Privacy policy

Last updated October 25, 2026.

This policy explains what we collect when you use Kitted to compare rental prices, save Fit Tags, request gear for a stay, or list a rental or a shop. It covers why we collect it, who else handles it, how long we keep it, and what you can ask us to do with it.

Who we are

BLRB Digital LLC ("we" or "us") runs Kitted at kittedoutdoors.com and is responsible for the personal information described here (under European law, the "controller"). Our mailing address is BLRB Digital LLC, 377 Main St, West Haven, CT 06516. Questions about this policy or your information go to adam@blrbdigital.com.

The short version

• You can search and compare prices without an account.
• We don't use analytics tools, advertising pixels or session recording on Kitted.
• If you create an account or send a request, we keep what you give us so the shop (and the host, if you came through a stay link) can fit and deliver your gear.
• We don't sell your personal information, and we don't share it for targeted advertising.
• You can ask us to see, correct or delete your information at any time.

Information you give us

• Account. Your name, email address and password, and whether you joined as a traveler, a host or a shop. Shops also give a shop name and town. Before an account is created you confirm you are 13 or older; we check the box but don't store your age or birth date. Google Firebase handles sign-in and stores your password in hashed form, so we never see it.
• Fit Tags. For each traveler you add: a name, adult or kid, height, weight, shoe size, ski or ride level, snowboard stance, helmet and jacket size, and any fit notes. Shops use them to size gear before it arrives. We use height and weight only to size gear, never to draw conclusions about anyone's health.
• Preferences. Your usual delivery window, handoff choice, home town and delivery notes.
• Delivery requests. Your name and email address, the address you want gear delivered to, the town, drop-off and pickup dates, delivery window, handoff choice and notes, the items and prices, a copy of the Fit Tag for each traveler on the request, the stay code and rental name if you came through a stay link, and the request's status.
• Hosts. Your rental's name, town, type, how many it sleeps, your welcome note and the gear you offer. We never ask for or store a street address for a rental.
• Shops. Your shop's name, town, description, hours and phone number if you add them, and the gear packages and prices you list.
• Messages. Anything you send us by email, including privacy requests.

Information collected automatically

• Server logs. When your browser asks for a page, our web server records your IP address, the date and time, the page requested, the referring page, your browser and device type, and whether the request worked.
• Sign-in records. Google Firebase Authentication records when accounts are created and signed in to, and the IP address and browser details of sign-in requests, to keep accounts secure.
• Font requests. Our pages load fonts from Google Fonts, so Google receives your IP address and browser details when the fonts load.
• "Use my location". Only if you tap it and allow it, your browser gives the page your approximate location, which we use in your browser to pick the nearest area. Your location is not sent to us or saved.
• Searches. The area, gear, dates and filters you pick are kept in the page address so you can share or return to a search. They are not tied to your account.

Information from other sources

The prices, gear, logos and shop details on Kitted come from each rental shop's own public website. They are business information. When you tap "Check availability" you go to the shop's website, and what happens there is covered by the shop's own policies, not this one.

How we use it

• To run your account and keep you signed in.
• To send your request and Fit Tags to the shop you chose, and to the host whose stay link you used, so they can fit, deliver and pick up the gear.
• To show public rental and shop listings.
• To send password reset emails when you ask for one (Google Firebase sends them for us).
• To answer your messages and privacy requests.
• To keep Kitted secure, prevent abuse and fix problems.
• To meet legal obligations.

We don't use your information for advertising, we don't build profiles of you, and we don't make decisions about you based only on automated processing.

Cookies and browser storage

Kitted does not use advertising or analytics cookies. It stores only what it needs in your browser:

• Your sign-in. Google Firebase keeps your sign-in in your browser's storage (IndexedDB) so you stay signed in until you sign out.
• Your kit. The gear you pick is saved in your browser's local storage until you send a request or empty your kit.
• Location permission. If you allow "Use my location", your browser remembers that choice. You can change it in your browser's site settings.

You can clear all of this in your browser settings at any time. Clearing it signs you out and empties your kit.

Do Not Track and Global Privacy Control. We don't track you across other websites and we don't sell or share your information for advertising, so there is nothing for these signals to switch off. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of any sale or sharing.

Who we share it with

Service providers. These companies handle information for us, only to provide their service:

• Google, through Firebase Authentication and Cloud Firestore (data stored in the United States): sign-in, password reset emails, and storage for accounts, Fit Tags, listings and requests.
• Google Fonts: serves the fonts on our pages.
• Hostinger: runs the web server that serves Kitted, in Boston, Massachusetts, and holds the server logs.

Other people on Kitted, because you asked us to.

• The shop you send a request to sees everything on that request, listed above under "Delivery requests".
• The host whose stay link you used sees the same request.
• Rental listings are visible to anyone with the stay link or door card, and shop profiles and gear listings are public.

When the law requires it. We may disclose information to comply with a law, court order or valid legal request, or to protect the rights, property or safety of our users, the public or us.

If the business changes hands. If Kitted is sold, merged or transferred, your information may move to the new owner, who must keep honoring this policy for it.

