Privacy Policy

Effective August 10, 2026

1. Who we are

Outpost is published by [LEGAL ENTITY — e.g. Outpost Media LLC], of [REGISTERED POSTAL ADDRESS]. For the purposes of the UK and EU General Data Protection Regulation, that entity is the controller of the personal data described below.

• Privacy contact: privacy@outpost.example.com
• Data protection contact: [GDPR / DPO CONTACT — if appointed]
• Postal address: [REGISTERED POSTAL ADDRESS]

2. Information we collect

The email address you type into our newsletter form. That is the only piece of personal information we ever ask you for. There is no account to create, no profile to fill in, and no other form on this site that collects personal data. We store the address in our own content management system, on our own database, alongside which page the signup came from and when it happened — so we can send the newsletter and honour a removal request.

Technical data collected automatically. Like any website, ours receives your IP address, user-agent string, referring URL, and the pages you view. Aggregate versions of that data reach us through [ANALYTICS PROVIDER — e.g. Vercel Analytics], which we use to see which reviews get read.

What we do not collect, at all. We take no payments, so we hold no card or billing data. We host no reader accounts, so there are no passwords or profiles. We run no comment system. We do not ask for your name, phone number, postal address, or date of birth, and we do not buy personal data about you from anyone else.

3. How we use it

• To send the newsletter — the gear brief you signed up for, and nothing else. We do not rent, lend, or resell the list.
• To understand what to publish — which reviews and buying guides are read, on aggregate, so editorial effort goes where it is useful.
• To keep the site up and detect abuse — spotting bot signups, scraping, and attacks against the service.

Under GDPR Art. 6 our legal bases are consent for the newsletter (you asked for it; you can withdraw at any time) and legitimate interests for analytics and security (running and defending a website that people asked to read).

4. Affiliate links and commissions

Outpost earns money from affiliate links, and we are telling you so here because the FTC requires it. The Federal Trade Commission's Endorsement Guides (16 CFR Part 255) require a clear, conspicuous disclosure of any material connection between a publisher and the products it recommends. Ours is that we participate in affiliate programmes including [AFFILIATE NETWORKS — e.g. Amazon Associates, AvantLink].

When a review or buying guide links to a retailer, that link is marked up as rel="nofollow sponsored" so search engines and readers can both tell it is a commercial link. Clicking it passes a referral identifier to the retailer — typically in the URL, and often stored by the retailer as a cookie on theirdomain — so they can attribute a resulting purchase to us. From the moment you land on the retailer's site, their privacy policy and cookie practices govern, not ours. We never receive your order details, payment information, or shipping address; at most we see anonymous, aggregated commission reports.

If you buy something through one of those links we may earn a commission, at no extra cost to you — the price is the same as it would have been. Commissions never influence a verdict, a star rating, or whether a product makes a list. We say so in detail, including how we source and score gear, in our review guidelines.

5. Cookies and similar technologies

Here is exactly what is set when you read this site today:

• Functional cookies and headers from Next.js and our host, Vercel — routing, caching, and load balancing. These are strictly necessary to serve the page.
• Analytics cookies or equivalent identifiers from [ANALYTICS PROVIDER — e.g. Vercel Analytics], used to count page views and see which articles are read.
• Affiliate cookies set by retailers and their networks after you click a buy link. These are set on the retailer's or network's domain, not ours, and are governed by their policies.

We do not currently operate a cookie consent banner, and this page will not pretend otherwise. To refuse or remove non-essential cookies, use your browser's own controls: every major browser can block third-party cookies, clear cookies for a single site, or run the site in a private window that discards them on close. Browsers also honour Global Privacy Controland “Do Not Track” signals to varying degrees; where we can act on a GPC signal, we treat it as an opt-out request under the CCPA. Blocking functional cookies may break parts of the site.

