Shop data deserves careful boundaries.
This policy explains what FFL Field Ops processes, where it goes, and the controls available to the organization owner.
Website product guide
The optional website product guide is disabled unless Rennavation Studios deliberately activates it. When active, it sends the current public-product question, up to six recent guide messages, and a salted pseudonymous network-abuse identifier to OpenAI to generate an answer and limit repeated requests. The request is configured with response storage disabled. The guide rejects common credential, contact, and regulated-record patterns, but automated filtering cannot identify every kind of personal information. Do not enter customer, firearm, license, payment, credential, or private shop-record information in the guide. OpenAI processes activated guide requests under its applicable service and privacy terms.
1. Scope
FFL Field Ops is a business operations and recordkeeping companion for the owner of a licensed firearm business. Each organization is limited to one owner account and one FFL Field Ops user. It supports post-receipt acquisition record entry, inventory, audits, gunsmith work orders, and an optional FastBound connection. The screen labeled Record received firearm is used after the business physically receives an item. It records an acquisition classification and may record optional internal historical cost/price values for the organization's own records; those fields do not publish a listing or offer, quote or negotiate a consumer transaction, match buyers and sellers, accept payment, provide checkout, or execute a transfer or disposition. FFL Field Ops does not publish firearm or ammunition listings or advertisements or provide invitations, employee accounts, shared notes, messaging, user-to-user content, a consumer marketplace, Form 4473 system, NICS client, legal-compliance guarantee, official FastBound product, or ATF-approved product.
This policy applies to the FFL Field Ops website, mobile application, authenticated workspace, support forms, and related services. The organization owner remains responsible for the shop's records, account access, legal obligations, and use of connected services.
2. Information we process
Account and shop information
Email address, optional name, authentication provider identifiers, organization and location names, owner-account settings, subscription status, and security or audit events. When Sign in with Apple is used, a provider revocation credential may be encrypted in server-side secret storage solely so authorization can be revoked during account deletion.
Operational information
Firearm manufacturer, importer when applicable, model, serial number, type, caliber or gauge, condition, storage location, acquisition classification, optional internal cost, price, purchase-order, invoice and shipment-tracking values, work requested, accessories, work-order status, inventory-audit results, exceptions, synchronization state, and activity history. The acquisition and cost/price values describe an item the licensed business has already physically received; they are not consumer listings, offers, or payment-card data. Searches and filters used against live inventory are sent through our backend to the connected FastBound account.
Documents & Costs records
Authorized work-order users may add private PDFs, JPEGs, PNGs, and related business records, together with safe display and version metadata and links to recorded work-order costs. The service checks current authorization before issuing a short-lived private file-access target; it does not use public sharing links for these records. The browser uploader is online-first: it needs a current connection to reserve, upload, and verify a file.
Limited customer information
When the owner chooses to record it, the service may process a customer or source name, organization, phone number, email address, and address for a gunsmith work order or acquisition. If the owner chooses Create a work order after an acquisition, the confirmed customer name, phone, email, and address may be copied into that organization's protected work-order customer record so it does not have to be entered again. FFL Field Ops is not designed to store Social Security numbers, Form 4473 records, or NICS information.
Device and service information
App version, platform and operating-system information, randomized app-installation or update identifier, push-notification token and preferences, network and synchronization status, update/runtime metadata, bounded prior fatal-error context, errors, performance metrics, app interactions and service-usage statistics, security events, and ordinary service-log information such as IP address, user agent, request path, response status, error code, and timing. A support request may include the sender's name, email, optional phone and organization, message, and a hashed network-abuse signal. Payment-card information is entered only in Stripe-hosted pages and is not stored by FFL Field Ops; we retain server-side subscription status and Stripe customer/subscription identifiers.
3. Camera, serial reading, barcodes, and customer ID
Camera and photo-library access is requested only when a user opens a workflow that needs it. Manual entry remains available when permission is denied or a scan cannot be read.
Serial-number reading uses Apple Vision or Google ML Kit on the device. Barcode scanning can read supported package labels and PDF417 driver-license barcodes. Cloud OCR is not enabled. Selected or captured serial and condition photos are copied to app-private storage on the originating device; photo bytes and device-local file paths are rejected from server synchronization. Account deletion removes app-owned copies that the app can identify, but it does not delete an original item in the user's photo library.
Google states that ML Kit does not collect the image content used for this on-device feature, but its Android SDK collects limited app/device information, per-installation identifiers, feature events, error information, and input/output sizes for diagnostics and usage measurement. See Google's ML Kit data disclosure.
