Western Boot World Privacy Policy

Overview

Western Boot World is a community marketplace for western boots. Browsing is open to everyone; posting and profile features require a member account, and members must be 18 or older. This policy explains what we collect and why, in plain English.

Who We Are

Western Boot World is operated by Cornerstone Technology Group LLC dba Ergon Insights, 102 E. Main St, Suite 211, Johnson City, TN 37604. We are the controller of the personal information described in this policy. You can reach us at support@westernbootworld.com for any privacy question or request.

Information We Collect

When you sign in with Google, Microsoft, or email, we receive basic account information such as your name, email address, profile image, and provider account identifier. We also store what you choose to create here: listings (photos, video, descriptions, prices), your profile (username, bio, policies, fun fact, avatar), and drafts. Listings and public profiles are visible to everyone. If you turn on your public seller profile and add contact methods (Facebook, Reddit, phone, email), those contact details are published so buyers can reach you; leave any of them blank to keep them private.

Using the community features creates more records: seller applications (name, contact email, storefront link, and what you sell); seller reviews you write about a purchase; Saloon threads, replies, photos, and reactions; Corral talk comments on a pair; event submissions; watchlists and saved searches; notifications we send you; daily game results and play streaks; buy-button holds; reports you file about content; and the date and version of the Terms you accepted along with your confirmation that you are 18 or older. Buyer-to-seller messages are stored as a notification for the seller and, if the seller allows email, sent to them by email with your account address as the reply-to, so the seller sees your account email when they reply.

How We Use Information

We use account information to operate member profiles, protect community accountability, enable posting and listing features, reduce abuse, and help members manage their own activity. We do not sell personal information.

Messages Between Buyers and Sellers

When you message a seller about a pair, or reply to a buyer, we store the conversation on Western Boot World so you can both see it in Messages. Only the two of you can read it, plus our administrators when one of you reports a message, so they can review it. Neither of you is shown the other's email address. We email you about each new message unless you turn that off in your profile, and if you turned on instant alerts for a device we send a short notification there too (it names the sender and the pair, not what they wrote). Like listings and community posts, messages pass through our automated moderation (OpenAI) before they are delivered. If you block a member, we record the block so they can't message you or hold your pairs.

Holding a Pair: Sharing Your Contact Info With the Seller

When you hold a pair for 48 hours with the buy button, we ask first, and with your agreement we send that pair's seller your name, username, the email address on your account, and the phone number on your profile if you added one. We email these details to the seller and show them under "Holds on your pairs" on the seller's own profile while the hold lasts. No other member can see them. They are shared only so you and the seller can arrange payment and shipping for that pair, and sellers agree not to use them for anything else. If you don't agree, the hold isn't placed.

Sellers can also turn on instant hold alerts for a browser or a home-screen app. The browser asks for permission first, and alerts can be turned off or a device removed at any time from the seller's own profile. To deliver them we store a push address for each device, which is passed to that browser's own push service (for example Apple, Google, Mozilla, or Microsoft). An alert names the pair, its WBW number, the buyer's name, and when the hold ends; it never includes the buyer's email or phone. We don't use push for marketing.

Fraud Prevention & Security Signals

To keep the community trustworthy and enforce one account per person, we collect limited security signals when you sign in or create a listing: a device fingerprint (a hashed identifier derived from your browser and device characteristics, generated by the ThumbmarkJS library), a hashed form of your network IP address, and your email domain. Sellers may also be asked to verify a phone number. We use these signals only to detect and prevent duplicate accounts, fraud, and abuse, never for advertising, and we store IP addresses and verified phone numbers in salted, hashed form rather than as raw values. This processing is carried out on the basis of our legitimate interest in protecting the platform and its members.

Two anonymous records use a hashed IP address without an account: the site tour remembers that a visitor has already seen it for 30 days, and our rate limiter counts requests per hashed address for 1 day. Neither can be reversed to an address.

Third-Party Login Providers

If you sign in through Google or Microsoft, that provider may process your information under its own privacy policy. Email sign-in is handled on this site. We use these methods only for authentication and basic profile setup.

Service Providers & AI Features

We run on a small set of service providers, and your data goes to them only as needed to operate a feature. All of them process data in the United States.

