

Children

The service is not for anyone under 18, and we don't knowingly collect children's data.

Your California privacy rights

If you live in California, the California Consumer Privacy Act (CCPA, as amended by the CPRA) gives you these rights. We extend them to all users.

• Right to know and access: ask what personal information we've collected about you, where it came from, why we use it and who we share it with, and get a copy.
• Right to delete: ask us to delete your personal information, except for what the law requires us to keep, such as tax records.
• Right to correct: ask us to fix inaccurate information.
• Right to opt out of sale or sharing: we do not sell or share your personal information (including for cross-context behavioral advertising), so there's nothing to opt out of. If that ever changes, we'll update this policy and add a "Do Not Sell or Share" link first.
• Sensitive information: we only use your body measurements to provide the service.
• No discrimination: we won't deny you service, charge you a different price or give you lower quality for using these rights.

How to make a request: email [email protected] with "Privacy request" in the subject line. We'll confirm we got it within 10 business days and respond within 45 days. We'll verify your identity by matching your account email. An authorized agent can make a request for you if they have your written permission.

Categories we collect: identifiers (email; shipping name and address only once auto-purchase launches), body measurements and preferences, commercial information (membership and orders) and site usage data. The sources and purposes are described above.

Changes and contact

We'll post updates here with a new date. Questions: [email protected]. Mail: Yardstick Outfitters, 1110 N Virgil Ave PMB 98040, Los Angeles, CA 90029.