How we handle your data

Account information. When you sign up: your name, business name, email, and a password (stored hashed, never in plaintext). When you invite team members: their name, email, and role.

Business profile. Logo, tagline, and any brand details you upload for your dealership.

Inventory data. Every watch and jewelry piece you log — brand, reference, model, cost basis, asking price, photos, notes, condition, provenance, serial numbers, jewelry attributes (material, weight, gemstones), and consignor links.

Customer and buyer data. Names, emails, phone numbers, Instagram handles, preferred contact channels, wishlists, budgets, and notes — whatever you enter about the buyers you serve.

Deal and accounting data. Sale prices, cost basis, fees, commissions, payment methods, taxes collected, expense entries, invoice records, and payment history.

Payment metadata. Subscription status, plan tier, billing email, and Stripe customer/subscription IDs. We do not see or store your card number — Stripe handles that directly.

Usage and operational logs. Standard server logs (IP, timestamp, request URL), email delivery status from Resend, and a brief log of AI scan calls (timestamp, dealer id, type, cost). No deep behavioral profiling.

To provide the product. Render your dashboard, match inventory against buyer wishlists, deliver email, process payments, and run the AI features you trigger.

To improve the product, in aggregate. We may look at anonymized, aggregated usage signals to decide what to build next — like “X% of dealers used the bulk-add flow this month.” No individual customer details surface in that analysis.

To contact you about your account. Transactional email (welcome, receipts, invoice send confirmations), product updates if you opt in, and direct outreach if your account needs attention. You can unsubscribe from product updates anytime; transactional email is required.

For security and abuse prevention. Rate limiting, fraud detection, and incident response.

We do not sell your data, share it with advertisers, train third-party AI models on it, or use your customers’ details for any purpose beyond running WristBook for you.

We don’t share data with any other third parties. If that ever changes — for example, when we add a new marketplace integration — we’ll update this page and notify you before turning the new integration on.

Same account, same data. The app signs in to the same WristBook account and stores data in the same place as the web app. Everything on this page applies to it.

Face ID and PIN lock are handled by your device. Your face data never leaves Apple’s Secure Enclave, and the optional PIN is stored only on your device (in the iOS Keychain, as a salted hash). Neither is sent to us.

Camera, photos and microphone are used only when you choose to: to photograph or scan a piece or an invoice, to attach photos, or to ask Case a question by voice. Voice is turned into text by Apple’s speech recognition and only the text is sent to Case.

No tracking. The app contains no advertising or analytics SDKs and doesn’t track you across other apps or websites.

Primary storage: Supabase US region (Postgres + S3-equivalent object storage for photos).

Application servers: Vercel US.

Email delivery: Resend (US).

Payment processing: Stripe (US, with global card-network routing).

AI features: Anthropic API endpoints. When you ask Case a question, the question and the records Case looks up to answer it (for example your deals, inventory, buyers and totals) are sent to Anthropic to generate the answer. Photos you submit for a scan are sent the same way. Nothing is sent until you use one of these features, and under Anthropic’s API terms none of it is used to train their models.

Access. You can see all your data in the app. Need a structured export of everything? support@wristbook.io and we’ll send you a JSON dump.

Correction. Most fields are editable in the app directly. Anything you can’t edit — like a historical payment record — email us and we’ll fix it.

Deletion. You can delete buyers, inventory, and deals in the app. To delete your entire account and all its data, use Settings → Team & billing → Cancel or delete (on the web or in the iPhone and iPad app), or email us and we’ll process it within 30 days and confirm in writing once it’s complete.

Portability. Your data is yours. We’ll hand it over in a structured format (JSON, CSV) anytime you ask, with no exit fee and no time limit.

If you’re a California or EU resident, you have additional statutory rights under the CCPA and GDPR respectively — access, correction, deletion, portability, and the right to object to certain processing. The same email address gets you those too.

While your account is active: Indefinitely, so you have full history.

After cancellation: 30 days, then permanent deletion. You can re-subscribe within that window and everything comes back. After 30 days it’s gone.

Financial records we’re required to retain for tax or accounting purposes (invoices, payment records) may be kept longer where law requires.

Backups: Encrypted Supabase backups for disaster recovery. Backups roll off on a 30-day cycle.

What we set: A session cookie when you’re signed in (required for the app to work), and that’s the entire list. No advertising cookies, no cross-site tracking pixels, no Facebook Pixel, no Google Analytics on the app side.

The marketing site (get.wristbook.io) uses Google Analytics and the Meta (Facebook) Pixel to understand traffic and measure our advertising. These set cookies and share site activity with Google and Meta.

Our own site stats: the marketing site also counts page views and button clicks itself, with no cookie. To count a visitor once a day, we keep a one-way scrambled code made from your IP address and browser (the IP address itself is never stored), and the code changes every day. If you accept the cookie banner, we also keep a random ID in your browser so we can see how visits connect over time. None of it is shared with anyone, and it’s only used to improve the site.

You’re in control: those tools load only if you accept the cookie banner. Decline and neither one runs. Either way, they stay on the marketing site — never inside the signed-in app.

WristBook is a business tool for licensed dealers and is not directed at anyone under 16. We don’t knowingly collect data from minors. If you believe we have, email us and we will delete it promptly.

When we change something material — adding a sub-processor, changing how we use data — we’ll email account holders at least 30 days before it takes effect, and update the “last updated” date at the bottom of this page. Cosmetic edits (typos, formatting) we’ll just push.

Privacy or data questions: support@wristbook.io. We answer within 2 business days, faster for anything urgent.

Security issues specifically: see /security for our disclosure process.