# Privacy Policy
**Numi - Coin Collection & Identification**
**Last updated:** July 19, 2026
**Apex Consulting AB** ("we", "us", "our") operates the Numi mobile application ("App"). This Privacy Policy explains how we collect, use, store, and share your personal data when you use the App.
**Contact:** info@apexconsulting.se
**Registered office:** Apex Consulting AB, Sweden
**Org. nr:** 559193-1935
---
## 1. Data We Collect
### 1.1 Account Information
When you create an account, we collect:
- **Email address** (via email signup, Google Sign-In, or Apple Sign-In)
- **Name** (first and last name, or display name from your Google/Apple account)
- **Profile picture** (optional, uploaded by you)
- **Biography** (optional, entered by you)
If you use the App without creating an account, we do not collect any personal identity information.
### 1.2 Coin Collection Data
When you use the App to identify, value, or manage coins, we collect:
- **Coin photos** you take or upload
- **Coin metadata** such as name, country, year, denomination, grade, estimated value, rarity, and personal notes
- **Sub-collection names** you create to organize your coins
If you are signed in, this data is synced to our servers. If you are not signed in, it is stored only on your device.
### 1.3 Social & Community Data
When you participate in the community features, we collect:
- **Posts** you create, including captions, photos, and coin details
- **Comments** you write on posts or coin identifications
- **Likes** you give to posts
- **Block and report actions** you take against other users
### 1.4 Purchase Information
We record whether you have:
- Purchased the "Remove Ads" option
- Subscribed to Numi Pro (monthly or yearly)
We do **not** process or store payment card details. All payments are handled by Apple (App Store) or Google (Google Play).
### 1.5 Device & Usage Data
- **Device locale** (used to set default weight units and grading scale preferences)
- **Ad interaction data** collected by Google AdMob (see Section 3)
- **Ad consent preferences** via Google's User Messaging Platform (UMP)
We do **not** use analytics SDKs such as Firebase Analytics, Mixpanel, or similar tools.
---
## 2. How We Use Your Data
We use your data to:
| Purpose | Legal Basis (GDPR) |
|---|---|
| Provide core App features (coin identification, collection management) | Performance of contract |
| Sync your collection across devices | Performance of contract |
| Enable social features (posts, comments, community feed) | Performance of contract |
| Process and verify in-app purchases | Performance of contract |
| Display ads to free-tier users | Legitimate interest / Consent (via UMP) |
| Detect and prevent abuse (spam, harassment, blocking) | Legitimate interest |
| Improve coin identification accuracy (cached AI results) | Legitimate interest |
We do **not** sell your personal data to third parties.
---
## 3. Third-Party Services
We use the following third-party services, each with their own privacy policies:
### Firebase (Google Cloud)
- **Firebase Authentication** — securely manages sign-in and stores your email and display name.
- **Firebase Storage** — stores profile pictures you upload.
- **Firebase Vertex AI (Gemini)** — processes coin images you submit for AI identification. Images are sent to Google's servers for analysis and are subject to [Google's Privacy Policy](https://policies.google.com/privacy).
### Google Sign-In / Apple Sign-In
If you sign in with Google or Apple, the respective provider shares your name and email with us according to their own privacy terms.
### Google AdMob
We display advertisements to users who have not purchased the ad-free option or subscribed to Numi Pro. AdMob may collect device identifiers, IP address, and ad interaction data. We use Google's UMP framework to obtain your consent where required. See [Google's Advertising Privacy Policy](https://policies.google.com/technologies/ads).
### Apple App Store / Google Play
In-app purchases are processed entirely by Apple or Google. We only receive confirmation of the purchase status, not your payment details.
---
## 4. Data Storage & Security
| Data | Storage Location |
|---|---|
| Account credentials & auth tokens | Firebase Authentication (Google Cloud, EU/US) |
| Profile pictures | Firebase Storage (Google Cloud) |
| Coin collection, posts, comments, profiles | Our backend servers (AWS, EU — Stockholm region) |
| Coin collection (offline copy) | Your device (SharedPreferences & local file system) |
| Purchase status & app preferences | Your device (SharedPreferences) |
We use HTTPS encryption for all data in transit. Access to backend systems is restricted and authenticated using Firebase JWT tokens.
---
## 5. Data Sharing
We share your data only in the following circumstances:
- **Public community features:** Your username, profile picture, posts, and comments are visible to other App users.
- **Third-party service providers:** As described in Section 3, solely to operate the App.
- **Legal obligations:** If required by Swedish or EU law, court order, or governmental request.
We do **not** share or sell your data to advertisers, data brokers, or other third parties for their own purposes.
---
## 6. Data Retention
- **Account data** is retained as long as your account is active.
- **Posts and comments** are retained until you or a moderator deletes them.
- **Coin collection data** is retained until you remove it or delete your account.
- **Cached AI identification results** may be retained indefinitely to improve service speed and reduce redundant processing.
When you delete your account through the App, your profile and associated data are permanently removed from our servers.
---
## 7. Your Rights (GDPR)
As a user in the EU/EEA, you have the right to:
- **Access** — request a copy of the personal data we hold about you.
- **Rectification** — request correction of inaccurate data.
- **Erasure** — request deletion of your data ("right to be forgotten"). You can delete your account directly in the App under Settings.
- **Restriction** — request that we limit processing of your data.
- **Data portability** — request your data in a machine-readable format.
- **Object** — object to processing based on legitimate interest, including ad personalization.
- **Withdraw consent** — where processing is based on consent (e.g., ad personalization), you may withdraw it at any time via the App or your device settings.
To exercise any of these rights, contact us at **info@apexconsulting.se**. We will respond within 30 days.
You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) at [www.imy.se](https://www.imy.se).
---
## 8. Children's Privacy
The App is not directed at children under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us at **info@apexconsulting.se** and we will promptly delete it.
---
## 9. International Transfers
Your data may be processed outside the EU/EEA by our third-party service providers (e.g., Google Cloud, which operates globally). Where this occurs, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission.
---
## 10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy within the App. Your continued use of the App after changes are posted constitutes acceptance of the revised policy.
---
## 11. Contact Us
If you have questions about this Privacy Policy or our data practices:
**Apex Consulting AB**
Email: info@apexconsulting.se
Country: Sweden
---