For an optional driver-license scan, the raw PDF417 payload is held only long enough to create an editable review screen and is then discarded. The app does not retain the raw barcode, a license image, date of birth, issue date, or hidden issuer metadata. An ordinary work order receives only the fields the user confirms for that customer. If a user separately confirms a FastBound contact-license action, the confirmed license number and expiration may be sent directly to that shop's FastBound account through the secure proxy; FFL Field Ops does not store the full credential in its ordinary customer or work-order tables.
A package label may help fill product details, but the user must check the serial marked on the firearm before acquisition. The app does not treat a UPC as a unique firearm serial.
4. Connected services
- Supabase: authentication, organization/location data, Row Level Security, server functions, encrypted FastBound and Apple-revocation credential storage, operational synchronization, and ordinary authentication/API logs.
- Vercel: website delivery and ordinary request/security logs.
- FastBound: when a shop owner connects an account, confirmed inventory, search, contact-license, and acquisition requests are sent through a server-side proxy. The API key is never embedded in the app or public browser storage.
- Stripe: when website billing is enabled through the production billing gates, the owner may complete and manage a subscription on Stripe-hosted Checkout and Customer Portal pages. Stripe handles payment-card data under its own privacy terms; FFL Field Ops retains subscription state and billing identifiers. No charge occurs unless the owner affirmatively completes Checkout. Store-distributed mobile builds remain access-only and contain no purchase, upgrade, billing-management, or external-purchase call to action.
- Google and Apple: optional sign-in. We receive the account information the provider returns and the user permits.
- Expo and Apple/Google delivery services: application builds and updates, randomized update identifiers, bounded error/diagnostic and usage information, and optional push notifications. Push opt-in adds the installation identifier and token needed to address a device. Notification content is designed to avoid firearm serials, credentials, and customer contact details.
- Sentry: monitoring is disabled. If enabled later, its exact collection will be reviewed and reflected in this policy and store disclosures before release.
5. How information is used
- Authenticate the owner and keep organizations and locations separate.
- Provide acquisitions, inventory, work orders, audits, notifications, export, and offline recovery.
- Prevent duplicates, recover retries, reconcile synchronization, and maintain an operational audit trail.
- Perform owner-confirmed FastBound requests and show connection health.
- Test subscription workflows and, when live website billing is enabled, process subscriptions, prevent billing abuse, and enforce paid or read-only access.
- Respond to support, security, privacy, and account-deletion requests.
- Protect the service, investigate failures, and meet applicable legal obligations.
7. Retention and security
Owner-account, billing, audit, synchronization, support, and operational records are kept while the organization account remains open and afterward only while reasonably needed to provide read-only/export access, preserve organization continuity, complete a verified deletion or closure request, resolve disputes, enforce agreements, protect the service, or meet applicable obligations. Subscription cancellation does not automatically erase retained operational records. Infrastructure and connected-provider logs and backups follow the applicable provider's settings and legal obligations.
Deleting a work-order document revokes ordinary application access before asynchronous private cleanup. A linked posted cost may then show missing required evidence, but deleting the document does not rewrite the recorded cost history. Deleting the owner sign-in does not automatically delete organization records, billing records needed to resolve the subscription, security/deletion records retained for a limited purpose, or records already placed in FastBound. Canceling a subscription preserves shop data and permits the read-only and export access described in the product. Because each organization has one owner account and one FFL Field Ops user, the organization must be closed before its owner sign-in can be deleted.
Account deletion removes identified app-owned caches, photos, exports, drafts, and account-scoped state on that device after server confirmation. Copies a user exported, saved, shared, backed up, or placed in another app or provider remain under that destination's control. An original photo-library item is not an app-owned copy and is not deleted. We use encrypted transport, server-side secret storage, owner and location boundaries, Row Level Security, scoped functions, redacted logs, and audit events. No storage or transmission method is perfectly secure.
8. Your choices
The owner can deny camera, photo, and notification permissions; use manual entry; sign out; manage the FastBound connection; export available shop data; and request account deletion. Each organization is limited to one owner account and one FFL Field Ops user. Organization billing, when available, is managed on the website by that owner.
To request deletion without the app, use the account-deletion page. We verify the request and explain expected timing and any organization, security, billing, or legal records that cannot be removed immediately. You may also contact us to request access to or correction of account information, subject to identity, organization, and applicable-law verification.
The service is intended for the owner of an FFL business, not children or general consumer use.
9. Contact and changes
Rennavation Studios LLC, an Indiana limited liability company, operates FFL Field Ops and is the controller responsible for this policy. Privacy questions and verified rights requests can be directed to davidprenna@gmail.com or 850-621-2781.
This policy may be updated when product behavior, connected providers, or legal requirements change. Material changes will be posted with a revised date.
Effective and last updated: August 9, 2026.