Privacy Policy

1. Information We Collect

We collect only the information you provide directly to us. This includes:

Account information: Your email address and a hashed (encrypted) version of your password. We never store your password in plain text.

Profile information (optional): Your legal name and insurance policy number, used solely to populate your insurance appraisal PDF documents. These fields are entirely optional.

Collection data: Information about knives in your collection, including maker, model, blade specifications, purchase details, current value, condition notes, storage location, and audit history.

Uploaded files: Photos of your knives and receipt or documentation images and PDFs you upload for insurance documentation purposes. When you upload a photo, we automatically strip embedded metadata (EXIF), including any GPS location data, before storing it. We also generate a small thumbnail copy of each photo for display purposes.

Two-factor authentication data (optional): If you enable 2FA, we store a TOTP secret and hashed recovery codes associated with your account.

Email preferences: If you opt in to periodic collection reminder emails, we store your chosen frequency (monthly, quarterly, or annually) and the date a reminder was last sent.

Payment information: If you purchase a paid plan, payment is handled by Stripe (see Section 4). We do not collect or store your card number. We store only what we need to manage your subscription, such as your plan, billing status, and a Stripe customer reference.

2. Cookies and Analytics

We use only first-party, functional cookies. Specifically:

Session cookie: Set when you log in to keep you authenticated. It expires after 30 minutes of inactivity.

Security (CSRF) token: Used to protect forms against cross-site request forgery attacks.

We do not use advertising cookies, tracking cookies, or any third-party cookies, and we do not respond to or need "cookie consent" advertising choices because there is nothing to opt out of.

Analytics: We measure page usage with our own server-side counter, hosted entirely on our own infrastructure. For each page visit, we record the page visited, the time of the visit, and, when you are signed in, which account made the visit, so we can understand which features are being used. We do not record your IP address. We do not use Google Analytics or any third-party analytics or tracking service, and no analytics data leaves our infrastructure.

Do Not Track and Global Privacy Control. SteelFolio does not track you across other websites or over time, so it has nothing to disclose in response to a Do Not Track or Global Privacy Control browser signal. Any such signal is consistent with how the Service already works, with no cross-site tracking and no sale of your information.

3. How We Use Your Information

We use the information you provide solely to operate and improve SteelFolio. Specifically:

• To authenticate your account and maintain your session
• To store and display your knife collection data
• To generate insurance appraisal PDFs and export files on your request
• To send transactional emails you initiate, such as password reset links
• To send periodic collection reminder emails, if and only if you opt in, at the frequency you choose (you can change or disable this at any time in Settings)
• To process subscription payments and send billing-related notices
• To send product updates, announcements, and collecting-related information through our mailing list, if and only if you separately opt in; you can unsubscribe at any time using the link in any such email
• To understand aggregate usage of the Service through our own server-side page counts

We do not use your data for advertising, profiling, or any purpose beyond providing the SteelFolio service to you. We do not train AI models on your data.

4. Service Providers

We share data only with the service providers needed to run SteelFolio, and only the minimum each requires:

Hosting — Render.com: Your database records and uploaded files are stored on servers provided by Render, a cloud hosting provider based in the United States, on a persistent encrypted disk. Render's privacy practices are described at render.com/privacy.

Transactional email — Resend: Emails such as password resets, account notices, and opt-in reminders are sent via Resend from hello@steelfolio.app. Resend processes your email address in order to deliver these messages. Resend's privacy practices are described at resend.com/legal/privacy-policy.

Payments — Stripe: Subscription payments are processed by Stripe. Your card details are entered directly with Stripe and never touch our servers. Stripe processes your payment information under its own privacy policy, described at stripe.com/privacy. Stripe also sends billing-related emails such as receipts.

Mailing list — Brevo: If you opt in to the SteelFolio mailing list, your email address and basic engagement data, such as opens and clicks, are processed by Brevo to deliver those messages. SteelFolio uses the mailing list only for its own updates and information about the Service, such as new features, changes to these policies, and knife-collecting, collection-management, and insurance topics. SteelFolio does not send third-party advertising, does not sell or rent your address, and Brevo does not use your information for its own marketing. You can unsubscribe from mailing-list emails at any time without affecting account, billing, or security messages.

We do not sell, rent, trade, or share your personal information with any third party for marketing or commercial purposes. Your collection data is private to your account. We do not share your data with insurers, appraisers, or any other party. The only circumstances under which we would disclose your information are if required to do so by law or legal process, or as part of a merger or sale of the business (in which case this policy would continue to apply to previously collected data).

Community Data Contributions (Optional)

SteelFolio offers optional features that let you contribute certain information to community datasets shared with other users. One example is a sale price you observed in the marketplace, which appears to other users under your username or a display alias you choose. Another, which you turn on in Settings and which is off by default, lets you contribute information from your own collection records, such as purchase price, purchase date, purchase source, and item characteristics like maker, model, and materials.

