Legal
Privacy Policy
The short version
- We run no analytics, no advertising trackers and no third-party scripts. Our Content Security Policy blocks them outright.
- We set exactly one cookie, and it exists only to keep you signed in.
- We never see what you buy. When you click through to a retailer, you leave our site and their privacy policy takes over.
- ATF wait times you submit are deliberately not linked to your account.
- You can delete your account and its data yourself, from your account page, without asking us.
- We do not sell your personal information, and never have.
1. Who we are
Leadfarmer, LLC (“Leadfarmer”, “we”, “us”) operates leadfarmer.deals, a price comparison service for ammunition, suppressors, magazines and reloading components.
We are a search and comparison tool. We do not sell ammunition, firearms, suppressors or any other product. We index prices published by third-party retailers and link you to them.
This policy explains what we collect when you use the site, why, and what you can do about it. It applies to leadfarmer.deals and our API. It does not apply to any retailer you click through to.
2. What we collect
Most of the site works without an account. Here is everything we store, and when:
| When you… | We store |
|---|---|
| Create an account | Your email address and a hashed password. Passwords are hashed with Argon2id — we never store or see the password itself. |
| Turn on two-factor authentication | An encrypted authenticator secret and a set of hashed single-use backup codes. |
| Sign in | A session record with the IP address of the sign-in, and the time of your last login. Used to let you review and revoke your own sessions. |
| Save a search | The name and filters of the search, linked to your account. |
| Submit an ATF wait time | The form type, submission and approval dates, your state, and any note you write. This is deliberately not linked to your account — we require a verified login to keep the numbers honest, but we do not record who submitted what. |
| Apply to be listed as a retailer | Store name, contact name, email, phone, store URL, state, product categories, feed details, any notes, and the IP address the form came from. |
| Enquire about advertising | Name, email, store name, website, the package and budget you selected, your message, and the IP address the form came from. |
| Use the site at all | Security logs recording the event, time and IP address for things like sign-in attempts and rate limiting. |
Our hosting providers also keep standard server logs, which typically include IP address, browser user-agent, requested URL and timestamp.
3. What we don't collect
Worth stating plainly, because it is unusual:
- No analytics. No Google Analytics, no Meta pixel, no heatmaps, no session recording.
- No advertising trackers and no third-party cookies. Our Content Security Policy sends
script-src 'self', which means the browser refuses to load any script we did not write. - No purchase data. When you click through to a retailer you leave our site. We do not know whether you bought anything, what, or for how much.
- No payment card details. If you buy advertising, payment is handled by Stripe and card details never reach our servers.
- No location beyond IP and, for wait-time submissions, the state you choose to enter.
- No sale of personal information to anyone, for any purpose.
4. Why we collect it
- To run your account — signing you in, verifying your email address, resetting your password, and keeping two-factor authentication working.
- To keep the site secure — IP addresses and security logs let us rate-limit abuse, detect credential-stuffing, and show you your own active sessions.
- To answer you — retailer applications and advertising enquiries exist so we can reply and set up a listing.
- To publish aggregate wait times — individual ATF submissions are combined into medians by form type. Nothing identifying is published.
Where the law requires a legal basis, ours is: performing our contract with you (accounts), our legitimate interest in a secure and functioning service (security logs), and your consent (optional marketing email, which you can withdraw at any time).
6. Who we share it with
We do not sell, rent or trade personal information. We share it only with the service providers that make the site work:
| Provider | What it handles |
|---|---|
| Cloudflare | Serves the website and filters malicious traffic. Sees your IP address and request details. |
| Railway | Hosts our application and database. |
| Resend | Delivers transactional email — address verification, password resets, security notices. Receives your email address. |
| Google Fonts | Serves the typefaces used on the site. Loading a page requests these files from Google, which discloses your IP address to Google. |
| Stripe | Processes advertising payments, if and when you buy advertising. Card details go directly to Stripe, not to us. |
We may also disclose information if we are legally required to, or where necessary to protect our rights, our users, or the security of the service.
7. Affiliate links
This does not change the prices you see, and it does not affect ranking: results are ordered by the sort you choose, not by what pays us.
What the retailer does with your visit is governed by their privacy policy, not ours. We receive commission reports from retailers in aggregate and do not receive your name, address or payment details through them.
8. How long we keep it
- Account data — until you delete your account.
- Sessions — until they expire or you revoke them; refresh sessions last 7 days.
- Security logs — retained for a limited period for abuse investigation, then discarded.
- Retailer applications and advertising enquiries — kept while we are considering or servicing them, and for our business records afterwards.
- ATF wait submissions — kept indefinitely as part of the public dataset. Because they were never linked to your account, deleting your account does not remove them, and we cannot identify which are yours.
9. Your rights and choices
You can, at any time:
- Delete your account. There is a self-service option on your account page. It removes your account and its associated data — you do not have to email us and wait.
- See and revoke your active sessions from your account page.
- Correct your details by editing them in your account, or by contacting us.
- Unsubscribe from any optional email using the link in the message. We will still send transactional email such as password resets while your account exists.
- Request a copy of the personal information we hold about you.
Depending on where you live — including California, and other states with comprehensive privacy laws — you may also have the right to know what we collect, to request deletion, to correct inaccuracies, and not to be discriminated against for exercising those rights. We do not sell personal information or share it for cross-context behavioural advertising, so there is nothing to opt out of on that front. To exercise any right, contact us using the details below.
Because we run no advertising trackers, a browser “Do Not Track” or Global Privacy Control signal has nothing to disable here.
10. How we protect it
- Passwords are hashed with Argon2id. We cannot read them, and a database breach would not reveal them.
- Optional two-factor authentication, with the authenticator secret encrypted at rest and backup codes stored hashed.
- All traffic is served over HTTPS, with HSTS enabled.
- Rate limiting and account lockout on repeated failed sign-ins.
- A strict Content Security Policy that blocks third-party scripts, framing and form hijacking.
No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal information, we will notify you as required by law.
11. Children
Leadfarmer is not directed at children. We do not knowingly collect personal information from anyone under 18, and accounts are limited to adults as set out in our Terms of Service. If you believe a child has given us personal information, contact us and we will delete it.
12. Changes to this policy
We may update this policy as the service changes. The “last updated” date at the top will always reflect the current version. If a change materially affects how we handle your personal information, we will give notice on the site or by email before it takes effect.
13. Contact us
Questions about this policy, or about the information we hold on you:
- Email: contact form
We aim to respond within 30 days.