Privacy Policy

Effective October 21, 2026 · Version 2026-10-21

This policy explains what Kilito Coins & Collectibles (“Kilito,” “we”) collects when you use app.kilito.app, how we use it, and your choices.

What we collect

• Account info: your name, email address, password (stored encrypted by our authentication provider; we never see it), and 2-step login settings.
• Your inventory data: items, photos, costs, prices, notes, sales records, labels and workspace settings you enter.
• Team info: the email addresses you invite and each member's role.
• Technical data: basic logs such as IP address, browser type and timestamps, used for security and troubleshooting.
• Payment info (if you subscribe): handled by our payment processor; we don't store full card numbers.

How we use it

• To run the Service: store and show your inventory, send sign-in, password-reset and invite emails, and keep your account secure.
• To support you when you contact us.
• To improve reliability and fix problems.

We do not sell your personal information or your inventory data, and we don't use it for advertising. Your inventory, photos, notes and sales records are visible only to members of your workspace. Purchase costs and profit are visible only to the workspace owner and members the owner allows. Other Kilito users can't see your workspace.

Shared market data. When you search for comparable sales, the public market results we find (for example eBay listings and published sale prices for a coin type and grade, such as "1921 Morgan Dollar, PCGS MS63") may be reused to price the same coin type for other Kilito users, and theirs for you. This shared data never includes your items, costs, notes, photos, cert or serial numbers, or who searched. Owners and admins can turn this off for a workspace in Settings → Shared market data.

Who processes data for us

We use trusted providers to run Kilito: Supabase (database, authentication, file storage, hosted in the United States), Cloudflare (website hosting, security), and Hostinger (email delivery).

When you use these features, the data needed for that request is sent to:

• AI entry and AI pricing research: Anthropic (AI provider): the photos, cert number, item details and any notes you add for that request. Under our agreement, Anthropic does not use this data to train its models.
• Find market price: PCGS (certification facts and auction records, using the cert number) and eBay (current listings, using the item title and details).
• Spot prices: gold-api.com. No personal or inventory data is sent.
• Payments (if you subscribe): our payment processor.

These providers may use your data only to provide their service to us. We may add pricing sources over time; we'll list them here.

Staff access

Kilito personnel may access your workspace only as needed to keep the Service running and secure, and to provide support to your workspace. For support, we access your workspace only with your consent at the time you ask for help.

Photo safety checks. To keep Kilito free of inappropriate content, new photos may be checked automatically (by our AI provider, Anthropic, under the same no-training terms) to confirm they don't contain content our Terms prohibit. A photo flagged by this check may be hidden and reviewed by Kilito staff. We don't use these checks for anything else.

Public QR cards

If a workspace owner turns on public QR cards, anyone who scans that workspace's labels can see the item's title, grade, certification number and asking price. Costs, notes and other private fields are never shown.

Security

Data is encrypted in transit, each workspace's data is isolated by database security rules, and you can turn on 2-step login. No system is perfectly secure, so please use a strong password. More detail is on our Security page.

Retention and your choices

• You can view, edit and export your inventory at any time.
• You can ask us to delete your account and data by emailing hello@kilitocoin.com. We delete it within 30 days, except records we must keep by law.
• Depending on where you live (for example California), you may have additional rights to access, correct or delete personal information. Email us to use them; we won't discriminate against you for doing so.

Children

Kilito is not intended for anyone under 18, and we don't knowingly collect their information.

Changes

We'll post updates here. If a change is significant, we'll tell you in the app or by email and ask you to accept the new version before you continue. We won't apply less protective practices to data we collected before the change without your consent.

Questions: hello@kilitocoin.com · Terms · Privacy · Security