Privacy policy.

This page is a working draft for lawyer review. It is not a finished privacy policy and should not be treated as legal advice or as the policy of a live service.

Who we are

Tack Room is operated by TimneeHolding, a company in the Netherlands, for the Barn Standard brand. The product is aimed at riders in the United States. Contact for privacy questions, until a final address is chosen: privacy@timneeholding.com.

Who can use it

Tack Room is for people 18 and older. We ask for a date of birth at signup. If that date is under 18, we stop the account and do not collect a closet, consents, or a public profile.

What we collect

Account email. Date of birth, used for the age gate and then locked. Display name, handle, discipline, and an optional bio. Gear you choose to log: category, brand, model, size, purchase date, how often you use it, a rating, a short note, and an optional photo. Consent records, including the version, the time, whether you opted in, and whether Global Privacy Control forced an opt-out. Who you follow. Offer clicks and page views of offers. A random viewer key in a cookie so we don’t count the same offer view twice in one day.

Why

To run your closet, show a public profile when you mark gear public, and estimate replacement windows from placeholder lifespans. Those estimates are not safety advice.

Three further uses happen only if you tick a separate, unchecked box:

• Barn Standard offers and emails, including queued replacement reminders.
• Including your email in Meta or Google custom audiences.
• Sharing or selling profile and gear data with partner tack brands.

If you do not tick a box, that use stays off. You can change any of them later. Each change is stored as a new record with a timestamp and the consent version. We do not overwrite history.

Global Privacy Control

If your browser sends Global Privacy Control (the Sec-GPC header), Tack Room treats that as an opt-out of ad audiences and of sharing or selling data with partner brands. Barn Standard email is separate and is not switched by that signal. We store the opt-out. We do not turn those two uses back on unless you later opt in from a browser that is not sending the signal.

Selling and sharing

Under US state privacy laws, custom audiences and partner sharing can be a “sale” or “share.” Those happen only with the matching opt-in, and Global Privacy Control opts you out of both. The anonymized admin export has no names, emails, or handles. A separate admin export lists only emails whose latest ad-audience consent is on.

Where it sits

The live service is designed to store data in Supabase (Postgres, authentication, and photo storage), hosted in a region TimneeHolding chooses, and to run on Vercel. Until those accounts exist, a local demo keeps fictional riders on the machine running the app.

How long

Account and closet data stay while the account is open. Consent history is kept so we can show what was agreed. A finished policy needs a retention schedule from counsel, including what happens if you ask for deletion.

Your choices

Settings is where consent changes. Public gear can be made private or deleted. Photos you upload can be removed by deleting the item. This draft does not yet describe a full access or deletion workflow. That has to be added before launch.

Counsel should also settle GDPR duties for a Dutch company, US state privacy notices, a real contact, subprocessors, and international transfers before anyone relies on this text.