Privacy Policy

Who we are

Collecteur is an app for cataloguing, valuing and selling collectibles, operated by Zero Knowledge GmbH, c/o Benedikt Schuppli, Stauffacherstrasse 163, 8004 Zürich, Switzerland (“we”). This policy explains what personal data the Collecteur iOS app and the collecteur web showroom process, and why.

Data we process

Account. How you sign in decides what we receive: your phone number (we send a one-time code by SMS through Twilio, our SMS provider), or your e-mail address (the code is sent through Brevo, our e-mail provider), or — with Sign in with Apple or Sign in with Google — the name and e-mail address they share with us (with Apple this can be a private relay address) and their account identifier. Plus a technical user ID. We never see or store a password.

Your collection. The photos you take, the item details, values, notes, documents, projects and contacts you save. Stored in the European Union on Supabase infrastructure.

Your iPhone contacts. Only when you tap Import from iPhone does the app read your address book — on the device, after its own explanation and Apple's permission — to show you a list of people you can choose from. Nothing is added to your collection until you tick the people you want and confirm. Looking one person up, on the add form or when enriching a contact, uses Apple's contact picker: you choose one card, the app receives that card and nothing else, and no permission is needed. From a card you accept it takes the details you already have: email, phone number, address, birthday, photo and profile links. Only the fields you save are stored, marked as coming from your iPhone, and you can change or remove every one of them. Nothing is read in the background, and you can withdraw the access at any time in iOS Settings.

Your Gmail mailbox. Only if you connect one — on the website; the iOS app does not offer it in version 1.0 — and only for a contact you pick yourself, does Collecteur look into your mail. It searches for the threads exchanged with that person's own e-mail address and nothing else. From them it takes the signature block at the foot of their most recent message, the date of the first and the last message, how many threads there are, and the subject lines. Those extracts are sent to Anthropic, our AI provider acting on our instructions, to read the signature and write two sentences about how you know each other. We propose the result to you and store nothing until you accept it. We never store the text of a message: what is kept is the fields you accept, the two sentences, and the identifier, date and subject of a few messages as evidence for what was proposed. Your Gmail access tokens are encrypted on our servers, are never sent to the app or to anyone else, and are used for nothing but the checks you ask for. Disconnecting in the app withdraws the access at Google and deletes the tokens; you can also withdraw it yourself at any time under your Google account's third-party access. Collecteur's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements: this data is never used to train models and is never read by our staff.

Files on your device. Only after you choose a folder while enriching a contact — and from then on each time you enrich a contact, until you forget the folder in Settings — does Collecteur look through files, and only inside that folder. In the app the folder is chosen in Apple's folder picker; on the website, in your browser's own folder dialog. Collecteur reads the files on your device and looks for the name, e-mail addresses and phone numbers of the one person you are enriching. Pictures and scans are matched by their file name only; their content is not read. Contact cards (.vcf) that name the person are read on your device, and nothing from them is sent to our AI provider. From other files that mention the person, Collecteur takes only short passages — at most about 600 characters around each mention and 24,000 characters per search (a very short file can fit whole), never a file's name — removes what looks like a password, an access key or a bank account number, and sends them to Anthropic, our AI provider acting on our instructions, to pick out details such as a job title, a company, an address or a phone number. The passages are not stored on our servers. We propose the result to you and store nothing until you accept it: what is kept is the fields you accept, each marked as coming from your files, and any file you tick to attach to the contact, which is then stored like any other document. The app does not read files that are not on your device. On the website, on a computer whose files are kept in iCloud Drive or another cloud service, reading a file that is not on the computer can make the computer download it. The app remembers the folder you chose on that device only, and a browser that can remember it does so in that browser only; you can forget it at any time in Settings. Nothing is searched in the background: a search runs only while you are enriching a contact. This is a website feature at present: the iOS app in version 1.0 does not read files.

AI processing. Only after you allow it in the app — it asks the first time something would be sent, and Settings › AI processing is where you turn it off again — does Collecteur send data to our AI providers: the photos you take or pick and the business cards you scan; the notes you dictate about a contact, as text; the search you type or dictate, together with the names and descriptions of your items; the files you import; and, when you enrich a contact, the details you saved about that person. The providers are Anthropic (Claude: identifying the object, estimating a value, writing the description, reading business cards, summarising dictated notes and searching your catalogue) and Replicate, which runs the image models we use — from Google and Bria — to cut the object out, create the clean AI picture shown as the cover, polish contact portraits and upscale images. Your own photos are kept unchanged. The providers process the data on our instructions, only to return the result to you; the results are stored with your item or contact, where you can change or delete them. Withdrawing the permission under Settings › AI processing stops every further send.

Selling on eBay. If you connect an eBay account, we store the eBay access tokens encrypted on our servers and send your listing data (item details, photos, price) to eBay when you publish. The tokens never leave our servers, and we can disconnect the link at any time on your request — or you can, in the app.

Subscriptions. Purchases run through Apple’s App Store; we receive only your subscription status (via RevenueCat), never payment details.

Crash reports. If the app crashes, a technical report is sent to Sentry (EU ingestion). Reports carry your user ID only — emails, phone numbers and IP addresses are stripped before sending.

Usage analytics. We measure how the app’s features are used via PostHog (EU Cloud) — events like “photo captured” or “item published”, tied to your user ID, so we can improve the product. No advertising, no sale of data, ever.

Public showrooms

Your collection is private by default. Only if you set your profile to public does your showroom page (collecteur.ai/yourname) show your public items — name, category and cutout image. Values and contacts are never shown publicly.

Legal bases

We process your data to provide the service you signed up for (contract), to keep it secure and improve it (legitimate interest), and where required with your consent (e.g. connecting eBay). We are not in the business of selling or renting personal data.

Internal review. Our staff review account-level usage — the AI jobs run, sign-ins, subscription status and app opens — to operate the service, control its costs and prevent abuse (legitimate interest). Staff see counts and dates, not the contents of your collection; your e-mail address and phone number are masked, and every time a member of staff opens an individual account's record or unmasks those details, that access is logged.

Service providers

We share personal data only with the providers named in this policy — Supabase (hosting, EU), Vercel (servers), Anthropic, Replicate and the model providers it runs (Google, Bria), Twilio, Brevo, RevenueCat, Sentry, PostHog, Apple, Google and eBay — only as far as each needs it to provide its part of the service, and under written agreements that require them to protect it at least as well as this policy does (the same or equal protection the App Store guidelines require) and to use it only on our instructions. Where a provider processes data outside Switzerland or the EEA, standard contractual clauses or an adequacy decision apply.

Retention & deletion

Your data stays as long as your account exists. In the app you can at any time export everything (Settings → Export — a download link valid for 7 days) or delete your account (Settings → Delete account), which permanently removes your photos, items, documents, contacts and account data from our systems.

A connected mailbox is part of that. Deleting your account revokes the Gmail access at Google and removes the encrypted tokens along with everything a mail check ever proposed or you ever accepted.

You can withdraw a consent at any time where you gave it: AI processing in the app under Settings › AI processing, your iPhone contacts in iOS Settings, a connected mailbox or a chosen folder in Settings. What was processed before stays as it is until you change or delete it.

Your rights

Under the GDPR and Swiss data protection law you have the right to access, correct, export, restrict and delete your personal data, and to lodge a complaint with a supervisory authority. The fastest path for access, export and deletion is built into the app itself (Settings); for anything else, contact us.

Contact

Zero Knowledge GmbH — support@unrot.io. We answer privacy requests within 30 days.