Security and privacy
GunRegistry.us is built so the data we keep can’t be turned into a list of who owns what. Here is what that means, and where the promise stops.
Encrypted in your browser
- Your master password never leaves your browser. Keys are derived there with Argon2id, and your vault is encrypted with AES-256-GCM before it’s uploaded.
- Sign-in is a challenge your browser answers. The server stores a verifier, not your password.
- Account recovery also happens in your browser with your printed recovery code. Without the code and the password, the vault can’t be opened, by you or by us.
What we store
| Kept encrypted (we can’t read it) | Kept in plain text | Not kept at all |
|---|---|---|
| Your name, address, phone, date of birth, notes, purchase info, and any gun you haven’t reported | Manufacturer, model, serial, type, and caliber of a gun reported lost or stolen or recorded by a dealer, plus its report history | An account ID on any firearm record, your IP address in our database, an email login |
No link between you and a gun
Reporting a gun uses a one-time grant from your session, and the firearm request itself carries no account. The grant is deleted when it’s used. Proving you hold a gun’s record uses a secret only your vault knows; we keep just its hash.
Where the promise stops
- Reported guns are readable. Once a gun is reported lost or stolen, or a dealer records it, its serial row is in plain text so lookups work.
- A tampered app. A malicious build of the web app could capture what you type.
- A watched server. A modified server watching live requests could see more than the stored data shows.
- A weak password. Someone with a copy of the database could try to guess a weak master password offline. Use a strong one.
Web server access logs exist on the shared edge server; the application doesn’t copy them into its database.