Skip to main content

Legal

Privacy Policy

Effective October 13, 2026

This policy explains what SigilQR ("we") collects when you use sigilqr.com, why we collect it, and the choices you have. The short version: we collect what's needed to run an authenticity registry — account details, the items you register or claim, and scan activity — and we don't sell your data.

1. What we collect

  • Account data — name, email, and a hashed password (we never store the password itself).
  • Registry data — collections, collectibles, photos you upload, listings, orders, transfers, claims, and burn events.
  • Scan data — when a signed QR is scanned we record that a verified scan occurred and when. Public passport pages can be viewed by anyone without an account.
  • Messages & notifications — messages you send on-platform and notifications generated by activity on your account.
  • Technical data — IP address and basic request logs, used for security and rate limiting; one essential session cookie (sr_session) that keeps you signed in. See our Cookie Policy.

2. What we do NOT collect

  • No advertising trackers, no analytics, no device fingerprinting, no cross-site tracking.
  • No third-party scripts or fonts — every page asset is served from our own domain, so browsing doesn't send your IP address to anyone else.
  • No payment card numbers — when card payments are enabled they are handled by Stripe on Stripe's systems.
  • We do not sell or rent personal data. Ever.

3. How we use data

  • To operate the registry: authenticate you, record provenance, display public passports, run the marketplace.
  • To keep the Service safe: fraud prevention, abuse detection, rate limiting.
  • To communicate: service emails about activity on your account (e.g. a purchase or transfer). We don't send marketing email without separate consent.

4. What is public

Passport pages, collection galleries, and marketplace listings are public by design — they show item details, provenance events, scan counts, and brand names. Your email is never shown publicly. Owner identity is not shown on public passports; on-platform names may be visible to members of the same brand workspace (e.g. in transfer history).

5. Service providers

We use a small set of processors to run the Service:

  • Vercel — hosts the website; Render — hosts the API; Neon — hosts the database (all data encrypted in transit).
  • Vercel Blob — stores uploaded product photos.
  • Stripe (when card payments are enabled) — payment processing.
  • Resend (when email is enabled) — delivers service emails.

6. Retention

Account data is kept while your account exists. Registry history (mint, claim, transfer, sale, and burn events) is retained as a permanent ledger, because deleting it would corrupt the provenance records of other users' items. If you delete your account (Settings → Delete account, or My Collection → Delete account), we remove or de-identify personal data not needed for that ledger or for legal obligations.

7. Your rights

Depending on where you live (e.g. GDPR/CCPA regions), you may have rights to access, correct, export, or delete your personal data, and to object to certain processing. You can delete your account yourself at any time — it takes effect immediately. For anything else, email webmaster@donlinestore.com and we'll respond within 30 days.

8. Security

Passwords are hashed with bcrypt; sessions use httpOnly cookies; QR signatures use per-item HMAC secrets; access to production systems is restricted. No system is perfectly secure — if we learn of a breach affecting your data we will notify you as required by law.

9. Children

SigilQR is not directed to children under 16. Sign-up requires confirming you are 16 or older, and we delete any account we learn belongs to a younger child.

Emails

We only send emails about activity on your account. Every email has an unsubscribe link that works in one click without signing in.

10. Changes & contact

We'll post any changes here and update the effective date. Questions or requests: webmaster@donlinestore.com.