Privacy

We don't sell your information.

My Coin Stack is built by Cedar Forge Labs, and we build software that respects the people using it. That means we collect as little data as we can get away with, we don't share what we do collect with advertisers or data brokers, and we don't use it to build an advertising profile of you.

What we store

My Coin Stack stores the coins, bullion, and collection details you add to the app, along with the account information needed to sign in and sync between your devices. That's it. We don't store contacts, location, photos beyond the ones you attach to a coin entry, or anything else outside the app.

Where it lives

Your data lives on servers we run ourselves. Cedar Forge Labs administers the machines, the database, and the software on top of them, so there is no third-party backend company sitting between you and your collection.

Running our own infrastructure means securing it is our job, and we treat that as part of the product rather than an afterthought. Every connection between the apps and our servers is encrypted with TLS, so nothing travels over the network in the clear. The disks holding the database are encrypted at rest, which keeps the data unreadable without our keys even if the hardware itself were taken. Backups are encrypted as well and kept apart from the live server. Production access is limited to the people at Cedar Forge Labs who need it.

It also means we can answer plainly when you ask where your data is, and delete it when you ask us to, without waiting on a vendor.

What we don't do

We don't sell, rent, or share your data with advertisers or data brokers. We don't run advertising pixels, retargeting tags, or the kind of tracking networks built to follow you from site to site. We don't build a profile of you to monetize. And we don't use what's in your collection — what you own, what you paid, what it's worth — for anything other than showing it back to you.

Analytics we do use

We do use analytics, and we'd rather tell you than let you find out. This website uses Google Analytics, and the iOS, Android, and web apps use Firebase Analytics. They tell us which screens get opened, which features get used, and where people give up — the things we need to know to decide what to fix next.

What they don't get is your collection. Analytics events never carry the coins you own, what you paid, your photos, or your notes; that stays on our own servers and is never sent to Google. Analytics is tied to an anonymous app or browser identifier rather than to your name or email, and we don't use it for advertising or hand it to data brokers.

Measuring our marketing

Some of our printed material and advertising carries a QR code or a short link. When one of those is used, we record that the link was followed — the time, the country, and whether the device was a phone or a computer — so we can tell which campaigns are worth repeating.

To count repeat visits without identifying anyone, we convert the IP address and browser into a one-way fingerprint using a key that changes daily, and store only that. We do not store the IP address itself, and the fingerprint cannot be reversed or used to recognize you tomorrow, on another campaign, or anywhere else on the internet. No cookie is set for this.

Deleting your data

You can delete your collection entries from inside the app at any time. If you want your account and all associated data removed, email us and we'll take care of it.

Questions

If anything here is unclear, or you'd like to know exactly what's stored about you, get in touch and we'll explain plainly.