Privacy Policy
This policy exists in Swedish, English and Brazilian Portuguese, with the same content. If you use Klenod in English, this version is the one that applies to you.
Who is responsible for your data?
The Klenod app is run by Spitakolus AB (Swedish Reg. no. 559554-6101), Svängrumsgatan 46, 421 71 Västra Frölunda, Sweden. We are the controller for the processing described here, under the EU General Data Protection Regulation (GDPR).
Contact: support@spitakolus.com
What data do we collect?
Account details
Email address, display name and password (the password is only stored in transformed form by our
sign-in service – we can never see it). We also store when your email address was confirmed and
which language you have chosen.
If you sign in with Apple or Google
If you choose Continue with Apple or Continue with Google, we receive your email address,
your name and a user ID from them. No password is created – Apple or Google checks that it is
you. We never receive the password you have with them, and we fetch nothing else: no contacts,
no calendar, no content from their services. We still ask for your birth year in the app,
because neither Apple nor Google shares it.
If you use Apple's Hide My Email, we receive a forwarding address ending in privaterelay.appleid.com instead of your real one. It works like any other address in the app, and we cannot see what is behind it. If you later choose to stop sharing it with Klenod, our emails will not get through – you will then need to change your address in the app.
Birth year
Only the year, to check the age limit (13, or 18 in Brazil). We never ask for your full date of birth or your
national ID number.
Profile
A short introduction, if you write one. Optional.
Your collection
The items you add: name, category, shelf, condition, quantity, variant and region, your note,
your own estimated value and what you paid, and the status In collection, For sale or
For trade. And the photos you upload yourself.
AI help when adding items
If you add an item by photographing it, the image is sent to Anthropic (an AI provider in the
USA), which extracts name, category, year, country, denomination, description and a search term.
The app shows that AI is reading the photo. You choose that way of adding yourself, and you
confirm or change the suggestion before anything is saved – nothing is saved automatically.
Push notifications
An anonymous notification ID for your device (push token), so that notifications reach the right
phone. Never the content of your messages.
Your watchlist
The items you're looking for. This is the list the matching engine compares against other
people's For sale and For trade items.
Clubs
Which clubs you belong to, threads and posts you write, and club suggestions you send in.
Contact with others
Your conversations and messages, your matches, whether you and the other person have confirmed
that the deal went through, and reviews you have written or received.
Safety
Reports you make (category and your description) and users you have blocked.
Klenod Plus, if you buy it
Payment is made through the App Store or Google Play — never through us. We therefore
never receive card numbers, bank details or your address, and we do not see what you paid.
The only thing we store on our side is: that your account has Plus, the date it is valid until,
and whether it comes from a purchase or from the founder gift. No purchase history, no
receipts, no amounts.
Notifications in the app
The notifications you receive in the app's notification center, and when you read them.
What we do not collect
No location, no tracking. Klenod never asks for location permission and does not read your phone's location. We never show where an item is – not the town, the address or the area. The only geographical information in the app is the region of an item, which means the release region (for example PAL or NTSC for a video game) and not where you live. Location data and other hidden information in your photos is removed on your phone before the image is uploaded or sent for AI reading.
We do not use advertising IDs, we do not track you in other apps or on websites, we show no ads and we never sell your data.
We never receive card numbers or bank details. If you buy Klenod Plus, payment goes through Apple or Google, using the payment methods you already have there. We only learn that the account has Plus and until when — never what you paid or how.
Why do we process the data?
- So that the app works – your account, your shelves, your watchlist, the matches, the clubs, the chat and the notifications. Legal basis: performance of a contract with you (GDPR Art. 6(1)(b)).
- Age check – the birth year and the country of your App Store or Google Play account are used to prevent accounts below the age limit (13, or 18 in Brazil). Legal basis: legal obligation and our legitimate interest in a safe service (Art. 6(1)(c) and (f)).
- Safety and moderation – handling reports and blocks, and preventing fraud and counterfeits. Legal basis: our legitimate interest in a safe community (Art. 6(1)(f)).
- AI help when adding items – when you add an item by photographing it. Legal basis: consent (Art. 6(1)(a)) – you choose that way yourself, and the app shows that AI reads the photo. If you don't want to use AI, you can add items in other ways.
- Klenod Plus – to know which accounts have Plus and until when, so that you get what you paid for and can restore the purchase on a new phone. Legal basis: performance of a contract with you (Art. 6(1)(b)).
- Keeping the app running – push notifications you have chosen to receive, and technical error reporting (see below). Legal basis: performance of a contract (push notifications) and our legitimate interest in a working service (error reporting) (Art. 6(1)(b) and (f)).
Who can see your data?
You decide what shows. Other signed-in collectors can see the photo, name and category of your items, and whether you are keeping, selling or trading each one. The value is never visible to anyone else: not the approximate valuation, not what you paid, and not your notes. You can make a whole shelf or a single item private whenever you like, and then only you can see it.
