Trust & security.

The shape of it

The forms at /quote and /contact send JSON to /api/inquiry, a Cloudflare Worker on fixedgearstraps.com. The Worker stores each request in Cloudflare D1, then sends it through Resend to quotes@fixedgearstraps.com. Migadu hosts the domain’s mailboxes and forwards the message to the business inbox at Fastmail. The business also keeps ordinary order, shipping, accounting and guarantee records.

The website’s form records and the copies sent by email are personal data we hold. Access is limited to the people who run the business. Retention and requests for access, correction or deletion cover both the database and correspondence; /legal/privacy and /legal/your-data give the details.

This page covers the controls on inquiry requests and on card payment, which runs on a checkout page Stripe hosts.

How the website is secured

fixedgearstraps.com is served over HTTPS with TLS, including the /api/inquiry endpoint. Form submissions contain personal information and need that protection in transit.

The pages are built in advance, but the forms call a Cloudflare Worker that runs server-side code and writes to Cloudflare D1. There are no customer accounts or customer passwords to store.

Our own code sets no cookies and writes no form data to browser storage. We run no analytics. Termly stores the cookie choice, and tawk.to uses browser storage only after a Performance-category opt-in or a click on “Chat with the bench”.

The inquiry service uses an IP-derived rate-limit key, a truncated browser user-agent, timestamps and delivery status. A hidden honeypot helps catch bots. These controls reduce abuse; they do not guarantee that an attack or delivery failure is impossible.

Check it yourself

In plain EnglishYour browser shows the submission request and when chat loads. Server storage and deletion are described here and at /legal/privacy.

• —The network tab shows webfont and Termly requests. tawk.to appears after a Performance-category opt-in or a click on “Chat with the bench”; neither action means it remains unloaded.
• —The application or storage tab shows the cookies and storage a site has written. On ours you will find the consent manager’s record of your own choice, and the chat widget’s session entries if — and only if — you switched the chat on. Nothing else.
• —View source, or read the deployed JavaScript. There is no analytics snippet, no tag manager, no advertising pixel and no social embed to find. The two third-party scripts you will find are the consent manager in the head and the chat loader at the end of the body, both described on this page.
• —Submit /quote or /contact with the network tab open: a JSON POST goes to /api/inquiry. A successful submission displays a GH-XXXX-123 reference. It does not send a confirmation email to you.
• —If any of that stops being true, this page is wrong and we would like to hear about it.

Inquiry submissions and card-number rejection

The forms at /quote and /contact send JSON to /api/inquiry, a Cloudflare Worker on fixedgearstraps.com. The Worker stores each request in Cloudflare D1, then sends it through Resend to quotes@fixedgearstraps.com. Migadu hosts the domain’s mailboxes and forwards the message to the business inbox at Fastmail.

The Worker rejects anything that looks like a payment card number with HTTP 422 before storing, emailing or logging it. Card numbers are never stored. No form asks for card details. Do not put card details in notes or messages; this inquiry service is not a payment channel.

Rate limiting uses a key derived from the IPv4 address or the /64 prefix for IPv6. A hidden honeypot field catches bots; there is no captcha. We also process a truncated browser user-agent, timestamps and the email-delivery status returned by Resend.

Form correspondence is kept for two years from the last message in the thread. The D1 copy is automatically purged two years after receipt and delivery-status events after 90 days. An access or deletion request covers these records too. Email hello@fixedgearstraps.com with the submission email and reference, if available.

Payments

In plain EnglishCard numbers are not typed on this website. Buy now sends you to a checkout page Stripe hosts, and the card goes to Stripe.

Each fixed-price product has a Buy now link to a Stripe Payment Link: a full-page checkout hosted by Stripe at buy.stripe.com. The product, its price in USD, the shipping rate and the tax setting are fixed inside our Stripe account, so nothing typed or changed in a browser can alter the amount. The checkout takes cards only (Visa, Mastercard, American Express, Discover and the other brands Stripe supports for US accounts) and delivers to US addresses. Custom or volume work requires your explicit approval of a written, itemized USD quotation before any payment link is issued or any charge is made.

Every card-entry field on that page comes from Stripe. No primary account number, CVC, PIN or track data passes through this website, a Cloudflare Worker, our mailbox, the chat widget, analytics or a log. There is no Stripe script, key or webhook on fixedgearstraps.com: the site holds a plain link to each checkout, and orders reach the bench through our Stripe account. The secret key for that account stays off the website and out of the Worker.

