This policy describes what the current Fairspire application actually does. Where something has not been decided, this page says so instead of inventing an answer.
Fairspire is a local-first coin and bullion collection app. Your collection lives on your device. Fairspire does not sync your collection to the server. The one exception is optional public sharing: if you choose to make a portfolio or an item public, a limited, structured snapshot of just those items is stored on Fairspire’s server so other signed-in users can find them (see “Public inventory sharing” below). Some optional online features send limited data to Fairspire’s servers and, from there, to the service that performs that feature.
Fairspire helps you track coins, bullion, purchase and sale history, notes, and photos on the device you use. You can use the collection without signing in.
If you sign in, you can use online features that are currently gated behind an account: AI coin scanning, Numista catalogue search, and PCGS certification lookup.
Unless you use an online feature described below, the following stay on this device and are not sent to Fairspire servers:
Photos are stored in a separate device-local photo database. Collection backups include portfolios, items, sales, and chart snapshots. Photos and your metals.dev API key are not included in the backup file.
Account deletion does not wipe this on-device collection.
Items you explicitly make public are the one exception to the list above: a limited snapshot of those items is stored on the server for as long as they stay public. See “Public inventory sharing” below for exactly what that snapshot contains and what it never contains.
If you request a sign-in code, Fairspire stores your email address (trimmed and lowercased), an internal user id, a plan id used only to decide which features your account may use, hashes of session tokens, HMAC verifiers for email sign-in codes, and expiration timestamps.
There is no in-app purchase or payment collection today.
The raw session token lives only in an HttpOnly cookie in your browser. The raw 6-digit sign-in code lives only in the email until you use it. Fairspire does not store those raw values.
Every portfolio is private by default, and visibility is decided separately for each portfolio — making one portfolio public never affects the privacy of any other portfolio in your collection. Nothing is ever shared unless you choose Public for a portfolio (Portfolio menu → Sharing) or Public for an individual item (Edit item → Sharing). Making a portfolio public requires being signed in; a portfolio cannot become public on its own, and only your own explicit action in the app — never a background sync, and never a stale copy of the app left open on another device — can turn a portfolio public.
When an item is public, Fairspire stores on its server a snapshot containing only these structured fields: the item’s name or coin type, its kind (coin, bullion, lot, graded), year, mint, denomination, country, metal and purity, grading service, grade, and designation, quantity, and current estimated value together with the time that value was computed, and a status label you choose (showcase, open to trade, or for sale). Quantities and current estimated values are public by design; if you do not want them visible, keep the item private or hidden.
The snapshot never contains your cost basis, profit or loss, purchase price, purchase date or source, notes, certification numbers, photos, sale records, email address, name, location, IP address, or account identifiers. The server rejects, rather than silently strips, any other field. Each public portfolio carries its own opaque identifier — not your user id, not your email, and not linked to anything visible in the app, and not shared between two different public portfolios in the same account, so they cannot be tied to each other from search results alone.
Only signed-in Fairspire users can search public items, through a bounded, rate-limited search over those structured fields. Public items are not exposed to anonymous visitors and are not indexed by search engines. There is no messaging, commenting, offer, or payment feature attached to a public item.
Making a portfolio Private, or an item Hidden, removes its snapshot from the server before Fairspire treats the change as complete. Setting an item to Hidden specifically waits for the server to confirm the item is gone from search before saving the change at all; if that confirmation cannot be obtained, Fairspire shows an error and does not save the change, rather than letting you believe the item is private when it may not be. Making a whole portfolio Private takes effect on the server immediately for that portfolio alone. If any privacy-reducing server request cannot complete right away (for example, while offline), Fairspire keeps trying automatically and will show a clear message rather than silently claiming success. Deleting an item, or deleting a portfolio, removes its public snapshot from the server as part of that deletion; deleting your account removes every public snapshot and every portfolio's sharing setting across your whole collection.
Once an item's public snapshot is removed, it stays removed. A hidden or deleted item cannot be silently recreated in search by a delayed sync, a stale or offline copy of the app catching up later, or an old device resuming a sync it started before you made the change — Fairspire's server remembers that the item was removed and refuses to let an ordinary resync bring it back. Bringing it back requires the same explicit action that made it public in the first place: choosing Public for it again.
Restoring a backup never publishes anything by itself. A restored backup's portfolios and items always come back Private/Hidden, even if the backup was made while something was public, and even if the backup names a sharing identifier — that identifier is discarded on restore rather than reused, so a restore can never silently reconnect to (or publish under) an account other than the one performing the restore. To share something from a restored backup, you turn sharing on again explicitly, the same way as for any other portfolio.
Restoring a backup also protects whatever is public on your device right now, before your collection is replaced. If any of your current portfolios are public at the moment you start a restore, Fairspire removes their public snapshots from the server first — before your device's collection is replaced with the backup's contents. If that removal cannot be confirmed (for example, you are signed out or offline), the restore does not proceed at all and your current collection is left exactly as it was, so a restore can never leave a portfolio's old public snapshot stranded and searchable after the portfolio it belonged to is gone from your device.
