Effective date: August 19, 2026 · Last updated: August 19, 2026
The short version
We run a website about Nerf blasters. We make money from affiliate links and ads. We also run three things that involve your information: a newsletter you have to confirm twice before we send you anything, a wish list dashboard called the Armory where you can build a public or private list, and a Chrome extension that adds items to that list from five shops.
Here is what we do not do, and these are commitments rather than intentions:
- We do not sell your personal information, and we never have.
- We do not put a tracking pixel in our newsletter. We cannot tell whether you opened it, and we do not track clicks in it.
- We do not store the name or email of anyone who claims a gift on a wish list. The list records only that an item was claimed and when.
- We do not store your raw IP address on a wish list. We store a one way hash of it, which we cannot turn back into an address.
- We do not ask for a surname, a school, an address, a phone number, an age or a photo of a person to create a wish list, and our software actively rejects those shapes when you try to type them in.
- We do not run ads on wish list pages.
- We do not use anything you write to train a general purpose AI model.
1. Who we are
NerfGuns.net is a US based enthusiast site. Articles are published under the byline Gunner Vance, which is the site's editorial identity. "We", "us" and "our" mean the site and the people who run it.
We are not Hasbro. NERF is a registered trademark of Hasbro, Inc., and this site is not affiliated with, endorsed by or sponsored by Hasbro.
Contact for anything in this policy: hello@nerfguns.net
Postal address: 4001 S Pine St, #110542, Tacoma, WA 98411-9994
2. Who this covers
- Readers. Anyone who visits the site without signing in.
- Newsletter subscribers. Anyone who confirms a subscription.
- Armory account holders. Anyone who creates a wish list account, and the parent who holds the account for a child under 13. See section 3.
- Guests using the wish list without an account. Your list stays in your own browser. See section 6.
- Extension users. Covered in more detail on our Extension Privacy page, which is the authoritative document for the extension. This policy does not repeat it.
- People who left comments on old articles. See section 12.
3. Age, and how families use this site
Our audience is mixed. Plenty of our readers are adults buying blasters for themselves. Plenty are parents. Plenty are players who are 10, or 14, or 17. This section is written so a parent can read it once and know where they stand.
Under 13. A child under 13 may not hold an account here. When our sign-up form learns a birth date is under 13, no sign-up request is sent at all: the fields clear and the visit's browsing is dropped. Instead, the account belongs to the parent or guardian, and the child exists only as a nickname-only profile inside it, with no email, password, login or account of their own anywhere in our systems. The parent creates the profile, the parent's email address is on the parent account, and the parent controls what appears on the child's list and can take it down. Our software rejects anything that looks like a surname, a school name, an address or another identifying detail in the child's nickname. A child can absolutely help choose what goes on the list, including through a read-only view a parent can hand them with no login and no account of any kind. The account and the decisions about what is published are the parent's.
13 to 17. You may hold your own account, and these protections apply automatically:
- The only thing that appears publicly is the one word display name you choose, and it cannot be a surname, a school name or anything that looks like an address. Our software rejects those.
- No age, no location, no school, no photo of a person and no contact details ever appear on a list page.
- Every list is set to no index until a human reviews it, so it does not appear in Google search results until we have looked at it.
- You can set a list to private at any time, which makes it invisible to everyone but you.
- We recommend you tell a parent before you share a list, because the whole point of the list is to send it to family.
18 and over. You are an adult and the ordinary terms apply.
How the age question works. Before anything else, our sign-up flow asks a birth date on its own screen, three plain dropdowns, nothing else on the page. Nobody types a name, an email address or a password until the birth date question is answered. We compute your age bracket on our own server the moment you answer, we never store the birth date itself anywhere, and no cookie or session is created for the under-13 branch of that flow. If you believe a child under 13 has an account here anyway, write to us at hello@nerfguns.net and we will remove it.
4. What we collect from readers
You can read every article on this site without giving us anything. When you load a page, the following happens automatically, and most of it is not us:
| What | Who gets it | Why |
|---|---|---|
| Your IP address, browser and the page you asked for | Our host, Hostinger, in ordinary server logs | Serving the page, security |
| Page views, referrer, approximate location, device | Google Analytics 4, via Google Site Kit | Knowing which articles are worth writing |
| Google Tag Manager, present on every page | We checked what it actually loads: nothing today, the container has zero tags configured | |
| Ad requests and ad interactions | Google AdSense | We are paid for ads |
| Your IP and browser, when a page shows a product photo hosted by Amazon | Amazon | Some older list pages load product images directly from Amazon's servers |
| Your IP and browser, when a page has a YouTube video on it | Google, via the no-cookie embed domain | Video embeds |
| A hash of your email address, if you left a comment years ago and it shows an avatar | Automattic, who run Gravatar | Comment avatars |
The full detail, including what is a cookie and what is not, is in the Cookie Policy.
