Privacy Policy

This Privacy Policy describes what information JewelersBid collects, how it is used, who can access it, and the choices you have. It is written to describe this platform's actual current implementation, not a generic template.

1. Information we collect

• Account and authentication information. Customers sign in with a one-time email code (no password is created or stored for customers). Jewelers sign up with an email address and password, and provide business name, address, phone number, years in business, and optional license or registration information.
• Sell request details. Jewelry category, metal, purity, markings, stones, approximate weight, condition, ZIP code, timing, and any written description you provide.
• Private photos and video. The photos, video, and any certificate/receipt image you upload for a request.
• Offers, messages, and completion records. Offers submitted by jewelers, messages exchanged once you select a jeweler, and any completion record the founder records after confirming an in-person sale occurred.
• Basic usage information such as when a request was created, updated, or submitted.

We do not ask for or store more personal information than the above for the purpose of operating the marketplace itself. Separately, as described in Section 4 below, our hosting, authentication, and email service providers may process ordinary technical information needed to run and secure the platform — such as IP address, device or browser information, cookies, and security or delivery logs — as part of providing their service to us. JewelersBid does not currently use analytics or advertising tracking, and does not sell your information.

2. How this information is used

To operate the marketplace: creating and displaying your request to eligible jewelers, letting jewelers submit sealed offers, letting you compare offers and message a jeweler you select, sending the account and transaction email notifications described below, and letting the founder review jeweler applications and record completed transactions.

3. Who can access your information

Access is enforced in the database itself (row-level security), not only by what a page happens to show — the same rule applies however the data is requested. Specifically, as actually implemented today:

• Your own request and its private photos/video are visible to you, the submitting customer, for as long as they remain retained under the Media Retention Policy — media for an abandoned draft, for example, is deleted after a period of inactivity, as that policy explains.
• Approved jewelers can see a sell request's details and private media once it is open for offers. JewelersBid does not currently filter which jewelers see a request by geography or ZIP code — every approved jeweler can see every open sell request, the same way, regardless of location. A future version of the platform may add geographic matching; this policy will be updated if and when that is actually built, and will not claim it before then.
• Sealed offers are visible only to the jeweler who submitted that specific offer and to you (the customer). You can view offers as they arrive. “Sealed” means jewelers cannot see another jeweler's offer, amount, or the current high offer at any time.
• Messages in a request's conversation are visible only to you and the one jeweler whose offer you selected — never to a different jeweler who also offered on the same request.
• The founder, as the platform operator, can access account and request data through the underlying database administration tools, for purposes such as approving jewelers, investigating a complaint, providing support, recording a confirmed completion, and complying with legal obligations.
• Photos and video are never made public and are never given a permanent link. They are stored in a private file storage bucket, and JewelersBid only ever issues a short-lived, expiring signed URL after the access check above confirms the requester is currently authorized. A signed URL works as a temporary bearer link, though — like a link to an unlisted file — meaning anyone who obtains a valid, not-yet-expired signed URL could potentially use it before it expires, regardless of who they are. JewelersBid does not intentionally publish, post, or share these URLs anywhere, and you should never copy, forward, or post a signed media URL yourself. This is not a claim that a signed URL is impossible to misuse if it leaks — only that it is private, temporary, and never a permanent or public link.

4. Service providers

We use a small number of service providers to operate JewelersBid. Each processes information only as needed to provide its service to us:

• Supabase — database, authentication, and private file storage.
• Netlify — website hosting.
• Resend — sending sign-in codes and account/transaction email notifications.
• Metals.Dev — supplies gold/silver spot prices; this integration does not receive any personal or request information from us.

5. Email notifications

JewelersBid sends a small number of transactional emails: a sign-in code, a notice to eligible jewelers that a new sell request is open, a notice to a customer that a new offer arrived (without putting the offer amount or private request details in the email itself), and a notice when a new message arrives in a conversation. These emails link back to the relevant page and require signing in to view any details — the email itself never contains an offer amount, message content, or other private information.

6. Security limitations

We take reasonable technical measures to protect your information, including database-level access rules and private, signed-URL-only file storage. No system is completely secure, and we cannot guarantee that information will never be accessed, disclosed, altered, or destroyed by a breach of any of our physical, technical, or managerial safeguards. We do not claim a specific security certification or compliance standard beyond what is described in this policy.

7. Retention and deletion

See the Media Retention Policy for exactly when private photos/video are deleted. In short: media for an abandoned draft request is deleted after a period of inactivity; media for a request that reached a real business record (submitted, closed, or otherwise decided) is not currently auto-deleted, pending further legal review of applicable recordkeeping requirements. Deleting media never deletes the underlying request, offer, or completion record itself.

8. Your choices

You can review and update your jeweler business profile if you are an approved jeweler. You can decline to submit a request at any time before submitting it. Because a submitted request is a real business record shared with jewelers who may already be relying on it, it cannot be edited or withdrawn from within the product once submitted — contact us using the details below if you believe a submitted request needs to be corrected or removed.

9. Contact

Questions about this Privacy Policy, or a request related to your information, can be sent through the Contact page.

10. Changes to this policy

We may update this Privacy Policy as the platform develops. The “Last updated” date above reflects the most recent change.