6. Who we share it with

We share personal data only with the service providers that make the site and the newsletter work, and only so far as they need it to do that job:

• [EMAIL SERVICE PROVIDER — e.g. Buttondown] — email delivery for the newsletter.
• Vercel — application hosting and CDN; processes request logs.
• Turso — the managed database that stores the subscriber list.
• [ANALYTICS PROVIDER — e.g. Vercel Analytics] — audience analytics.

We may also disclose data where the law compels it — a valid legal process, or to protect our rights and the safety of others — and, if the business is ever sold or merged, to the acquirer as part of that transaction.

We do not sell personal information, and we do not “share” it as the California Consumer Privacy Act defines those terms in §1798.140 — meaning we neither exchange it for money or other valuable consideration, nor disclose it for cross-context behavioural advertising. We have never done so and have no plans to.

7. How long we keep it

• Your newsletter email address — until you unsubscribe, plus [RETENTION WINDOW — e.g. 24 months after unsubscribe], so a later removal request can be matched against the record and honoured.
• Analytics data — for whatever retention period [ANALYTICS PROVIDER — e.g. Vercel Analytics] applies to aggregated site metrics.
• Server and security logs — kept short-term by our host and then rotated out.

8. Your rights

If you are in the EEA or UK (GDPR)

You have the right to:

• Access a copy of the personal data we hold about you;
• Rectify data that is wrong or incomplete;
• Erasure — have it deleted;
• Restrict how we process it;
• Portability — receive it in a machine-readable form;
• Object to processing based on legitimate interests;
• Withdraw consent at any time, which for us means unsubscribing;
• Lodge a complaint with your national supervisory authority — you do not have to come to us first.

If you are a California resident (CCPA/CPRA)

You have the right to:

• Know what personal information we collect, why, and who receives it;
• Delete personal information we hold about you;
• Correct inaccurate personal information;
• Opt out of the sale or sharing of personal information — as noted above, we do neither, so there is nothing to opt out of;
• Non-discrimination — exercising any of these rights costs you nothing and changes nothing about the service you get;
• Use an authorised agent to make a request on your behalf, with proof of authorisation.

How to exercise any of these rights: email privacy@outpost.example.com from the address you signed up with, or tell us which address to look up. We answer GDPR requests within one month and CCPA requests within 45 days, and we will tell you if we need the extension the law allows. We may ask you to confirm control of the email address before acting, because that address is the only identifier we hold.

9. Unsubscribing

Every newsletter includes an unsubscribe link, and you can also email privacy@outpost.example.com and ask to be removed — one line is enough. We do not run a self-service unsubscribe page on this site, so email is the reliable route; we would rather say that plainly than send you to a link that does not exist. Removals are processed promptly, and unsubscribing from the newsletter does not stop you reading anything here.

10. Children

Outpost is written for adults buying outdoor equipment. The site is not directed to children under 13, and we do not knowingly collect personal information from them — which under the Children's Online Privacy Protection Act would require verifiable parental consent we neither seek nor have. In the EEA and UK, the newsletter is intended for readers at or above the local digital-consent age (13 to 16, depending on the country). If you believe a child has given us an email address, write to privacy@outpost.example.com and we will delete it.

11. International transfers

We operate from, and our providers process data in, the United States. If you write to us or subscribe from outside the US, your email address is transferred there. Where that transfer leaves the EEA or UK, it relies on the European Commission's Standard Contractual Clauses (and the UK Addendum/IDTA) in our providers' terms, or on another lawful transfer mechanism such as an adequacy decision. Ask us at privacy@outpost.example.com if you want the specifics for a particular provider.

12. Changes to this policy

When this policy changes we bump the effective date at the top of the page. If a change is material — new categories of data, a new purpose, a new recipient — we will say so in the newsletter as well, so the people who gave us an address hear about it rather than having to re-read this page. Past versions are available on request.

13. Contact

[LEGAL ENTITY — e.g. Outpost Media LLC]
[REGISTERED POSTAL ADDRESS]
privacy@outpost.example.com

For anything that is not a privacy question — a correction, a tip, a pitch — use our contact page.