A checkout charge appears on your card statement as GEARHOLD* GH-1 STRAPS, GEARHOLD* STRAP SET or GEARHOLD* STARTER KIT, the short form GEARHOLD* followed by the product. Other charges, such as a quoted order paid by payment link, can show the full descriptor GEARHOLD. Your bank may shorten or reformat that text.

Do not send a full card number, security code, PIN, password or bank credential through the quote notes, email, a phone message, chat, SMS or social media. We will not ask for one that way. The inquiry Worker rejects suspected card numbers before storage, email or logging. If card details arrive through another channel, we delete them without using them and send you to the hosted checkout instead.

Stripe publishes that a PCI-certified auditor evaluated Stripe and certified it to PCI Service Provider Level 1 — the most stringent level of certification available in the payments industry (docs.stripe.com/security, reviewed 29 Oct 2026). That is Stripe’s status as a service provider. It does not certify, endorse or guarantee Gearhold LLC. Sending buyers to a checkout page Stripe hosts, with no card field on our own pages, keeps card data off our systems. We have not completed a PCI DSS self-assessment questionnaire or an attestation of compliance of our own, and we do not claim PCI validation.

If we ever replace the payment links with a checkout our own server creates, the amount will still be set on the server, the redirect will go only to a Stripe-created URL, and any webhook will be verified on the unmodified raw body with its own signing secret. A card field or Stripe script on our own pages would change what we have to protect, so this page changes before any of that does.

We keep no card numbers. What comes back from Stripe is the ordinary merchant record: that a payment went through, the amount and any tax, the date, the card brand and last four digits, and the name, email and addresses entered at checkout. That record lives in our Stripe account and with the accounting records described below.

Where order data actually lives

Records can exist in the inquiry database, the email-delivery service, the business inbox, accounting and shipping tools, paper order notes and optional chat.

Email deserves an honest note, because it is where nearly all of this starts. Mail normally travels encrypted between mail servers, but the hops in between are not ours and we cannot promise it for every message. After it arrives, a copy sits in your sent folder as well as in our inbox. Send us what an order needs — a name, an address, what you want made. Nothing that would hurt you if the wrong person read it.

Access is limited to the people who run Gearhold. That is a short list and it does not include contractors, marketers, agencies or anyone who bought a lead list. Accounts are individual rather than shared, they are protected with strong unique passwords and with two-step verification wherever the provider offers it, and access is removed when someone stops working with us.

There is no permission matrix here and it would be dishonest to draw one. The controls that exist are the ones that fit a workshop: a small number of named accounts, no shared logins, and no reason for anyone else to be in the inbox. How long each record is kept, and why, is set out at /legal/privacy.

Physical security

The workshop is a room with a bench, a wall of webbing, Ruth the 1978 bar-tack machine, and a clipboard. It is locked when nobody is in it. The computer used for the business is password-locked and is not left signed in where someone could walk up to it.

Paper matters more here than it does in most security policies, because paper is where a live order note actually sits. Order slips stay in the workshop. They are not carried around, not left face-up on the counter, and not photographed for the internet. Once the order is closed and the accounting record is made, the slip is shredded.

What is not here is worth saying too. There is no badge reader, no camera wall, no alarmed server room and no visitor log, because there is no server here to guard and no data center to sign into. There is a lock, a bench, and a habit of putting paper away.

Third parties, and what each one gets

In plain EnglishThese are the outside companies involved in serving this site and running the business, and the most any of them ever sees.

Beyond the host handing you this page, the two font providers and the consent manager are the only outside servers your browser talks to while you read it — plus tawk.to if you have switched the chat on. Loading a font is a real network request, so it sends your IP address, your user-agent string and the page you are viewing to servers operated by Google in the United States and by Indian Type Foundry in India. If you are reading from anywhere else, that information leaves your country. A webfont is small, but it is not nothing, and we would rather write it down than let you find it in the network tab.

Everything else in that table sits behind the scenes. The inquiry providers receive data when you submit a form; the other business tools receive it as needed for correspondence, an order or a repair.

The 3D cog on the home page is drawn with three.js, which is bundled into the site itself rather than pulled from a content delivery network. It costs you no third-party request and it reports nothing to anyone.

