Who runs this site
NFA Watch (www.nfawatch.com) is an independent community project. It is not affiliated with the ATF or any U.S. government agency, and not affiliated with any manufacturer or retailer. Questions about this policy or about data held about you go to support@nfawatch.com.
Approval reports carry no personal identifiers
When you report an approval through the submission form, the record stored contains only the following: form type, owner type (individual or trust), state, the pending and approval dates, the calculated wait in days, how it was filed, and — optionally — the purchase channel or Form 1 service used.
There is no field for your name, email address, postal address, phone number, or any other direct identifier. The form does not ask for one and the database has nowhere to put one.
Two indirect values are stored, and both are deliberately reduced:
- –A masked control number, if you choose to provide one. It is normalised and stored in its masked form and is used only to detect duplicate submissions.
- –A contributor hash, used to rate-limit submissions and to count distinct contributors. It is a SHA-256 hash of your IP address combined with a secret salt, truncated. Your IP address itself is never written to the database, and the hash cannot be reversed to recover it.
Page visits
Analytics on this site are first-party. Every page sends a small beacon recording the route you viewed, the referring URL if there was one, and any UTM campaign parameters in the link you followed. Query strings are stripped from the recorded route before it is stored.
Alongside that, each row stores your browser’s user-agent string and a session hash — a truncated SHA-256 of your IP address and user agent, used to tell repeat views apart from new ones. As with contributions, your raw IP address is not stored. Repeat views of the same page within fifteen minutes are discarded rather than recorded twice.
This exists so the project can tell which pages are useful. It is not shared with advertisers and it is not used to build a profile of you.
Outbound link clicks
Links to products and services route through a redirect on this domain (/out/…) which records which link was clicked, its destination, the page you clicked from, your user agent, and the same kind of session hash described above. This is how the project measures whether its recommendations are useful, and how click counts are reported to partners — in aggregate, never individually.
See the affiliate disclosure for how those links work commercially. Once you leave this site, the destination site’s own privacy policy applies, not this one.
If you subscribe to reports, the site stores your email address, the page you subscribed from, your subscription status, the date, and an unsubscribe token. Nothing else. Your address is used to send the reports you asked for and for nothing else — it is never sold, rented, or shared with any advertiser or partner. Every email carries an unsubscribe link, and unsubscribing takes effect immediately.
Cookies and local storage
This site sets no advertising or cross-site tracking cookies, and there is no consent banner because there is nothing to consent to. Two small exceptions, both functional:
- –A short-lived cookie recording when you last submitted feedback, used purely to rate-limit the feedback form.
- –Browser local storagefor the “track my stamp” feature, so filings you choose to follow persist between visits. That data stays in your browser and is never transmitted to the site.
Service providers
The site runs on Vercel (hosting, and Vercel’s own privacy-preserving analytics), stores data in Supabase, and sends email through Resend. Each processes data only to provide those services. Aggregate search performance data is retrieved from Google Search Console and Bing Webmaster Tools; that data describes queries and pages, not individual people.
Retention
Approval reports are retained indefinitely — they are the historical dataset this site exists to publish, and they contain no personal identifiers. Visit and click records are retained as an operating history of the project. Subscriber records are retained while your subscription is active and after you unsubscribe, so that the same address is not re-added by a later import.
Your choices
- –Unsubscribeusing the link in any email, or write to us and we’ll do it.
- –Ask what we hold about you, or ask for it to be deleted, by writing to support@nfawatch.com. Note that because approval reports carry no identifiers, we usually cannot connect one to you — which is the point of collecting them that way, but does mean a specific submission generally cannot be located after the fact.
- –Browser signals. Blocking scripts or sending Do Not Track will stop the visit beacon from firing. Nothing on the site breaks if you do.
Children
This site is not directed at children under 13 and does not knowingly collect information from them.
Changes
If this policy changes, the date at the top changes with it. Material changes will be noted on the site rather than made quietly.
One honest caveat
This document was written to describe what the software actually does, verified against the code that collects each item, rather than assembled from a template. It is not legal advice and it has not been reviewed by a lawyer. If you need a formal compliance assurance for a specific jurisdiction, ask and we’ll tell you what we know and what we don’t.