Privacy policy
Last updated: October 11, 2026.
This policy explains how NexVant L.L.C. ("CoinLab," "we," or "us") handles information when you use the CoinLab iOS app or coinlab.online. We act as the service operator and, where applicable, the data controller.
How We Use Your Information
We use information to provide the feature you request, operate and secure CoinLab, and respond to you. Where applicable privacy law requires a legal basis, we rely on your consent for AI photo processing and any optional contribution, providing the service or account feature you request, legitimate interests in service security and abuse prevention, or legal obligations, as applicable. We do not sell personal information or use cross-app advertising tracking in the current app.
| Information and source | Purpose, choice and applicable basis |
|---|---|
Photos and scan requests | When you choose AI identification, the app sends the selected front and back item photos, item category (coin or banknote), and the instruction needed for recognition to CoinLab's server. The server forwards the request to the AI provider configured for that service: Anthropic Claude or Google Gemini. Only the configured provider receives that scan. This processing is based on your request and explicit AI-processing permission. Do not include faces, names, addresses, or other personal information. Photo data is processed to complete the scan. The current CoinLab server code does not write submitted photo files or request bodies to persistent CoinLab storage or application logs. AI providers may process or retain the request under their applicable terms, described below. Declining AI processing leaves local collection and guide features available. |
Collection, scan history and saved photos | Your collection, scan results and any photos you choose to keep are stored in the app on your device. Capture image files are excluded from iOS device backups; other app state may be included or restored according to your device backup settings. You can delete individual saved items or use Settings to delete local app data. |
Guide searches and value requests | When you browse the Guide or request an estimated reference range, the app sends the selected country, category and relevant item details (such as catalog ID, name, year, denomination or mint) to return matching information you request. Reference lookup results have a 24-hour cache validity window; expired cache entries may remain in memory until cleanup, as described below. |
Installation and technical data | A random installation identifier stored on your device and a signed recognition session (valid for 30 days) help issue scans, enforce per-install limits and prevent abuse. CoinLab's service also processes network information such as IP address and request metadata. We use these details for service operation and security, based on legitimate interests where applicable. Operational diagnostics may include a request ID, processing stage and time, selected provider/model, usage counts when returned, and safe error categories. Application logs do not include photo bytes, prompts or arbitrary provider error bodies. |
Optional CoinLab account | If you choose Sign in with Apple, CoinLab receives an Apple account subject identifier and authorization data needed to create and maintain your CoinLab account. The app does not request your name or email from Apple. CoinLab stores the Apple refresh credential encrypted and stores session-token hashes; the CoinLab account is separate from the Apple Account used for App Store purchases. |
Subscriptions and purchases | Apple processes App Store payments. CoinLab and RevenueCat use a random billing identifier, product and transaction information, and subscription status to synchronize purchases and verify access. Payment card details are handled by Apple and are not provided to CoinLab. Billing-session credentials are stored in the iOS Keychain. Coin photos are not sent to RevenueCat. |
Support and website visits | If you email us, we receive your email address, message and any attachments you choose to include so we can respond. The website may process IP address, browser/request information and access time to deliver and protect the site. The current website does not load analytics or advertising trackers. |
Optional photo samples and recognition improvement | CoinLab plans to offer a separate, optional program that may use contributed coin or banknote photos and related identification results to supplement reference samples and train, test or improve recognition. Permission to identify an item does not authorize this additional use. This program is not active in the current app implementation, which has no separate sample-contribution consent or collection feature. We will request a distinct in-app opt-in and explain the applicable retention and controls before starting this use. If source photos are later removed, that may not reverse changes already incorporated into a trained model. |
Third-Party Services
CoinLab shares information with a provider only when needed for the feature or transaction you request, to operate the service, or when required by law. The selected AI provider can change through service configuration; one provider, not both, receives an individual scan.
| Provider | Information shared and role |
|---|---|
Apple | Apple provides Sign in with Apple and the App Store payment and subscription flow. It processes sign-in authorization and purchase/transaction information under its own terms. CoinLab does not receive your payment card details. Apple Privacy Policy. |
RevenueCat | RevenueCat receives the random billing app-user identifier and purchase, product and subscription-status information used to synchronize transactions and verify entitlement. CoinLab does not send scan photos to RevenueCat. RevenueCat Privacy Policy. |
Anthropic Claude (when configured) | The configured Anthropic API receives the scan photos, coin/banknote category, recognition instructions and, when applicable, CoinLab guide reference images, to return an identification result. Anthropic handles API inputs under the terms applicable to the service account. Anthropic Privacy Policy. |
Google Gemini (when configured) | The configured Gemini API receives the scan photos, coin/banknote category, recognition instructions and, when applicable, CoinLab guide reference images, to return an identification result. Google's terms distinguish unpaid services, which may use submitted content and responses to improve or develop products and machine-learning technologies and may permit human review, from paid services, which state that prompts, images and responses are not used for product improvement but may be logged for a limited period for safety, security or legal purposes. Which terms apply depends on the project billing status. Review the Gemini API Additional Terms and Google Privacy Policy. |
Hosting and network service providers | Providers that host, relay or protect CoinLab's website and API may process connection metadata and, when necessary to relay a scan, the transmitted request content. They support service delivery, security and abuse prevention. |
Retention and Deletion
Photos saved in the app remain on your device until you delete them, delete the related history, or clear local app data. Photos submitted for a scan are not written to persistent CoinLab photo storage by the current service code; the AI provider's own retention is governed by its terms.
CoinLab's recognition-result and reference-valuation caches use a 24-hour reuse window. That is a validity period, not a promise of physical deletion within 24 hours. Expired in-memory entries may remain until a later matching request, capacity cleanup, or service restart removes them.
CoinLab account sessions expire after 30 days. When you delete an account, CoinLab removes the account and stored Apple authorization, and clears local app data. To make an interrupted deletion safely retryable, a hash of the former session token is retained as a deletion receipt for 31 days. It can be matched for that retry purpose and is not fully anonymous. The account service removes expired receipts at startup and in its periodic cleanup while running. Account deletion does not cancel an Apple subscription; cancel it separately through Apple.
Technical diagnostics and support messages are kept only as needed to operate the service, address support requests, protect CoinLab, and meet legal obligations. CoinLab does not currently publish a fixed application-level deletion period for operational logs. Apple, RevenueCat and AI providers may retain records under their own policies and legal obligations.
Your Choices and Privacy Rights
You can decline AI processing, withdraw permission in Settings to stop future photo uploads, delete saved photos or clear local app data, and delete an optional CoinLab account in Settings → Apple Account. Withdrawal cannot recall information already sent to an AI provider. Depending on where you live, you may also request access, correction, deletion, restriction, portability or object to certain processing. Contact support@coinlab.online; we may ask for information reasonably needed to verify your request.
Security and International Processing
CoinLab uses HTTPS for service requests and applies access controls, protected local storage and encrypted storage for Apple authorization credentials. No internet transmission or storage method can be guaranteed completely secure. CoinLab and its service providers may process information in countries other than yours, where privacy laws may differ. We use service providers to support the features described above.
Children
We do not knowingly collect personal information from children under 16. If you believe a child has provided personal information, contact support@coinlab.online so we can review the request.
Changes and Contact
We may update this policy when CoinLab's features or data practices change. We will post the revised policy here and provide additional notice or request new consent when required. For privacy questions or requests, contact support@coinlab.online.