We show a cookie banner. On your first visit you will see a plain-language notice with two real buttons, Accept and Essential only, and a link to the full Cookie Policy. Google Analytics and Google Ads personalization stay off until you accept; declining, or leaving the banner alone, keeps them off and clears any analytics cookie already set. Your browser's Global Privacy Control signal is honoured the same way a decline is. We checked our own third-party footprint ourselves rather than assume it: a Zoho testing script we did not know was installed has been removed, and a dead, years-inactive analytics tag that predates this policy is gone as well.
5. What we collect if you subscribe to the newsletter
We collect your email address. That is the only thing you type.
Attached to it we store: the status of your subscription (pending, subscribed, unsubscribed or bounced), a random confirmation token, the date and time you asked to subscribe, a short tag saying which page or free download you came from, the date and time of the most recent change to your status, and, if you asked for a specific download, the address and label of that download.
We do not store your IP address with your subscription. We count signup attempts per address for an hour to stop bots, and that counter is keyed to a hash and expires by itself.
How the double opt in works. You type your address, we email you one link, and nothing else happens until you click it. If you never click, you stay at "pending" forever and you never receive a newsletter. If you did not ask for it, ignoring the email is a complete answer.
Unsubscribing. Every newsletter carries a one click unsubscribe that works from inside your mail app, and a plain link at the bottom. There is no login, no survey, no "are you sure". One click and you are out.
What we cannot see. There is no tracking pixel and no click wrapper in our newsletter. We know we attempted to send you an issue. We do not know whether you opened it or what you clicked.
What we keep after you leave. When you unsubscribe we keep the record and mark it unsubscribed, so that we can prove you consented and so that we do not accidentally add you again. Three years after that, the record is automatically reduced to a salted one-way hash of your address: the address itself, every timestamp except the status, and any lead-magnet detail are deleted, and only "unsubscribed" plus the hash remain, so a future re-add is still recognized without your address surviving anywhere in readable form. You can ask us to delete the record entirely, at any time, sooner than that, and we will.
If a message to you hard bounces, we mark the address bounced and stop sending, and the same three-year reduction applies. The bounce message itself is not stored, and if an earlier failure log ever named your address, that gets redacted at the same time.
6. The wish list, without an account
You can build a wish list without signing up for anything. If you do, the list lives in your own browser's local storage under a key called ng_armory_guest_v1, and it holds nothing but a short list of product keys and a timestamp. There is no name in it and no email in it.
None of that reaches us. The browser sends it to us exactly once, and only if you decide to create an account, at which point it becomes the starting contents of your list. Clearing your browser data deletes it and we cannot recover it.
We also store one other preference in your browser, ng_armory_plain, which remembers whether you prefer the plain English view of a list.
7. What we collect if you create an Armory account
The signup form asks for four things: a one word display name (20 characters maximum), a web address slug for your list, an email address, and a password. There is an optional checkbox to also join the newsletter. There is also a hidden field that must stay empty, which is how we catch bots.
What we store on your account: your email address, your display name, your slug, your password as a one way hash (we never see or store your actual password), whether you ticked the newsletter box, a note that you signed up through the wish list, whether you have confirmed your email, a hashed copy of your confirmation link, the ids of your lists, and, only if you ask for one, a hashed copy of your extension token and the time it was created.
What we store on each list: the items you added, the display name shown at the top, your short intro note, whether the list is live or archived, whether it is private, its review state, an optional cover image you uploaded, whether surprise mode is on, the claim record described below, and a one way hash of the IP address the list was created from.
The free text you write is cleaned before it is saved. Your intro note and your item notes run through a filter that strips out email addresses, web addresses, @handles and anything shaped like a phone number. This is deliberate. It exists so that a child cannot publish a contact detail on a page that grandparents are going to share.
Your display name and slug are checked too. We reject common surnames, school and place words, words like street, avenue, apartment, zip, address, phone and email, long runs of digits, and anything shaped like a house number and street. We also reject profanity and names that would make a page look like an official NerfGuns.net page.
8. Public lists, private lists and search engines
Lists are published as soon as you create one, and they are set to no index until a human has reviewed them. In plain terms: your list has a working web address immediately, so you can send it to family, and search engines are told not to list it. It becomes eligible to appear in search results only after one of us has looked at it and approved it, and approval requires that you have confirmed your email and that the list is actually a list rather than a test.
