Privacy Policy

Grateful Metals LLC, an Indiana limited liability company (“we,” “us,” or “our”), operates the Grateful Metals web application (the “Service”), a collection management platform for coin and bullion collectors. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use the Service.

By creating an account or using the Service, you agree to the practices described in this policy. This policy applies to all users, including Free, Premium, and Estate tier members.

We collect the following categories of information:

• Account information: Your email address and display name, collected when you register. Your account is identified by a unique user ID.
• Collection data: The coin and bullion items you add to your vault, including titles, grades, grading service, notes, purchase details, and any images you upload.
• Payment information: When you purchase Premium or Estate access, payment is processed by Stripe. We do not store your full card number or bank account details on our servers — Stripe handles this on our behalf. We retain a record of your transaction (tier, entitlement, and Stripe customer/transaction identifiers) to manage your access.
• Bank account information (ACH / Financial Connections): If you choose to pay by bank transfer (ACH Direct Debit) for Estate-tier purchases, Stripe Financial Connections may access your bank account and routing numbers, balance data, and ownership details to verify and process the payment. This data is collected and stored by Stripe, not Grateful Metals. We receive only a tokenized reference that allows us to initiate the authorized debit.
• Reference and market data: We retrieve numismatic reference data (via the PCGS API) and precious-metals spot prices from public market-data sources, including Coinbase and Yahoo Finance, with currency conversion from a public FX-rate source.
• Usage and technical data: IP address, browser type, and interaction logs collected automatically when you use the Service.
• Device fingerprint (conditional on reinstatement): If your account has been suspended and we later offer to reinstate it, we may condition that reinstatement on your acceptance of a persistent device fingerprint being recorded. A device fingerprint is an identifier assembled from characteristics of your browser and device (for example: user agent, installed fonts, screen dimensions, timezone, and hardware canvas/WebGL signatures) that lets us recognize the same device across accounts. We collect this only after you explicitly accept the reinstatement offer; details are in Terms Section 10.2. This feature is being evaluated for deployment; until the specific tooling is live, we enforce reinstatement conditions with equivalent identifiers available to us (primarily IP address history and account metadata).

• To create and manage your account and authenticate your sessions.
• To store, organize, and display your coin and bullion collection.
• To process payments and manage your subscription tier (Free, Premium, or Estate).
• To verify and debit your bank account when you authorize an ACH payment.
• To provide reference data, grading information, and spot-price valuations.
• To communicate with you about your account, payments, and the Service.
• To detect, prevent, and address fraud, abuse, and security issues.
• To enforce account suspensions and reinstatement conditions described in Terms Section 10.2, including recognizing devices associated with previously-suspended accounts.
• To comply with legal obligations.

We do not sell your personal information. Certain information is made public by your own action or with other members; see “Public and community sharing” below. Otherwise we share data only with the following service providers and as required by law:

• Stripe — payment processing, subscription management, ACH bank debits, and Financial Connections bank verification. Stripe's handling of your payment data is governed by Stripe's Privacy Policy.
• Supabase — database hosting and authentication. Your account and collection data are stored in Supabase's PostgreSQL database. See Supabase's Privacy Policy.
• Cloudflare — image storage (R2) for any photos you upload to your vault, and infrastructure services. See Cloudflare's Privacy Policy.
• PCGS (Professional Coin Grading Service) — reference and grading data retrieved via API. See PCGS's Privacy Policy.
• Vercel — application hosting and deployment. See Vercel's Privacy Policy.
• Resend — transactional email delivery (account verification, password resets, and product notifications). See Resend's Privacy Policy.

Public and community sharing

Some information is intentionally shared through your use of the Service:

• Public profile. If you enable a public profile, your username, display name, join date, badges (Collector, Numismatist, Stacker), and any coins you explicitly mark for public showcase are visible to any visitor, including anonymous visitors and search engines. You can disable your public profile at any time in Settings; the “Vault Kill Switch” toggle hides all public showcase content immediately.
• Shakedown Street listings. When you list a coin on our user-to-user marketplace (see Terms Section 10), the listing — including its title, your public display name, price if set, listing kind (buy/sell/trade), and the photos you provided — becomes publicly visible to anonymous visitors and may be indexed by search engines. Withdrawing or completing a listing removes it from public view, but cached copies (e.g. in Google) may persist for a period we do not control. The underlying vault item's notes, purchase price, and private valuation are not exposed.
• Reference-image submissions. If you submit a photo for consideration in the Reference Guide and it is approved, your username may be credited on the reference item as the photographer. You may request removal of credit at any time via contact.
• User-to-user messaging. When you contact another Grateful Metals member (for example, about a Shakedown Street listing), the recipient sees your username, display name, and any information you disclose in the message. We store these messages so both parties can retrieve them. We do not read messages except as necessary to operate the Service, respond to abuse reports, or comply with law.

We may also disclose information when required by law, court order, or to protect our rights, property, or safety, or that of our users.

When you choose to pay for the Estate tier by ACH Direct Debit, you authorize Grateful Metals LLC (via Stripe) to debit your bank account. Stripe Financial Connections is used to collect and verify your bank account information. Under this arrangement:

• You must provide explicit authorization (a “mandate”) before any debit occurs.
• Bank account details are collected and stored by Stripe, not Grateful Metals.
• We receive only a tokenized payment method reference sufficient to initiate the debit you authorized.
• You may revoke authorization by canceling the payment or contacting your bank, subject to ACH rules.
• Bank debit transactions are subject to a settlement period (typically 2–4 business days) before funds are available.

We retain your account and collection data for as long as your account is active. If you request account deletion, we will remove your personal data from active systems within 30 days, except where retention is required for legal, accounting, or dispute-resolution purposes.

Estate-tier members: because Estate access is a generational, lifetime entitlement, your vault and inheritance designation are retained until the inheritance is transferred or the account is closed by you or your verified heir. If you have designated an heir, that information is retained to facilitate the transfer of access upon verification.

Device fingerprints collected under the reinstatement condition in Terms Section 10.2 are retained indefinitely for as long as the associated account, or a subsequent account we have identified as belonging to the same person, remains banned. The purpose is to prevent circumvention of a permanent ban; retention beyond that purpose serves no function and fingerprints associated with reinstated accounts in good standing may be reviewed for deletion at your request under Section 8.

We protect your information using industry-standard measures, including encrypted data storage, secure authentication, row-level database access controls, and server-side validation of all billing and access changes. Payment data is handled exclusively by Stripe, which is PCI-DSS compliant. Inheritance codes are stored only as salted cryptographic hashes — never in plain text.

No method of transmission or storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security.

Depending on your location, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Request deletion of your personal data (subject to legal retention requirements).
• Export your collection data.
• Withdraw consent for payment processing (which may affect your tier access).
• Object to or restrict certain processing of your data.

Because Grateful Metals does not sell your personal information or share it for targeted advertising, there is no opt-out of sale or targeted advertising required at this time. If our practices change, we will update this policy and provide any required opt-out mechanism.

To exercise any of these rights, contact us at the email below. We will respond within 30 days.

The Service uses essential cookies and local storage to maintain your authenticated session and preferences. We do not use advertising or third-party tracking cookies.

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. For material changes, we will provide notice through the Service or via email. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or your personal data, contact us at:

Grateful Metals LLC
Evansville, Indiana, United States
GratefulMetals@outlook.com