IsItGOLD? Privacy Policy

This privacy policy outlines how IsItGOLD? ("we", "us") collects, uses, and protects your data.

Information We Collect

Contact Information: Email address, first and last name.
App Usage Data: Scan history and purchase history.
Device Identifiers: Device IDs may be collected for analytics, advertising, and fraud prevention.
Advertising Data (Appodeal): Ad performance data, approximate location (if enabled), and interaction with ads may be collected by our advertising partners.

How We Use Your Information

App Functionality: To provide core features of the app.
Analysis & Improvement: To understand usage patterns and enhance the app experience.
Personalization: To tailor content, ads, or offers (if applicable).
Support: To assist with troubleshooting or inquiries.
Advertising: To display relevant ads through Appodeal and its partners.

Third-Party Providers

We work with the following third-party providers, which may process your data:

Firebase: Cloud services (database, analytics, storage)
RevenueCat: Subscription management and one-time payments
OpenAI: AI-powered features
Appodeal: Display of advertisements, analytics, and ad personalization
Resend: Delivery of emails, such as confirmation emails

Appodeal and its partners may collect:

Advertising identifiers (e.g., Google Advertising ID)
IP address and device information
App interactions and usage data
Location data (if enabled by the user)

Appodeal may use this data to provide personalized or non-personalized ads, measure ad effectiveness, and prevent fraud.

For more details, please review:
Appodeal Privacy Policy
How Appodeal works with partners

Marketplace Waitlist

If you join the waitlist for our upcoming marketplace, we store your email address, country and ZIP code, the time you joined and the wording you agreed to. We use them only to tell you when the marketplace opens in your area.

You enter the email address yourself, and we send it a link to confirm it. You are added only after you confirm, and submitting the address is your agreement to this policy.
The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by writing to isitgold@marvinbuth.dev, and we will delete your entry.
We keep your entry until we have told you that the marketplace is open in your area, or until you withdraw your consent.

Website Language

Our website, isit.gold, is available in the same languages as the app.

Country lookup: On your first visit, our hosting provider (Vercel) tells the website which country your connection comes from, based on your IP address. Together with the languages your browser says you prefer, we use it once to suggest a language. We do not store or log it.
Language cookie: When you choose a language, in the dialog on your first visit or with the language switch, the website stores a cookie named NEXT_LOCALE. It contains only the code of the language you chose (for example "de"), is used only to show you the website in that language on later visits, and expires after one year. It is set only when you choose a language. You can change it at any time with the language switch, or delete it in your browser settings.
The cookie is strictly necessary to give you the language you asked for, so it does not require consent (§ 25(2) no. 2 TDDDG). The legal basis for the country lookup is our legitimate interest in showing you the website in a language you understand (Art. 6(1)(f) GDPR).

When you use our web app at app.isit.gold, including the free Value Checker, a banner at the bottom of the screen asks whether we may measure your visit with cookies. It appears on every page as soon as you arrive. Accept and Decline are the same size and side by side, nothing is preselected, and the web app works the same whether you accept, decline or ignore the banner.

Before you choose, and if you decline: we do not use Google Analytics or Google Ads measurement. Nothing is sent to Google measurement services and no measurement cookies are set.
If you accept: the web app uses Google Analytics (Firebase) and Google Ads to see how visitors use IsItGOLD? and which ad brought them here. Google sets cookies on your device (such as _ga and _gcl_au) and receives usage data: the steps you take in the Value Checker (for example opening the page, adding a photo, a finished or failed check, creating an account, signing up for the newsletter or the marketplace waitlist, opening the app), the result of your check (verdict, metal and confidence), the ID of your check, your user ID in our app (a random ID that guests have too), the country you choose for the marketplace waitlist, the campaign parameters of the link you came from (utm_source, utm_medium, utm_campaign, utm_content), the platform, and the technical data every request to Google carries, such as your IP address and browser details. If you accept after you have opened the Value Checker, the opening of the page is sent to Google at that moment. We do not send your email address, name, photo or ZIP code to Google for this.
Google Consent Mode: all four signals (analytics storage, ad storage, ad user data and ad personalization) are denied until you accept, and denied again when you withdraw.
Your choice: it is stored in your browser, only on this device, with the time and the version of the banner text. You can change it at any time with Cookie settings on the start page of the Value Checker, in its account step or under Profile > Legal, which shows the banner again and stops the measurement. Clearing the site data of your browser also resets it.
Legal basis: your consent (§ 25(1) TDDDG and Art. 6(1)(a) GDPR). Withdrawing it does not affect what was processed before.
Campaign parameters on our servers: if you open the Value Checker through one of our ads, the parameters of the link (utm_source, utm_medium, utm_campaign, utm_content, utm_term, ref), the page you landed on and the website you came from are also saved with your check and, if you create an account, with your account, so that we can tell which ad led to it. This does not depend on your choice in the banner.
Meta Pixel: if you accept, the web app also uses the Meta Pixel, described in the next section.
The mobile apps are described in the sections above.

If you accept the banner in our web app at app.isit.gold, the web app also uses the Meta Pixel of Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland ("Meta"). We use it to measure and improve our ads on Facebook and Instagram: to see whether people who saw or clicked one of our ads go on to use the Value Checker, and to show our ads to people who are more likely to be interested.

