Aevumex
Privacy policy
Aevumex is built on one principle: what you own is none of our business. Your portfolio is encrypted on your device with a key only you hold. This policy explains which data we do process, why, and your rights under the General Data Protection Regulation (GDPR).
1. Controller
Aevumex, established in the Netherlands, is the controller. Contact: privacy@aevumex.com. [Chamber of Commerce number and address will be added once the company is registered.]
2. What we can never read: your portfolio
All data about your metal (type, quantity, weight, purchase date, purchase price, storage location, notes, receipt photos) is encrypted on your device with AES-256-GCM before it is stored or synchronised. The key is generated on your device, kept in the secure keychain of iOS or Android and derived from your 12-word recovery phrase. Our servers receive and store only encrypted blobs without the key. We cannot view, recover or share this data. If you lose both your device and your recovery phrase, the portfolio is permanently unreadable, also for us.
What the server does see: the number of encrypted items, timestamps and blob sizes.
3. Data we do process
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| E-mail address | Sign-in with a one-time code, account management, address changes | Performance of the contract | While your account exists |
| Name and date of birth (optional) | Your profile; the name may come from Apple or Google if you allow it | Consent; you may leave them empty or delete them | Until you delete them or close your account |
| Pseudonym | Shown on the marketplace and in chats instead of your name | Performance of the contract | While your account exists |
| Listings, photos, chat messages, reviews, reports | Running the marketplace, moderation, legal obligations (Digital Services Act) | Performance of the contract; legitimate interest (safety) | Listings 30 days after expiry; chats and reports up to 12 months after account closure for abuse investigations |
| Price alerts (metal and threshold) | Push notification when a price crosses your threshold | Performance of the contract | Until you delete the alert |
| Device push token | Delivering notifications; the notification itself never contains amounts or holdings | Consent (notifications) | Until you disable notifications or sign out |
| Subscription status, app user id, purchase receipts | Activating and restoring Aevumex Pro | Performance of the contract | Statutory retention period for transaction data |
| Technical logs (IP address, error reports) | Security and stability | Legitimate interest | At most 30 days |
We process no location data (the region in a listing is free text you choose), show no advertising and do not track you across apps or websites. Photos attached to a listing are uploaded without location metadata (EXIF).
4. Processors and transfers
| Party | Role | Location |
|---|---|---|
| Supabase (Supabase Pte. Ltd.) | Database, authentication, storage of encrypted blobs and marketplace data | EU (Ireland); SOC 2 Type II, ISO 27001 |
| Resend | Sending sign-in codes and account e-mails | EU/US; data processing agreement with standard contractual clauses |
| RevenueCat | Subscription management (only a random user id and purchase receipts, never your e-mail) | US; standard contractual clauses |
| Expo (push service), Apple (APNs), Google (FCM) | Delivering content-free notifications | US; standard contractual clauses |
| Apple and Google | Sign in with Apple or Google (only if you choose it), payments through the stores | Independent controllers for their own processing |
| metals.dev, European Central Bank | Prices and exchange rates; receive no data about you | — |
5. Your rights
You can view and change your data in the app under Settings → Profile, delete your account and all associated data under Settings → Delete account, and withdraw consent for notifications in your device settings. You also have the rights of access, rectification, erasure, restriction, portability and objection; e-mail privacy@aevumex.com. We respond within one month. You may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
6. Security
Beyond on-device encryption: TLS connections, database access enforced strictly per user (row level security), PIN and biometric lock in the app, and no passwords that could leak.
7. Children
Aevumex is not intended for persons under 16; we do not knowingly collect data from children.
8. Changes
For material changes we notify you in the app and on this page, with a new version date at the top.