Public sharing is currently a foundation feature that ships disabled. PUBLIC_INVENTORY_ENABLED is the master kill switch (unset/malformed/false means off). A separate rollout control, PUBLIC_INVENTORY_ACCESS_MODE (off, allowlist, or all; unset/malformed means off), prevents turning the master switch on from automatically exposing public inventories to every signed-in account. In allowlist mode only listed account emails receive normal publish/search/browse access. Turning the master switch off, setting access mode to off, or removing an account from the allowlist hides that owner's public inventory from other users' search and collection browsing, but the owner can still unpublish or delete previously published snapshots so data is not stranded.
Signed-in users who can use public inventory search can report a currently public item. Authorized Fairspire moderators (configured with PUBLIC_INVENTORY_MODERATOR_EMAILS, never shown to browsers or written to logs) can review those reports, dismiss them, or suppress the public item. Suppression removes the item from public search and collection browsing only. It does not delete or change the owner's private/local collection, and the owner can still hide, unpublish, or delete that public representation. A moderation suppression remains attached to that inventory item as it is edited or moved between portfolios. Ordinary updates, unpublishing and republishing, or moving the item to another portfolio cannot restore its public visibility. A newly created inventory record is treated as a separate item. Reports are rate-limited (10 per user per hour) and optional comments are capped at 500 characters. This reporting and moderation foundation is not by itself a claim of complete App Store Rule 1.2 compliance. Public inventories remain dark/off pending a separately reviewed controlled beta. Public beta enablement and App Store submission are separate decisions. PB1 reporting/moderation and PB2 operator readiness provide technical foundations only; current Apple requirements must be reviewed from authoritative current guidance before any App Store submission. No public-inventory environment value should be changed except by a deliberate, separately reviewed rollout.
If you scan a coin, the front and back photos for that scan are sent to Fairspire’s scan service, then forwarded to the AI vision provider for analysis.
Fairspire does not keep those scan images or the scan result on its servers after the request finishes. The result is returned to your device so you can decide whether to save anything into your local collection.
Fairspire does keep a spend/accounting record of the scan. That record may temporarily include your opaque user id so monthly AI limits can be enforced. After account deletion, that user id is removed; the dollar totals stay for accounting.
A third-party processor may process the images under its own terms. Fairspire does not claim that provider deletes the images immediately.
If you search or open a catalogue detail, Fairspire sends the search text or catalogue id you entered to Numista through Fairspire’s server. The Numista API key stays on that server and is not sent to your device. Fairspire does not keep a catalogue copy on its servers. It stores a per-account monthly usage count, not the search text.
Fairspire does not display Numista catalogue photos.
If you choose a result and save the item, this device may keep the Numista number (N#) and the selected issue id with that item, along with the name, year, mint, variety, metal, weight, and purity values written into the item. Those values stay with the item in on-device backups and, when you record a sale, in the sale record. The item may also keep a private note of which of those fields were filled from Numista. That note stays on this device, is not included in a public inventory listing, and does not decide whether Numista's licence allows the values to be stored.
Unlinking Numista removes that N# and issue id and keeps the saved details. You can also choose to remove values Fairspire recorded as filled from Numista and that you have not changed. Values with no source note, including details on older items, are not removed. Unlinking does not decide whether Numista's licence allows those values to be stored.
This feature is optional. It is not Google Sign-In for your Fairspire account.
If you paste a Google Sheets link and connect Google, Fairspire requests temporary, read-only access (spreadsheets.readonly) through Google Identity Services in your browser. Google then returns spreadsheet metadata and cell values for the spreadsheet ID in the link you pasted. That data is processed in this browser and is not uploaded to Fairspire servers.
The access token is kept only in memory for the import wizard. It is not stored in Fairspire settings, inventory, localStorage, or backups. You can disconnect Google; that does not delete items you already imported. After you confirm an import, accepted rows become ordinary local Fairspire inventory.
Google’s OAuth grant technically allows reading Sheets that Google account can access. Fairspire’s product only requests the spreadsheet you paste.
Fairspire’s use of data obtained from Google APIs is limited to providing this import feature and is intended to follow the Google API Services User Data Policy, including Limited Use. Public production use remains blocked until Google sensitive-scope verification, branding, and a published privacy-policy URL are completed. Local and Testing-mode OAuth clients are for development.
If automatic prices are enabled and the operator has configured the shared feed, Fairspire’s servers request latest metal prices from metals.dev (gold, silver, platinum, and palladium, in USD per troy ounce). You do not need a Fairspire account for that request. Your own metals.dev API key is not transmitted to Fairspire. Fairspire does not send your email, user id, inventory, or a user-supplied key with the price request.
If the operator enables Market Details, Fairspire’s servers may also request reference Bid/Ask quotes from the same metals.dev vendor. That data is informational only. It is not used to value your collection.
If an older version saved a metals.dev key on this device, that key stays on the device and is not uploaded. You can still type metal prices by hand when the live feed is off, unavailable, or stale beyond the server’s limit.