Any edit that adds an item captured from a shop puts the list back into review and back to no index until it is checked again.
Private lists. If you mark a list private, anyone who is not signed in as you gets a "not found" page, the page is excluded from caching, it is excluded from our trending page, and there is no share code for it.
Trending. We publish an aggregate page showing which products appear most often across public lists. It shows product totals only. No list is named, linked or counted individually, private lists are excluded entirely, and nothing renders at all until there are at least three public lists to aggregate.
9. Claiming a gift, and surprise mode
When a relative marks an item as "I'm getting this", we store a single number: the time it happened. No name, no email, no account, no cookie, no IP address, nothing that could identify who claimed it. Unclaiming removes that number entirely. We are saying this loudly because it is unusual and because families ask: we genuinely cannot tell you who bought what.
Surprise mode, if the list owner turns it on, hides the claim marks from the owner while everyone else can still see them.
10. Items captured from shops
You can add an item by pasting a product link or by using our Chrome extension. When you do:
- We accept links only from Amazon, Walmart, Target, Best Buy and Hasbro Pulse. Anything else is refused.
- We throw away the entire query string on the link you gave us. If it carried somebody else's affiliate tag or a session id, that is gone before we save anything.
- We store the cleaned link, the product title, your optional note and your priority.
- We do not store the price. The extension can see a price on the page and it deliberately does not send it to us.
- We store the product image address so that a moderator can see what the item is. That image is never shown on a public list page, and when we do show it to a moderator we tell the browser not to send a referrer.
Captured items are not clickable on your public list until a human has reviewed them. Until then they read "Link pending".
11. The Chrome extension
The extension has its own policy at /extension-privacy/, and that page, not this one, is the authoritative description. The summary: it runs only on product pages at those same five shops, it sends nothing anywhere until you click its button, it stores its access token in your browser's local extension storage and deliberately does not sync it to your Google account, and it contains no analytics or telemetry of any kind. It talks to exactly one server, ours.
Your extension token is stored on our side only as a hash. It can do exactly two things: add one item to one of your own lists, and read the names of your own lists. It cannot log in as you, cannot read your email address, and cannot touch anybody else's list. It automatically expires 12 months after its last authenticated use, you can revoke it yourself immediately from the account screen at any time, and getting a new one replaces the old one.
12. Comments on old articles
This site is old and carries comments left on articles years before the current owner took over. WordPress stores, by default, the commenter's name, email address, website, IP address and browser string. Those records still exist.
We are not publishing anybody's email address from a comment. Going forward, the comment form requires a name and an email address, and carries its own separate, unticked "email me site updates" box: ticking it does not sign you up for anything by itself today, it just records that you asked. If you left a comment here at any time and want it and its associated data removed, write to hello@nerfguns.net and we will remove it.
13. Affiliate links and advertising
We earn money two ways and we would rather you knew exactly how.
Affiliate links. Many product links on this site are affiliate links, mostly Amazon Associates under the tag nerfspot-20, and some eBay Partner Network links. If you click one and buy something, we earn a commission at no extra cost to you. Our full disclosure is on the Affiliate Disclosure page, and the standard sentence appears near the links themselves: as an Amazon Associate I earn from qualifying purchases.
What that means for your data. When you click an affiliate link you leave our site and Amazon's or eBay's own privacy policy applies from that point. The tag tells them the visit came from us. They do not tell us who you are. We see aggregate earnings reports, not names.
Ads. We run Google AdSense automatic ads on articles. Google may use cookies and similar technology to select and measure ads, and Google's own policies govern that, subject to the ad choices in our cookie banner. We do not run ads on wish list pages at all, which is deliberate, because those pages are where family members and children spend their time. Toy-review and buying-guide pages are treated as directed at a mixed, partly-young audience, and personalized ad targeting is limited there; modification, battery-safety and competitive-play pages are treated as general-audience content.
We do not accept payment to change an article's conclusion. Where a manufacturer has provided a product, that is disclosed on the page in question, and no first-person testing or relationship claim is published unless the current publisher actually stands behind it.
14. Who we share information with
We do not sell your personal information and we do not share it with data brokers or advertising networks for their own marketing.