• Supabase (database, authentication, and media storage).
• Vercel (site hosting and the serverless functions behind our API; Vercel keeps short-lived function logs, which can include a request's IP address, for the retention period of our plan).
• Twilio: Twilio Verify sends the one-time SMS code for seller phone verification, and Twilio Lookup checks the line type of a number before we send a code so we do not text landlines or VoIP numbers.
• Resend (delivering account emails, notification emails, buyer-to-seller messages, seller-application emails to our reviewers, and invite emails).
• OpenAI (the Dusty help chatbot and its voice; the optional screenshot-import feature; photos you submit for skin identification when you request an AI assessment; automated content moderation of listings, seller reviews, Saloon posts, profile text, and buyer-to-seller messages; and Dusty reading and replying to public Saloon threads). Messages you type or dictate to the chatbot and screenshots you submit for import are processed by OpenAI to generate the response; don't include sensitive personal information in them.
• Google Analytics (only if you choose Allow analytics; see Cookies below).
• Google Fonts (typefaces are loaded from Google's servers, which see your IP address when the font file is fetched).
• jsDelivr (serves the ThumbmarkJS fingerprint library used for multi-account prevention; the CDN sees your IP address when the script is fetched).

We do not sell personal information to anyone, and we use no advertising trackers. Optional Dusty voice mode uses your browser’s speech-recognition service, which may process microphone audio remotely, and OpenAI generates Dusty’s AI voice from the reply text. Voice transcripts appear in the chat. Close voice or the chat, or leave the tab, to stop the microphone.

Boot Reference Contributions

Boot lookup proposals and reviewer notes are visible only to the contributor and administrators until review. With the contributor’s publication permission, approved reference fields and source citations appear publicly. Private notes, account identifiers, and linked Skin ID photos are not included in public records. Linked photos retain their separate Skin ID permissions. We keep the original proposal and review history for corrections and accountability; contributors can withdraw a proposal while it is pending.

Cookies & Local Storage

With your permission, we use Google Analytics to measure page visits and language choices. Analytics is optional and stays off until you choose Allow analytics. We do not send account details, form contents, or Dusty conversations to Google Analytics, and advertising features are disabled. You can change your choice using Analytics preferences in the footer. If your browser sends the Global Privacy Control signal, we treat it as a decision not to allow analytics. Google processes technical usage data; see its privacy policy at policies.google.com/privacy. Your browser stores the Supabase sign-in session and small amounts of site data such as theme, sound and interface preferences, game progress, and pending invite state. Founder/admin tools may also keep unpublished manual-entry drafts on that device. Signing out clears the sign-in session; preferences and local game progress may remain until you clear this site's browser data.

The site uses Google Analytics, Vercel Web Analytics and Microsoft Clarity to understand usage and improve the site, and does not sell data.

Skin Identification & Reference Photos

Skin identification requires a free, signed-in account; seller or photo-contributor approval is not required to request identification. Submissions and results are private to the submitting member and authorized reviewers. We store your listing links or uploaded photos, material descriptions, recorded photo-use permissions, assessments, and any response feedback or corrections. Separate reference-only contributions still require seller or photo-contributor approval. A contributor's description is kept separate from a reviewed identification.

You can submit a listing URL without uploading photos or claiming ownership of the seller’s images. We temporarily fetch public listing images and boot details for AI identification. We store the link, result, and evidence used; we do not save copies of those listing images in our photo collection or treat the link as permission to reuse or train on them.

Choosing Identify with AI starts identification automatically after submission. The submitted photos or public listing images, photo-view and boot-region labels, maker/style details, relevant public listing metadata, selected collection reference photos, and matching published Boot Lookup records are sent to OpenAI. We do not include your account details, private notes, or the expert's decision. We store the result, model-estimated confidence, and evidence separately from human reviews. Human review is available when requested. Listing submissions do not grant photo reuse rights; uploaded-photo permissions are described below.

Identification requests made with photo uploads require your explicit permission to reuse those photos for our reference and evaluation collection and to train and improve skin-identification models. Public display remains a separate, optional choice and does not happen automatically. Earlier submissions retain their original permissions. Reference-only contributions require reference-use permission, with training and public display optional. Use My submissions to withdraw a photo set from active review and future reference and training use. Withdrawal cannot undo training already completed. Contact us for deletion requests, including questions about any prior use.

To help you finish signing in or retry an upload, unfinished photo submissions may be saved in this browser for up to 24 hours. You can clear the draft in the submission form. Signing out clears the locally saved submission draft.