We don't sell personal information, we don't share it for cross-context behavioral advertising, and we don't give it to other companies for their own marketing.

How long we keep it

• Accounts, Fit Tags and preferences: until you remove them or ask us to delete your account.
• Delivery requests: for as long as your account exists, so you, the shop and the host have a record. When we delete your account we delete its requests too, unless one is still in progress or the law requires us to keep it.
• Rentals and shop listings: until you remove them, ask us to, or your account is deleted.
• Server logs: kept only for a limited time and deleted automatically on a rolling basis as newer entries replace them. We use them only to keep Kitted running and secure.
• Emails to us: as long as we need them to answer you and keep a record of what you asked.

How we protect it

• Kitted only loads over an encrypted connection (HTTPS).
• Database rules let you read only your own account, and limit each request to the traveler, the shop and the host on it.
• Passwords are stored by Google in hashed form, and we never see them.
• Only the people who run Kitted can get into the database and the server.

No method of storing or sending information is perfectly secure. If a breach affects your information, we will tell you as the law requires.

Your choices and rights

In Kitted: you can edit or remove a Fit Tag and change your preferences on your trips page, and cancel a request while it still says "Requested". Shops can edit their profile and remove gear packages.

By email: you can ask us to:

• tell you what we hold about you and give you a copy in a common, portable format;
• correct anything that is wrong;
• delete your information, including your whole account (accounts can't yet be deleted from inside Kitted, so email us and we will delete the account, its sign-in and its data);
• stop or limit a use you object to, or withdraw consent you gave.

Email adam@blrbdigital.com with "Privacy request" in the subject, from the email address on your account. If you write from another address, we will ask you to confirm you control the account's email before we act. Someone you authorize, such as a lawyer, can make a request for you with your signed permission; we may still check with you directly.

We answer within 30 days. If we ever need longer, we will tell you why and how long, within the time the law allows. If we turn down your request, you can appeal by replying with "Appeal" in the subject, and we will answer within 45 days. If you are not satisfied with the outcome of an appeal, you can contact your state attorney general.

We will never charge you more, give you a worse service or treat you differently for using these rights.

California residents

The California Consumer Privacy Act, as amended by the CPRA, gives California residents the right to know, correct and delete their personal information, to opt out of its sale or sharing, to limit the use of sensitive personal information, and not to be discriminated against for using these rights. In the last 12 months we collected these categories:

• Identifiers: name, email address, IP address and account ID.
• Customer records: name, delivery address and physical description (the height, weight and sizes in Fit Tags).
• Commercial information: the gear you request.
• Internet activity: server logs and sign-in records.
• Sensitive personal information: your account login (email and password), used only to run your account.

We don't collect precise geolocation, payment card or bank details, government ID numbers or biometric information. The sources, purposes and recipients are the ones described above: you, your browser, and shops' public websites; to run Kitted; disclosed to our service providers and to the shop and host on your request. We don't sell or share personal information (including of anyone under 16), and we don't use sensitive personal information for anything beyond providing the service, so there is nothing to opt out of or limit. To use your rights, follow "Your choices and rights" above. California's "Shine the Light" law: we don't share personal information with other companies for their direct marketing.

Other US states

Residents of Connecticut, Virginia, Colorado, Oregon, Texas and other states with consumer privacy laws have similar rights: to confirm whether we process their information, to access, correct and delete it, to get a portable copy, to opt out of sale, targeted advertising and profiling (we do none of these), and to appeal a decision. We give these rights to every Kitted user, whatever the law of your state requires, using the same process.

Visitors from the EU and UK

Kitted lists rentals in the United States and is run from the United States. If European or UK data protection law (the GDPR or UK GDPR) applies to you:

• Why we may use your information: to perform our agreement with you (your account, Fit Tags, requests and listings); our legitimate interests in running a secure, working site (server logs, sign-in records and fonts); your consent ("Use my location", which you can withdraw in your browser at any time); and legal obligations.
• Your rights: access, correction, deletion, restriction, portability, objection, and withdrawing consent, using the process above. You can also complain to your local data protection authority, or in the UK to the Information Commissioner's Office.
• Transfers: your information is stored and processed in the United States. Google is certified under the EU-U.S. Data Privacy Framework and offers the European Commission's Standard Contractual Clauses in its data processing terms.

Children

Kitted accounts are for people 13 and older, and creating an account asks you to confirm your age first. We don't knowingly collect personal information from children under 13. A parent or guardian can add a child to a Fit Tag (a name and sizes) so a shop can fit the child's gear. We use it only for that, share it only with the shop and host on a request, and the parent can remove it at any time from the trips page. If you believe a child under 13 has given us personal information, email adam@blrbdigital.com and we will delete it.

Changes to this policy

If we change this policy we will post the new version here and update the date at the top. If a change materially affects how we use information you have already given us, we will also email the address on your account before the change takes effect. We will update this policy before we ever add analytics, advertising tools or payments to Kitted.

Contact us

Email adam@blrbdigital.com, or write to BLRB Digital LLC, 377 Main St, West Haven, CT 06516.