Before you choose, and if you decline: the Meta Pixel is not loaded. Nothing is loaded from Meta, nothing is sent to Meta and no Meta cookies are set.
If you accept: the web app loads the Meta Pixel from Meta (connect.facebook.net) and sends Meta these events: viewing a page of the web app (once each time the page is loaded, or at the moment you accept if the page is already open), starting a check in the Value Checker, adding a photo, sending the check, a finished check, and creating an account. With each event we send only the name of the event, the language of the page and the campaign parameters of the link you came from (utm_source, utm_campaign, utm_content). Like every request to Meta, it also carries the address of the page, including the parameters in it (such as campaign parameters, or a click ID that Meta adds to links from its ads), your IP address, and details of your browser and device, which Meta processes.
Cookies: Meta sets the cookie _fbp on your device, which according to Meta is kept for up to 90 days, and, if you came from a link in a Meta ad, the cookie _fbc with the click ID of that ad.
What we do not send to Meta: no email address, name, phone number, photo, result of your check, ID of your check or user ID. We do not use the "advanced matching" of Meta, the automatic event setup of the Meta Pixel is switched off, and nothing is sent to Meta from our servers.
Joint controllership: we and Meta are jointly responsible (Art. 26 GDPR) for collecting the data with the Meta Pixel and transmitting it to Meta. The agreement between us is the Meta Controller Addendum (Meta Controller Addendum). What Meta does with the data after it has received it is the responsibility of Meta alone (Meta Privacy Policy). You can exercise your rights regarding the joint processing with us or with Meta.
Transfer to the USA: Meta may transfer the data to Meta Platforms, Inc. in the USA. The transfer is based on the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR).
Legal basis: your consent (§ 25(1) TDDDG and Art. 6(1)(a) GDPR). Withdrawing it does not affect what was processed before.
Withdrawing: you can withdraw your consent at any time with Cookie settings on the start page of the Value Checker, in its account step or under Profile > Legal. The web app then tells the Meta Pixel to stop, sends nothing more to Meta and deletes the cookies _fbp and _fbc. Clearing the site data of your browser also resets your choice.
The mobile apps do not use the Meta Pixel or any other Meta software.

Web App: Anonymous Step Counting

To know how many visitors from our ads actually reach the Value Checker and how far they get, the web app counts some steps of the Value Checker for every visitor, whether you accept, decline or ignore the banner. This counting uses no cookies and is separate from Google Analytics and Google Ads.

What is counted: opening the Value Checker (once when the page starts loading and once when it has loaded), starting a check, adding a photo, sending the check, a finished or a failed check, viewing the result, and creating an account. Each step is counted at most once each time the page is loaded.
What is sent for each step: the name of the step, the campaign parameters of the link you came from (utm_source, utm_medium, utm_campaign, utm_content, or "none" if the link had none), the language of the page (German, English or other), and whether you have accepted the banner, declined it or not answered it yet (when the page starts loading this is not known yet, because nothing is read from your device, and is sent as "unknown").
What it does not contain: no user ID, no ID of your check, no click ID from an ad (such as gclid), no result of your check, no screen size, no time zone and no referring website. No login information and no cookies are sent with it.
Nothing on your device: no cookies are set, and nothing is stored on your device or read from it for this counting.
What we keep: our server only adds one to a daily total for each step, date, set of campaign parameters, language and answer to the banner. Like every request on the internet, the request technically carries your IP address and the usual details your browser adds (such as its name and version); the counting code does not use or store them. We keep no record of individual visits, so the totals do not identify you.
Where: Google Firebase (Cloud Functions and Cloud Firestore), in the EU region europe-central2. The totals are not passed on to Google Analytics, Google Ads or anyone else.
How long: each daily total is kept for 30 days after its day and is then deleted automatically.
Technical request logs: our hosting provider Google Cloud keeps technical logs of requests to the counting service to run and secure it. Like any server log, they include the IP address. We do not use them for counting or analysis, and they are deleted automatically when the retention period set in Google Cloud Logging ends.

Your Rights

Depending on your jurisdiction, you may have rights to access, correct, restrict, or delete your data. You may also:

Opt out of personalized ads by adjusting your device settings (Google/Android: Settings > Google > Ads > Opt out of Ads Personalization, iOS: Settings > Privacy > Tracking).
Contact us at isitgold@marvinbuth.dev for data requests.

Security

We and every third-party service we use implement measures to protect your information. These include, but are not limited to:

Hashing
Encryption
Anonymizing requests

Children

The app is not intended for children under 13 (or the applicable age in your region).
We do not knowingly collect personal information from children. If we learn we have collected such information, we will delete it promptly.

Policy Updates

We may revise this policy, with notice provided on our website or within the app.

We comply with applicable privacy regulations, including the General Data Protection Regulation (GDPR) for users in the European Union and the California Consumer Privacy Act (CCPA) for users in California.

GDPR: EU users have the right to access, rectify, delete, and restrict the processing of their personal data. You may also request a copy of your data or object to certain processing activities.
CCPA: California residents may request disclosure of what personal information we collect, request deletion of their personal information, and opt out of the sale or sharing of personal data.

To exercise these rights, please contact us at isitgold@marvinbuth.dev. We will respond to your request in accordance with applicable law.

Contact Us

For questions or concerns, please reach us at:
isitgold@marvinbuth.dev

Privacy policy