Privacy Policy

The controller of your personal data is numistack.pl, [email protected], e-mail: [email protected] (the “Controller”).

• account data: e-mail address, username / name, password (stored only as a hash), profile settings and preferences,
• collection data: coin descriptions, photos (with the date taken, read from the EXIF metadata), prices, valuations, storage locations, notes, tags,
• technical data: an account event log (for example logins and account changes — the last 100 events) used for security. The IP address is used only to limit the number of requests (abuse protection) and is stored only in hashed (irreversibly transformed) form for at most 24 hours,
• visit statistics: page path, referrer host (where you came from — without the full address), UTM parameters, country (from the Cloudflare header), device type, and an irreversible hash (HMAC) of the IP address and browser — without cookies and not linked to an account; entries older than 90 days are deleted automatically,
• the date of acceptance of the Terms and the Privacy Policy at registration,
• the content of reports sent through the reports tab and correspondence with the Controller,
• data on the use of AI features (number and type of requests, consumption) — for cost accounting and abuse control.

• providing the service and handling the account — Article 6(1)(b) GDPR (performance of a contract),
• security, abuse prevention, establishing or defending claims — Article 6(1)(f) GDPR (legitimate interest),
• sending system messages (e-mail verification, password reset) — Article 6(1)(b) GDPR,
• meeting legal obligations of the Controller and demonstrating acceptance of the Terms — Article 6(1)(c) and (f) GDPR,
• sending photos for AI analysis — Article 6(1)(b) GDPR, only on your initiative (after you use the feature).

Data may be entrusted to entities that support the operation of the Service, under processing agreements or other instruments that ensure data protection:

• hosting and server infrastructure providers,
• e-mail providers (sending system messages),
• Cloudflare, Inc. — content delivery network and attack protection (processes the IP address and request headers in traffic to the Service),
• AI model providers configured in the Service (for example OpenRouter, Google Gemini) — they receive only the photos and content that you choose for analysis, without your e-mail address and account data. Before sending, we remove metadata from photos (including GPS location, camera model and date taken),
• external photo processing services (background removal, quality improvement), if enabled — only for photos that you choose to process.

Some providers may process data outside the European Economic Area; in that case the mechanisms provided for in the GDPR are used (for example standard contractual clauses).

AI results are auxiliary — we do not take automated decisions on their basis that produce legal effects for you, and we do not profile you.

Data is not sold or used for advertising.

Coins and collections that you choose to share through a link are visible to anyone who has the link — without logging in. You can hide financial data and storage location in the privacy settings and withdraw the sharing at any time, after which the link stops working.

The Service uses only a necessary session cookie that keeps you logged in (valid for up to 30 days, marked HttpOnly). We do not use third-party advertising or analytics cookies, and fonts and scripts are hosted in the Service — the browser does not connect to external servers for this purpose (for example Google Fonts).

Visit statistics work without cookies and without advertising identifiers — we do not track you across sites. We store only aggregate information about a page view (see section 2); if your browser sends a “Do Not Track” signal, the counter records nothing.

Interface preferences (for example the last selected tab or filter, or the language you chose) may be stored in the browser. You can delete them in your browser settings.

We keep account and collection data until the account is deleted. After deletion, the data is permanently erased and photos are removed from the server.

• login sessions — up to 30 days (or until logout),
• accounts not confirmed with the e-mail link — deleted after 7 days,
• request-limiting counters (hashed IP) — up to 24 hours,
• account event log — the last 100 events, deleted together with the account,
• administrator action log — up to 24 months (after an account is deleted, without the e-mail address of the person concerned),
• AI usage statistics — after the account is deleted they lose their link to you (anonymisation).

You have the right to access your data, to have it rectified or erased, to restrict processing, to data portability (CSV/JSON export is available in the app), to object to processing based on a legitimate interest, and to withdraw consent (if it was given), without affecting the lawfulness of processing carried out before.

You can exercise most rights yourself in Settings (the “Session” tab): download a copy of your personal data (JSON) and permanently delete your account. You can correct your data in your profile. For other matters write to [email protected]. You also have the right to lodge a complaint with the President of the Personal Data Protection Office in Poland (uodo.gov.pl) or with the supervisory authority in your country.

We apply technical and organisational measures appropriate to the risk: password hashing, HttpOnly session cookies, access to data limited to its owner, logging of security events, and keeping the keys of external services on the server side. No system is entirely free of risk, however — choose a strong, unique password.

We will inform you of material changes to this Policy in the Service or by e-mail. The current version is always available at /en/privacy-policy.