Contribution features work only after you opt in. Contributed collection data is used and shown only in aggregated or de-identified form, and it never includes your name, email address, photographs, or documents. You may withdraw your consent at any time in Settings. Withdrawal stops the use of your data in future aggregations, but statistics already derived from de-identified, aggregated data may be kept. De-identified and aggregated data that does not identify you may be kept and used by SteelFolio, including after you delete your account, to provide and improve the Service and features built on that data.

5. Your Rights

You have the right to access, correct, export, or delete your data at any time.

Access and export: You can export your full collection data and files at any time, on any plan and at no charge, using the backup feature in the application. Data portability is a standing commitment — we will never hold your data hostage.

Correction: You can edit any information in your account or collection at any time.

Deletion: You can delete your account directly from the Settings page. Account deletion is immediate and permanent — it removes your user account, all collection data, uploaded photos, receipts, condition audits, feedback submissions, and market comp entries. Uploaded files are also removed from our servers. You may also request deletion by contacting us at the address below. Data you contributed to community datasets in de-identified, aggregated form is not tied to your account and may remain after deletion, as described under Community Data Contributions.

We recommend exporting a backup of your collection data before deleting your account, as this action cannot be undone.

SteelFolio serves users in the United States. Depending on your state, you may have additional rights under state privacy law, described below. To exercise any right, use the in-app tools or contact us at hello@steelfolio.app.

Your State Privacy Rights

If you live in California, Virginia, Colorado, Connecticut, Texas, or Utah, your state gives you privacy rights. SteelFolio honors these rights for every user, wherever you live.

You may ask SteelFolio to confirm whether it holds personal information about you and give you access to it, correct information that is wrong, delete your information, and provide a portable copy of the information you gave us. You may also opt out of the sale of personal information, targeted advertising, and profiling. SteelFolio does not sell personal information, does not use it for targeted advertising, and does not profile you, so there is nothing to opt out of, but the right is stated here for completeness.

SteelFolio does not use or disclose sensitive personal information, such as account credentials, for advertising or profiling. It collects that information only to run the Service.

To make a request, use the in-app tools or email hello@steelfolio.app. SteelFolio verifies your request through your account login or by confirming information already on file. You may use an authorized agent, and SteelFolio may ask the agent to show written permission. SteelFolio responds within 45 days and may extend once when reasonably needed, with notice to you.

SteelFolio will not deny service, charge a different price, or provide a lesser experience because you exercised a privacy right. If SteelFolio denies a request, you may appeal by replying to the decision or emailing hello@steelfolio.app. If you live in Colorado, Connecticut, or Virginia and the appeal does not satisfy you, you may contact your state attorney general.

6. Data Retention and Backups

We retain your data for as long as your account is active. When you delete your account, your personal information, collection data, and uploaded files are removed from our systems immediately.

As a commercially reasonable measure to protect against data loss, we maintain automated daily backups of the Service's database in Cloudflare R2, an encrypted, off-platform cloud storage service separate from our primary hosting provider (Render). Backups are retained on a rolling schedule of up to 30 daily snapshots and up to 12 monthly snapshots, after which they are automatically deleted. To guard against tampering or improper deletion — including by us — backups are protected by object-lock rules that make each snapshot immutable for its retention period. This means that when you delete your account, your information is removed from our live systems immediately, but may continue to exist in encrypted, immutable backup copies for up to approximately 12 months before being automatically purged. Uploaded files (photos, receipts, and certificates of authenticity) are stored in a separate private, encrypted storage bucket and are served to you only through short-lived authenticated links. Backups are used solely for disaster recovery and are never used to restore data you have chosen to delete. We have tested our restore process end to end. These measures reduce the risk of data loss, but we do not guarantee against all possible loss, and backups are not a substitute for your own copy of your data — you can export your complete collection and files at any time, at no charge, on every plan, using the built-in export feature (see Section 5).

7. Security

We take reasonable measures to protect your information, including password hashing, HTTPS encryption in transit, session timeouts, CSRF protection, rate limiting, optional two-factor authentication, and stripping of location metadata from uploaded photos. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we learn of a breach affecting your personal information, we will notify you as required by applicable law.

8. Children's Privacy

SteelFolio is intended for adults. The Terms of Service require every user to be at least 18 years old, and the Service is not directed to children. SteelFolio does not knowingly collect personal information from any child under 13. It does not create accounts for children, does not target children in its design or marketing, and does not ask for a child's information. If SteelFolio learns that it has collected personal information from a child under 13, it will delete that information promptly and close any related account. A parent or guardian who believes a child under 13 has given SteelFolio personal information may contact hello@steelfolio.app to have it removed.

9. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you by email or in-app notice at least 30 days before they take effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy. If you do not agree, stop using the Service and, if you wish, delete your account.

10. Contact Us

If you have questions about this Privacy Policy, wish to exercise any of the rights described in Section 5, or want to report a concern, contact us at hello@steelfolio.app.