Privacy policy

Bullion Prices exists to hold sensitive family information, so this policy is written to be read, and the product is built to store as little as possible.

The calculators store nothing

Everything you type into the public calculators (gold pieces, family structure, percentages) is processed in your browser and never sent to our servers. Leave the page and it's gone.

What the register stores

  • Account: your email address, used only for sign-in links. No passwords are stored; sign-in tokens are hashed, single-use, and expire after 15 minutes.
  • Holdings you choose to record:type, weight, unit, purity, an optional label, optional location note and optional free-text notes. The location field is optional by design — we recommend general notes ("bank locker") over exact addresses.
  • Beneficiaries you choose to record: a name, an optional relationship, and a percentage.
  • Your family structure, if you save it: the counts you enter in the inheritance calculator (spouse, children, parents, siblings) — no names — so the calculator can prefill for you. Saved only when you click save; included in your export; deleted with your account.
  • Price alerts: if you set one, we store the email address and the alert itself (metal, currency, threshold). Alerts are inactive until you confirm by email, and unconfirmed alerts are deleted within 48 hours.

We never put holdings or beneficiary details in emails. We don't sell or share your data with anyone. There is no advertising and no cross-site tracking; basic anonymous page analytics keep the site running well.

Your rights (GDPR)

  • Export: download everything we hold about you as a JSON file from your register, any time.
  • Deletion: delete your account from the register — it immediately and permanently removes your account, holdings, beneficiaries and sign-in tokens. No retention period, no soft delete.
  • Contact: for anything else (access, correction, complaints), write to hello@bullion-prices.com. You may also complain to your local data protection authority.

Data is processed to provide the service you signed up for (GDPR Art. 6(1)(b)). The data controller is the site operator, based in the EEA; infrastructure runs on Vercel (Frankfurt region) with a managed Postgres database. Expired sign-in tokens are purged automatically.