Privacy Policy

1. Who we are

Numists is operated by Nándor Szőcs, an individual based in Romania, as the data controller for the personal data described below (contact: numists.market@gmail.com). This describes what Numists collects when you use the website or the mobile app, why, on what legal basis, and what control you have over it. It doesn't cover the other person in a deal you make through the site — what they do with information you share with them directly in chat is between the two of you.

2. What we collect

From signing in with Google, we get your email address, display name, and profile picture.

From using the site, we store what you give us directly:

• Your username, bio, country, and preferred language
• Photos and details of the coins you catalog or list for sale
• Chat messages, offers, and reviews you send
• Reports you file against another user

If you enable push notifications on the app, we store a device token — an opaque id for your phone, not your phone number — so Firebase can deliver them. If you grant camera or photo library access, that permission is used only to let you pick or take a photo of a coin; we don't access your library beyond the photo you choose.

When you're signed in and view another user's listing, we record that you (specifically, your account) viewed it — used only for an internal, admin-only distinct-view count; it's never shown to the listing's owner or any other user, and we don't record anything for signed-out visitors, so this involves no additional tracking cookie.

3. Our legal basis for processing

Under Article 6 GDPR, each use of your data rests on one of these grounds:

• Performance of a contract — creating your account, showing your listings, running chat/offers, and the other core features you actually use the site for
• Legitimate interest — fraud/abuse prevention, keeping the service secure and working (error monitoring), aggregate listing-view counts, and enforcing the Terms & Conditions — balanced against your right to privacy, and only ever the minimum needed for that
• Consent — promotional email only. It is off by default; nothing promotional is sent unless you explicitly turn it on in your profile, and you can withdraw that consent at any time in the same place
• Legal obligation — where we're required to keep or disclose something (e.g. to respond to a lawful authority request)

4. Who else sees it

We use a small number of processors to run the service, and don't sell your data to anyone:

• Google — for sign-in, and (if you use the AI-assisted identification tool) to analyze a coin photo you submit via the Gemini API
• Cloudinary — hosts the photos you upload
• Resend — delivers transactional emails (a new message, an offer)
• Firebase Cloud Messaging — delivers push notifications to the app
• Sentry — error monitoring, so we can find and fix bugs; may incidentally capture technical details of a request that errored
• Supabase (database) and Vercel (hosting) — store and serve the site and its data

Several of these are based outside the EEA (notably in the United States). Where that's the case, the transfer relies on that provider's Standard Contractual Clauses or an equivalent safeguard recognized under GDPR Chapter V.

Your username, display name, bio, country, active listings, and public reviews are visible to anyone who visits your shop page — that's the point of a public seller profile. Your email address is never shown to other users.

5. Cookies

Numists sets three cookies, all strictly necessary to run the site — none are tracking, analytics, or advertising, and none require consent under EU ePrivacy rules:

• Sign-in session (set by our authentication provider) — keeps you logged in; expires when you sign out or your session lapses
• numists_locale — remembers which language you're browsing in; up to 1 year
• numists_admin_mode — set only for site-admin accounts, toggles the admin UI; up to 1 year

6. How long we keep it

We keep your account data for as long as your account exists. Past listings, completed sales, and reviews stay visible after the fact so the other party's records stay intact — that's also why deleting your account (below) anonymizes rather than erases those specific records. We may retain an anonymized transaction/dispute trail for up to 3 years after account deletion where needed to defend against a legal claim or investigate abuse — never tied back to your name, email, or photo.

7. Your rights

Under GDPR you can, at any time, ask us (contact below) to:

• Confirm what personal data we hold about you, and get a copy of it (most of this is already visible and editable directly on your profile)
• Correct inaccurate data
• Erase your data — in practice, this is what account deletion (below) does
• Restrict or object to a particular processing use
• Receive your data in a portable, machine-readable format (data portability) — a one-click JSON download of everything on your account is available from your shop page's account settings while signed in
• Withdraw consent for promotional email at any time, without affecting anything already sent

If you believe we've mishandled your data, you have the right to lodge a complaint with a supervisory authority — in Romania, the National Supervisory Authority for Personal Data Processing (ANSPDCP), or the equivalent authority in your own EU country of residence.

8. Your controls

You can, at any time, from your profile:

• Edit or remove your display name, bio, country, and photos
• Turn off any individual email notification, or all promotional email
• Revoke notification permission for the app from your device's settings
• Delete your account entirely

Deleting your account removes your email, profile photo, bio, and other personal details, signs you out everywhere, unregisters your devices from push notifications, and unlists anything you currently have for sale. Listings, sales, and reviews you were previously involved in stay on the platform — other users depend on that history — but are no longer linked back to your identity. This can't be undone.

9. Not intended for children

Numists is not directed at, and isn't knowingly used by, anyone under 18 — creating a binding account and listing items for sale requires contractual capacity. If you believe a minor has an account, contact us and we'll remove it.

10. Changes to this policy

We may update this policy from time to time. Continuing to use Numists after a change means you accept the updated policy.

11. Contact

Questions about this policy, or a request under section 7, can be sent to numists.market@gmail.com or through the contact details on your account's profile page.