If you look up a certification number, Fairspire sends that number (currently PCGS only) through Fairspire’s proxy. Fairspire may keep a short-lived in-memory cache of the result on the server process. That cache is not a durable database and is not tied to your account. Your device may save the cert number on a local item if you choose to.
If you submit in-app feedback, Fairspire stores a campaign id, a rating, an optional comment, the time it was submitted, and the app version of the server that received it.
Feedback is not linked to your Fairspire account, email address, user ID, or session. Please avoid including personal information in your feedback comment, because the comment is stored as you submit it. IP addresses are used only to limit abuse in memory and are not stored with the feedback.
Fairspire’s servers briefly see your IP address for rate limiting, request timing, coarse error codes, and AI spend counters. IP addresses are not written to the account, spend, or feedback databases.
Server logs use fixed categories. They are not supposed to include email addresses, tokens, cookies, image bytes, or feedback comments.
Fairspire does not currently include an analytics, advertising, crash-reporting, or tracking SDK.
Fairspire uses this information to keep your local collection on your device, sign you in, run the online feature you asked for, enforce feature limits, keep a global AI spend ceiling, receive optional feedback, show items you explicitly made public to other signed-in users who search for them, and protect the service from abuse.
Fairspire does not use this information for advertising, marketing lists, or profiling people across other companies’ apps or websites.
When a feature is enabled and you use it, these processors may receive data. Each has its own terms. Fairspire does not control how long those companies keep data. Interface typefaces are self-hosted with the app and are not loaded from Google Fonts.
| Service | When | What they receive |
|---|---|---|
| Resend | You request a sign-in link | Your email address and the one-time sign-in URL |
| OpenAI | You run an AI scan | The two scan images and Fairspire’s analysis prompts |
| Numista | You search or open catalogue detail | The search query or type id |
| PCGS | You look up a certification number | The certification number |
| metals.dev | Fairspire fetches live market prices (no account required). Optional reference Bid/Ask if the operator enables Market Details | Fairspire’s server-side latest-price and, if enabled, Bid/Ask requests. Not your email, inventory, or a user-supplied API key |
| Google Sheets | You choose optional Google Sheets import | Your browser sends an OAuth request and then reads the pasted spreadsheet from Google. Fairspire servers do not receive the sheet |
On your device, collection data remains until you delete it, restore a backup over it, or clear the app’s storage.
Account data stays until you delete the account, or until a session or login token expires. Expired authentication records are periodically removed by the server. That cleanup is not guaranteed at the exact moment of expiry.
AI spend records are kept for accounting. After account deletion, the user id on those rows is cleared. Dollar totals stay.
Numista and Cert Lookup per-account monthly counts are deleted with the account. Counts only — not search text or certification numbers.
Aggregate UTC-day provider-call counts (no user id, no certificate numbers) stay for operator/provider budget accounting. They are not tied to an account and are not deleted when a user deletes their account.
Public inventory snapshots are kept only while the item is effectively public. They are removed when you make the item hidden or its portfolio private, when you delete the item and the app next syncs, or when you delete your account. A moderator suppression hides a public snapshot from other users but does not delete your local collection.
If you report a public item, Fairspire stores the report reason, optional comment (up to 500 characters), a small public-at-the-time snapshot of identifying fields (title, type, year, mint), and opaque ids needed to review it. Reports do not include your email in operator-facing views. They are kept for moderation/audit history even if the public item is later hidden or deleted. Account deletion removes reports you filed, owned, or resolved.
Feedback is stored until an operator defines a retention policy. There is no automatic deletion today.
If you are signed in, Settings → Account → Delete account lets you permanently delete your Fairspire account. You must confirm, then type DELETE ACCOUNT.
Fairspire then removes your user row, all sessions, all login tokens, your Numista monthly usage, your Cert Lookup monthly usage, your public inventory sharing setting and every public item snapshot, public-inventory reports you filed, owned, or resolved as a moderator, and removes your user id from historical AI spend rows. It does not change historical dollar totals.
Deletion does not erase the collection, photos, notes, or sales on this device. It does not find or delete previously submitted feedback. It does not erase aggregate global provider-call counts.
After deletion you are signed out. The same email may register later as a new account with a new user id. Old anonymized spend is not attached to that new account.
If account deletion succeeds but spend cleanup cannot finish, the account is still gone. A leftover opaque user id may remain on old spend rows until cleanup is retried. The app will not claim that privacy cleanup fully finished in that rare case.
Fairspire stores login and session secrets only as hashes, sends the session in an HttpOnly cookie, and requires a CSRF header on cookie-authenticated requests. Provider API keys stay on the server and are not shipped in the app bundle.
Based on the current application, Fairspire does not sell personal information, does not include third-party advertising, does not include analytics or tracking SDKs, and does not track you across other companies’ apps or websites.
Fairspire is a collection tool for coin and bullion records. A minimum age has not been published. That decision must be made before a public store listing.
This draft is not a GDPR, CCPA, or similar compliance claim.
When this policy is published, updates will be posted at the same public URL with a new date.
For privacy or support questions, email support@fairspire.app.
A mailing address and legal operator name have not been published. They must be filled in before this policy is used for a public or App Store listing.