What we deliberately do not do

• —No analytics. Not the big commercial one, not a privacy-friendly alternative, not a self-hosted one. We genuinely do not know how many people have read this page.
• —No cookies of our own. The consent manager stores the choice you make in its banner — the one strictly necessary storage write on the site — and the chat widget uses storage only if you switch it on. Earlier versions of this page claimed the site set no cookies at all; that stopped being true when the banner arrived, and this is the current, exact version.
• —No tracking pixels, no fingerprinting, no session recording, no heatmaps and no A/B testing.
• —No advertising or retargeting scripts, and no tag manager that could quietly load one later without it showing up in the source.
• —No selling, renting or brokering of customer information, and no sharing for cross-context behavioral advertising. The service providers above receive information for their stated roles.
• —No profiling for advertising. We hold submitted request and correspondence records, and tawk.to processes session activity while chat is active.
• —No third-party scripts at all beyond the two webfont providers, the consent manager and the opt-in chat widget named above.
• —No CRM tracker, no social embeds, no social login, no captcha, no map embed and no video embed. The chat widget loads only after a Performance opt-in or a click on “Chat with the bench”.
• —No newsletter. There is no signup form on the site and no mailing list to be added to.
• —No user accounts and no login of any kind.

The full cookie inventory, with the browser panels to check it in, is at /legal/cookies. What the business holds from forms and other channels is at /legal/privacy, and how to ask for a copy of it or its deletion is at /legal/your-data.

What we do not have

In plain EnglishWe hold no security certifications. Here is the full list of what is missing, why, and what to do if your procurement rules need it.

A row of badges is easy to imply and hard to back. So here is the list, without apology.

• —No SOC 2 report, Type I or Type II.
• —No ISO 27001 certificate.
• —No PCI-DSS attestation of our own. Stripe is a PCI DSS Level 1 service provider on its own published evidence; that does not certify Gearhold. Card numbers are not meant to reach us.
• —No formal penetration test and no third-party security audit.
• —No bug bounty program, and no budget to pay for one.
• —No dedicated security staff and nobody on call for security.
• —No 24/7 monitoring and no security operations center.
• —No appointed Data Protection Officer, and no EU or UK representative.
• —No cyber insurance policy.

We run an inquiry Worker and D1 database and keep correspondence and order records in business services. Provider certifications do not certify Gearhold. This page describes the controls we use without claiming an independent audit.

If your purchasing rules require a SOC 2 report, a security questionnaire backed by an audit, a signed data processing agreement listing named sub-processors, or a supplier carrying cyber insurance, we will not clear that bar. We would rather tell you in the first email than waste a month of your time. Buy through a distributor who can meet it, or buy from us on a purchase order where the only data that changes hands is a name, a shipping address and an invoice — which, for a box of pedal straps, is usually the honest amount.

If something goes wrong

In plain EnglishIf order information ever got out, we would tell the people affected quickly and in plain words, and tell the regulators the law says we must.

An incident could involve the inquiry Worker, D1 database or delivery service as well as an email account, accounting login, business laptop or paper order slip. We would assess both stored requests and emailed copies.

The first move would be to contain it — change credentials, end active sessions, revoke access, stop the leak. The second would be to work out exactly what was exposed and whose information it was. We would write that down as we went, because a clear record is what makes the notice afterwards worth reading.

We would notify the people affected without undue delay. Where the GDPR or the UK GDPR applies, we would notify the relevant supervisory authority within 72 hours of becoming aware of the breach. We have no establishment in the EU and no lead authority, so that means the authority for the people affected rather than one regulator standing in for the rest. Where a US state breach-notification law applies we would follow it, including the Georgia notification law for Georgia residents. We would not sit on the news until the picture was perfect.

A notice from us would tell you, in plain English:

• —What happened and roughly when, including when we found out.
• —What information about you was involved, and what was not.
• —What we have done to stop it, and what we have changed so it does not happen the same way twice.
• —What you should do, if there is anything worth doing.
• —Where to reply: hello@fixedgearstraps.com or +1 (762) 760-1179.

It would not be dressed up as a routine security update.

Reporting a vulnerability

If you find a security problem with fixedgearstraps.com, email security@fixedgearstraps.com, also listed in security.txt. hello@fixedgearstraps.com also reaches us. For an urgent issue you can call +1 (762) 760-1179 during workshop hours.

Tell us what you found, how to reproduce it, and what someone could actually do with it. A short clear write-up beats a scanner export every time.

