SigilQR

Legal

Privacy Policy

Effective September 1, 2026

This policy explains what SigilQR ("we") collects when you use sigilqr.com, why we collect it, and the choices you have. The short version: we collect what's needed to run an authenticity registry — account details, the items you register or claim, and scan activity — and we don't sell your data.

1. What we collect

  • Account data — name, email, and a hashed password (we never store the password itself).
  • Registry data — collections, collectibles, photos you upload, listings, orders, transfers, claims, and burn events.
  • Scan data — when a signed QR is scanned we record that a verified scan occurred and when. Public passport pages can be viewed by anyone without an account.
  • Messages & notifications — messages you send on-platform and notifications generated by activity on your account.
  • Technical data — IP address and basic request logs, used for security and rate limiting; a session cookie (sr_session) that keeps you signed in.

2. What we do NOT collect

  • No advertising trackers, no third-party analytics cookies, no cross-site tracking.
  • No payment card numbers — when card payments are enabled they are handled by Stripe on Stripe's systems.
  • We do not sell or rent personal data. Ever.

3. How we use data

  • To operate the registry: authenticate you, record provenance, display public passports, run the marketplace.
  • To keep the Service safe: fraud prevention, abuse detection, rate limiting.
  • To communicate: service emails about activity on your account (e.g. a purchase or transfer). We don't send marketing email without separate consent.

4. What is public

Passport pages, collection galleries, and marketplace listings are public by design — they show item details, provenance events, scan counts, and brand names. Your email is never shown publicly. Owner identity is not shown on public passports; on-platform names may be visible to members of the same brand workspace (e.g. in transfer history).

5. Service providers

We use a small set of processors to run the Service:

  • Vercel — hosts the website; Render — hosts the API; Neon — hosts the database (all data encrypted in transit).
  • Vercel Blob — stores uploaded product photos.
  • Stripe (when card payments are enabled) — payment processing.
  • Resend (when email is enabled) — delivers service emails.

6. Retention

Account data is kept while your account exists. Registry history (mint, claim, transfer, sale, and burn events) is retained as a permanent ledger, because deleting it would corrupt the provenance records of other users' items. If you delete your account, we remove or de-identify personal data not needed for that ledger or for legal obligations.

7. Your rights

Depending on where you live (e.g. GDPR/CCPA regions), you may have rights to access, correct, export, or delete your personal data, and to object to certain processing. To exercise any of these, email us — we'll respond within 30 days.

8. Security

Passwords are hashed with bcrypt; sessions use httpOnly cookies; QR signatures use per-item HMAC secrets; access to production systems is restricted. No system is perfectly secure — if we learn of a breach affecting your data we will notify you as required by law.

9. Children

The Service is not directed to children under 16, and we do not knowingly collect their data.

10. Changes & contact

We'll post any changes here and update the effective date. Questions or requests: webmaster@donlinestore.com.