Operational Metrics

To monitor reliability and operating costs, we record AI request timing, feature and model names, success or failure, reported token counts, and estimated cost. These records do not contain prompts, photos, conversations, account identifiers, or credentials. Only authorized administrators can view operational reports.

Data Retention

We keep information only as long as it is needed for the purpose it was collected. The periods below are our retention commitments, not a claim that every record is automatically deleted on schedule. Where a record is tied to your account, "life of the account" ends when the account is deleted, and deletion or anonymization then completes within 30 days.

Automatic time-based deletion is not currently implemented for notifications (including buyer-to-seller messages stored as notifications), seller applications, event submissions, content reports, sign-in security signals, or operational AI metrics. Those records may remain in storage after the stated periods. This implementation gap does not extend those periods or change your deletion rights.

The collection exception below describes the current cleanup behavior; it does not waive earlier deletion commitments or your right to request deletion.

When you request deletion, we delete or anonymize your data as described on the data deletion page. Copies held by our service providers expire on their own schedules after we delete ours.

Children

Western Boot World is for adults. You must be 18 or older to create an account, and we do not knowingly collect personal information from anyone under 13. If you believe a child has created an account or given us personal information, email us and we will delete it.

Security and Breach Notification

We protect member data with encrypted connections, access controls on our database, hashed storage of IP addresses and phone numbers, and server-side checks on every action that changes public content. No system is perfectly secure. If we learn of a breach that affects your personal information, we will notify you by the email address on your account without undue delay, and within any period the law requires (for example, 72 hours where that applies), with what happened, what information was involved, and what we are doing about it. Security researchers can find our disclosure address in /.well-known/security.txt.

International Transfers

We are based in the United States and our service providers process data there. If you use the site from the European Union, the United Kingdom, Mexico, or anywhere else outside the United States, your information is transferred to and processed in the United States, where privacy law may differ from your country's. Where the law of your country requires a transfer mechanism, we rely on our providers' standard contractual terms and on your consent when you create an account.

Your Choices & Rights

You can view and edit your profile and listings from your account at any time. You can also ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it by emailing the contact address below. Depending on where you live (for example, California or the EU), some of these may also be legal rights. We honor such requests for all members regardless of location, and we will never treat you differently for exercising them.

California Privacy Rights (CCPA/CPRA)

This section applies to California residents and supplements the rest of this policy. In the past 12 months we have collected these categories of personal information: identifiers (name, email address, username, provider account ID, hashed IP address, device fingerprint); customer records (profile text, contact methods you publish, verified phone number in hashed form); commercial information (listings, sales you mark, holds, reviews, seller applications); internet activity (pages visited, only if you allow analytics); audio and visual information (photos and video you upload, voice transcripts if you use Dusty's voice mode); and inferences limited to the automated content-moderation verdicts and the preliminary AI skin assessments you request. We collect them from you, from your sign-in provider, and from your device, and we use them for the purposes in How We Use Information: operating the marketplace, security and fraud prevention, moderation, communicating with you, and, with your permission, analytics.

We do not sell personal information and we do not share it for cross-context behavioral advertising. We have not done so in the past 12 months, and we have no actual knowledge of selling or sharing the personal information of anyone under 16. We disclose personal information only to the service providers listed above, under contracts that limit their use of it to providing their service to us.

You have the right to know what personal information we have collected about you and to receive a copy; to delete it; to correct inaccurate information; and to not be discriminated against for exercising these rights. To make a request, email support@westernbootworld.com from the email address on your account, or from another address naming your account email and username. We verify requests by matching the sending address to the account and, for deletion or a copy of your data, by asking you to confirm from within a signed-in session or by replying to a one-time code sent to the account address. An authorized agent may submit a request for you if they provide your signed permission and we can verify your identity the same way. We respond within 45 days and will tell you if we need more time. Because we do not sell or share personal information, there is no opt-out to exercise; if your browser sends the Global Privacy Control signal we also treat it as declining analytics.

Data Deletion

You can request deletion of your account data by following the instructions on our data deletion page.

Changes to This Policy

When we make a material change to this policy, we will update the "Last updated" date, post a notice on the site, and email members at the address on their account at least 14 days before the change takes effect, except where a change is required sooner by law.

Contact

For privacy questions, contact support@westernbootworld.com.