Privacy
Short version: your holdings are yours. They are not sold, not shared and not advertised against. We do measure how the app is used, with our own code — no analytics vendor, no ad network, no tracking across other sites.
What is stored
- Your account — email address and a password, which is stored only as a cryptographic hash. Nobody, including us, can read your password back. Since October 2026 the account also carries its plan — free or Pro Stacker — with when and how it was granted; every account that was in the vault, or waiting at its door, before the plans existed is grandfathered Pro for life.
- Your profile — display name, and the optional bio and picture you add. These three are shown to the other approved members in the directory, along with the month you joined and roughly when you were last active — unless you turn off “Show me in the member list” in Account → Members, which takes you out of the list the other members see. Owners and admins stay listed, so members always know who runs the vault. Your email is not shown either way.
- The board — anything you choose to post in the members’ room, with when you posted it. A post is shown to every approved member under your display name (and your picture, if you’re listed in the member list); it is yours to remove, and the people who run the vault can hide one that crosses a line. A heart you leave on a post is counted, never named — the room sees how many, not who.
- Your vault — the holdings, alerts and photos you enter, with cost basis, purchase date, mint year, purity, grade, any stated numismatic value, and any brand or serial number you record.
- Your devices and asks — with push notifications on, the delivery address your browser issues for this device (so alerts can reach it) and roughly which browser it is; and for each photo you ask the identifier about, whether it answered and what metal it named — never the photo itself.
- How you use the app — which screens you open, which features you use, how long a visit lasts, error messages the app hits, and whether the sponsor banner was shown or clicked.
The usage measurements, precisely
Each record is a screen or feature name — "holdings", "exportCsv" — with a timestamp and your account id. What we deliberately do not record: what you own, what anything is worth, what you paid, what you named a holding, or what you typed anywhere. Owners and admins see these as totals only — visit counts, typical visit length, the most-used features, a list of errors. You can ask us for everything recorded about you at any time.
Where it lives
In a Supabase (PostgreSQL) database and private file storage. Every table is protected by row-level security and every photo is filed under a folder keyed to your account, so one signed-in person cannot read another's rows or files even by asking the database directly. Photos are served through short-lived signed links rather than public URLs.
Who can see it
You. Administrators can see the account list — email, display name, approval status, role, when you asked for access, when you joined and roughly when you were last here — in order to approve, restore or withdraw access, and the usage totals described above. They also have database-level access as the operators of the service. Your holdings are not part of any admin screen. Nothing is shared with advertisers, data brokers or any third party.
Two emails are sent from the account list: your access request (name, email, note) to the administrators, and a line to you when you're approved. Sign-in mail — address confirmation and password resets — is sent separately by Supabase Auth. All of it leaves through the same account at SendGrid, which sees the message it is asked to send. Beyond that: an email change you ask for sends a confirmation link to both the old and the new address; a note you write us can be answered by email, but only if you ticked “OK to email me back” on it, and the owners can have members' notes forwarded to their own inboxes. None of it carries anything about anybody's holdings, and there is no marketing mail: no newsletter, no digest, no ads. The one broadcast that exists is an owner announcement: it shows inside the app for every member, and is emailed — one member at a time, never a visible list — only to confirmed addresses that allow it, a switch you hold under Account → Notifications.
What your device talks to
The app fetches live data straight from your browser: gold-api.com (spot), goldback.com read through the vault's own relay (the Goldback rate — your browser asks the vault's server at supabase.co, which fetches the page, so goldback.com never sees you), frankfurter.dev (currency rates), fiscaldata.treasury.gov (national debt), gdeltproject.org (news headlines; when it cannot be reached, headlines come from news.google.com through the same vault relay), itunes.apple.com, Apple's image servers and each show's own audio host (podcasts, when you play an episode) and cdn.jsdelivr.net (published daily metal closes). Your account and your vault live at supabase.co, and the library that talks to it is loaded from esm.sh. Those services see the request the way any website visit does, including your IP address. None of them, apart from Supabase, are told anything about your holdings. Alerts that reach a closed app travel through your browser's own push service — Google's, Apple's or Mozilla's, depending on the device. What they carry is a title and a sentence, never a figure.
Paying for Pro Stacker happens on Stripe (buy.stripe.com), a payment company, on its own checkout page. When you tap Upgrade, the app sends Stripe your email address and your member reference so your payment matches your account by itself — never a holding, never a figure from your vault. Your card details go to Stripe directly; we never see or store them. Stripe tells the vault that you paid, or that a subscription ended, and that is the whole conversation.
Photo identification
The add-holding sheet can read a photo of a coin, bar or note and suggest what it is. That happens only when you tap Identify this photo: the photo then goes to Groq (api.groq.com), an AI service, through our own server, to be read once. We do not store it there, and it is not kept by our server. The only copy that stays is the small one attached to the holding you then save, on your own account. Each member can identify twenty photos a day. The suggestion is a guess for you to check — nothing is added to your vault until you save it yourself.
The sponsor slot
The banner is a plain link to the sponsor's own site. No advertising network is involved and no tracking pixel is loaded. We count how often the banner is shown and clicked, so the slot can be sold on real numbers. Sponsors are given those totals — never a list of who clicked, and never anything else about you.
Cookies
No tracking cookies and no third-party cookies. Your sign-in session is kept in your browser's local storage, along with a copy of your vault so the app works offline. What follows your account to every device: your home-page layout and stack goals, whether your amounts hide until a tap, and whether you're listed in Members. The rest — display currency, refresh cadence, the sample-data switch — stays in this browser.
Deleting your data
Delete a holding and it is removed from the database immediately. Delete your whole account yourself, in the app, under Account → Security & data → Delete my account: your holdings, photos, alerts, notes, board posts and profile are erased permanently, and your sign-in with them. Removing a board post takes the replies under it too — a thread goes with its root — and deleting your account does the same for every thread you started. Or email the address below and it is done by hand. Either way, gone means gone. Details at fbometalvault.com/delete-account.
Changes
If this policy changes in a way that affects what is collected or who can see it, you'll be told in the app before it takes effect.