The companies that necessarily handle some of it are:
| Provider | What they handle |
|---|---|
| Hostinger | Web hosting and server logs, including their content delivery layer in front of the site |
| Titan Mail | Sends our newsletter and our two account emails, so it handles your address and the message |
| Google (Analytics, Site Kit, Tag Manager) | Site measurement |
| Google (AdSense) | Advertising on articles |
| Google Drive, via UpdraftPlus | Off site backups of the site database, which contains everything above. Backups run daily and off-site delivery is checked, not assumed |
| Amazon, eBay | Only when you click one of their links, or when a page loads a product photo from their servers |
| Automattic (Gravatar) | Only for avatars on legacy comments |
We will also disclose information where the law requires it, and if the site is ever sold the new owner inherits it under this policy.
15. How long we keep things
Being honest here matters more than being impressive.
| Data | How long |
|---|---|
| Newsletter subscription record | 3 years after you unsubscribe or a message to you bounces, then automatically reduced to a hash (address gone, only the hash and "unsubscribed"/"bounced" remain) |
| Armory account and its lists | Kept while the account exists. See the note on deletion below. |
| Hashed IP on a list | 12 months from list creation, then automatically purged. The list, its items and its display name are untouched |
| Claim timestamps | No independent expiry, they live and die with the list |
| Extension token hash | 12 months from the last authenticated use, then automatically revoked. You can also revoke it yourself immediately, any time, from the account screen |
| Legacy comments | Kept until removal is requested |
| Server logs and analytics | Per Hostinger's and Google's own retention settings |
| Backups | Retained per our backup settings, which means a copy of deleted data can persist in a backup for a period after deletion. Off-site backups run daily and are verified landing |
Archived lists. A list that has served its purpose can be archived rather than deleted, in which case the address keeps working and shows "this list has moved on". That exists because grandparents bookmark links and a dead link is a bad outcome. Archiving anonymizes the list rather than hiding it: the display name and the link back to your account come off, the address keeps resolving, and the item list stays so a bookmarked link is not a dead one. Archiving is not deletion, and if you ask us to delete rather than archive, deletion always wins.
16. Your choices and your rights
Whoever you are and wherever you live, you can:
- See what we hold about you. Ask and we will tell you.
- Correct it. Your display name, slug, notes and list contents are editable by you at any time.
- Delete it. Write to hello@nerfguns.net and we will delete your account, your lists and your newsletter record.
- Make a list private, immediately, yourself.
- Unsubscribe, in one click, from any newsletter.
- Ask us to take a list off the web, which we can do immediately.
How long we take. We answer within 45 days. If something is going to make that impossible we will tell you before the 45 days are up, not after.
What we will ask you for. The least we need to be sure the account is yours, and nothing beyond it. We are not going to demand a copy of an identity document to delete a wish list.
What it costs you. Nothing, and it never changes anything about your account. We do not close accounts, take lists down, or treat anybody differently because they asked a question on this page. If we say no to something, we tell you why, and you can write back and ask us to look again.
You can edit and empty a list yourself at any time, and a self-serve "delete my account" button is available directly in the dashboard, no email required unless you would rather write to us instead.
If you are in California, or in another US state with a consumer privacy law, or in the UK or EU, you may have additional rights including access, correction, deletion, portability and objection. Ask and we will honour them. We do not sell personal information and we do not share it for cross context behavioural advertising as those terms are defined in California law.
Parents and guardians: you can ask to see, correct or delete anything associated with your child's account, and you do not have to prove anything beyond a reasonable link to the account. Write to hello@nerfguns.net.
17. Security
Passwords are stored as one way hashes. Traffic runs over HTTPS. IP addresses on lists are stored only as one way hashes. Tokens are stored only as hashes. Private lists are enforced on the server, not hidden with CSS. Public list pages carry no ads and load no third party social scripts.
We are a small operation and we say so rather than implying a security department that does not exist. What we do, what we do not do, and what is on our list to fix, is written out on the Security page.
No system is completely secure, and we are not going to pretend otherwise.
18. Links to other sites
We link out constantly, to shops, to manufacturers, to YouTube creators and to other enthusiast sites. Once you click, their policies apply and not ours.
19. Where we operate
We are based in the United States and the site is hosted in the United States. If you visit from elsewhere, your information is handled in the United States, where privacy law differs from your own. The cookie banner and Global Privacy Control support described above apply regardless of where you are visiting from.
20. Changes to this policy
If we change this policy we update the date at the top. If we make a change that materially expands what we collect or who receives it, we will say so plainly on the site before it takes effect rather than relying on you re-reading the page.
21. Contact
NerfGuns.net · 4001 S Pine St, #110542, Tacoma, WA 98411-9994
Email: hello@nerfguns.net
Write to us in plain English. You do not need a form, a template or a lawyer to ask us to delete something.