If you report a genuine issue in good faith, do not access anyone else’s information, and do not degrade the service for other people, we will not pursue you and we will not report you. We will thank you and we will fix it. We cannot pay a bounty, and pretending otherwise would waste your afternoon.

What we ask you to avoid:

• —Automated scanning, fuzzing or load testing against the live site. It is a small host and the bill is ours.
• —Social engineering of any kind, including phoning the workshop under a pretext, and any attempt to enter the building.
• —Accessing, altering, downloading or keeping information belonging to anyone else.
• —Publishing the issue before we have had a fair chance to fix it. If we go quiet on you, publishing after 90 days is reasonable and we will not complain.
• —Using the phone line for anything that is not urgent. Email leaves a record we can work from.

We aim to acknowledge a report within five working days. Someone is at the bench Tue–Sat 10–18 ET, so a Sunday report waits until Tuesday. That is an aim we think we can keep, not a contractual response time, and we are not going to promise you an hour.

We can fix this website, the inquiry service and the way the business handles your records. Cloudflare, Resend, Migadu, Fastmail, Termly, tawk.to, the font providers and Stripe have their own systems and reporting routes. Tell us if a provider issue affects your data through our services so we can follow it up.

Business continuity

In plain EnglishThe restitch guarantee has no time limit, but it does depend on the workshop still existing. That is worth knowing before you treat it as insurance.

The lifetime restitch guarantee, set out in full at /legal/guarantee, has no time limit, needs no receipt, and follows the strap to a second owner. It also depends on there being a bench, a machine and someone to sit at it.

Gearhold is one workshop. If it closed, the guarantee would close with it. There is no parent company standing behind it, no escrow arrangement, and no third party contracted to honor repairs in our place. Anyone who tells you a lifetime guarantee from a small maker is stronger than the maker is selling you something.

What we can tell you is what a bad week looks like in practice. Ruth is a 1978 bar-tack machine, and machines that old are repairable — the parts exist and so do the people who know them. Webbing and hardware come from more than one supplier. Order records, invoices and the price list live in ordinary business tools that keep their own backups, so a dead laptop is an inconvenience rather than an ending. If a run slips, you get the new date from us rather than silence.

If we ever had to wind the business down, we would say so on this website and email anyone with an order in progress, finish or refund the work in hand, and give reasonable notice for guarantee claims instead of closing the door overnight.

The records would go the way /legal/privacy describes: kept while the law still wants them, then destroyed. A customer list is not an asset we would sell, and there is nothing else in there to sell. If the business were ever sold rather than closed, the order records and the guarantee would travel with it under the assignment clause at /legal/terms, and this page would say so before it happened.

When this page changes

In plain EnglishEvery claim here is checkable today. If one stops being true, the page changes before the thing does.

This page describes the current inquiry service and the workshop. It changes before we change how card payment works, add analytics or change how personal data is handled.

That day came for the chat widget on 20 Aug 2026, when the consent manager and the opt-in chat went live, and this page, /legal/cookies and /legal/privacy changed in the same release — before either one ran, not after somebody with the network tab open caught us. The promise stands for whatever is next: the pages are corrected before the code ships, and the effective date at the top moves with them.

We cannot email you about a change, because there is no mailing list to email. The date at the top is the honest signal. We keep the previous wording, so if you want to know what this page said on the day you ordered, ask and we will tell you.

29 Oct 2026: added the Worker, D1, Resend, Migadu and Fastmail request pipeline, rate limiting, honeypot, card-number rejection, retention and database rights coverage. Chat can now also load on a button click. PCI readiness is not certification.

30 Oct 2026: card payment went live on Stripe Payment Links for the three fixed-price products. Section 5.0 now describes the live checkout, the statement descriptors and the merchant record Stripe returns; the provider table lists Stripe as a live processor.

Talk to us

Security questions, a vulnerability report, or a procurement questionnaire you would like answered honestly rather than optimistically — same address, same phone, same people.

• —Gearhold LLC, a Wyoming limited liability company
• —104 S Cherry St, Tunnel Hill, GA 30755, USA
• —hello@fixedgearstraps.com — general questions and privacy requests
• —security@fixedgearstraps.com — security questions and vulnerability reports
• —quotes@fixedgearstraps.com — wholesale quotes
• —+1 (762) 760-1179 — Tue–Sat 10–18 ET

If you think anything on this page overstates what we do, tell us and we will change it. If we ever disagree, let’s start with a phone call.