New items are visible to others by default, and the app tells you so when you add them. Items you added before this default changed stay private until you choose to show them. For accounts under 18, private is the default (in Brazil, Klenod is for ages 18 and up).
What else is visible to others is your display name, your profile picture and posts you write in a club. If you mark something as For sale or For trade, it can match someone else's watchlist – that person then learns that someone has the item and can write to you.
Your watchlist. The items you are watching are not shown on your shelf. But if someone marks an item you are watching as For sale or For trade, that person sees your display name and your profile picture – so that you can find each other.
The clubs. When you add an item of a kind that has a club, you automatically become a member there, and your display name is then shown in the club's member list to the other members. You can leave the club whenever you like. What we remember is that you have left it – new items of the same kind do not add you again.
Reviews you have given or received are visible to everyone who is signed in to Klenod, not only the person you did the deal with – they are meant as a safety signal for the whole community.
Only you and the recipient can read your messages. We do not read them, except when a message has been reported to us and we need to assess the report.
Where is the data stored?
Database, sign-in and photos are handled by Supabase, with servers in Stockholm, Sweden (EU). The database is backed up every night, and the backups are overwritten after eight days.
Confirmation and password emails are sent via Resend (USA), which then processes your email address, the content of the email and delivery details. The same service emails new reports to our moderators.
If you sign in with Apple or Google, the sign-in itself takes place with them, and they then learn that you use Klenod. We receive your email address, your name and a user ID and store them with Supabase, just as for an account created with email. What else Apple and Google store about the sign-in is governed by their own terms, not by us.
If you use the AI help, the photo is sent to Anthropic in the USA for analysis, without your name or email address. Anthropic does not use the image to train its AI models and normally deletes it within 30 days – longer only if needed for safety, investigating abuse or by law. Because Anthropic is outside the EU/EEA, the transfer is made with safeguards under the European Commission's Standard Contractual Clauses.
Push notifications are sent via Expo (650 Industries, Inc., USA). We store an anonymous notification ID for your device so that the notification reaches the right phone – never the content of your messages. Expo is bound by the European Commission's Standard Contractual Clauses and participates in the EU-U.S. Data Privacy Framework.
If you buy Klenod Plus, the payment is handled by Apple or Google under their terms — we are not involved in it. To keep track of which accounts have Plus, we use RevenueCat, Inc. (USA). They receive your Klenod user ID (a random string of characters, not your email address or your name) and, from the store, details of the purchase: which product, when it was bought, renews and expires, and technical purchase IDs. Neither they nor we receive card details. Our own server only stores that the account has Plus and the date it is valid until. Because RevenueCat is outside the EU/EEA, the transfer is made with safeguards under the European Commission's Standard Contractual Clauses.
Error reports. If the app crashes, it sends an error report to our own database: which screen it happened on, the error message, app version, operating system, a random ID for the phone and your user ID. Once a day the app also sends a short check-in signal with the same IDs, so that we can see that error reporting is working. Never your email address, your name, your photos or the content of your messages. The reports are only used to find and fix bugs, and they are deleted after 90 days.
The error reports are also sent to Sentry, a service that shows us where in the code the error occurred. Sentry receives the same data as listed above – never your email address or your name, and Sentry is set not to store your IP address. The data is stored within the EU, in Germany. The company behind Sentry is in the USA, and if data is processed there after all, this is done with safeguards under the European Commission's Standard Contractual Clauses.
As with all internet traffic, our providers see your IP address when the app contacts them. We do not store it in Klenod's database.
If a provider processes data outside the EU/EEA, this is done with safeguards under the European Commission's Standard Contractual Clauses. All providers process data according to our instructions and data processing agreements.
How long is the data kept?
For as long as you have an account. When you delete the account, your profile, shelves, items, photos, watchlist, club memberships, posts, matches, conversations, messages, reviews, blocks, notifications and the record that the account has Plus are permanently removed – see Delete account. They remain in the backups until those are overwritten, at most eight days. Deleting your account does not cancel a Klenod Plus subscription – you cancel it in the App Store or Google Play. Reports you have made about others may be kept in de-identified form, with no link to you, for our ongoing safety work and to be able to deal with repeated abuse. We may also need to keep certain data if the law requires it.
When someone reports content, we keep a copy of what was reported (the text, and for cases involving children also where the images are stored) so that we can assess the report even if the content or the account is removed. The copy is kept for twelve months after the decision. Cases involving children are kept for as long as needed to support an investigation.
Your rights
You have the right to access your data, to have it corrected or deleted, to object to or request restriction of the processing, and to receive your data in a machine-readable format. Where the processing is based on your consent, you can withdraw it at any time. You can export your collection yourself in the app, as a file you can open in a spreadsheet program. Deletion is easiest directly in the app. For anything else, email support@spitakolus.com.
If you think we are processing your data incorrectly, you have the right to complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY). If you live or work in another EU/EEA country, you can also complain to the data protection authority there.
Age limit
Klenod is for you if you are 13 or older — 18 or older in Brazil. The age limit follows the country of your App Store or Google Play account, and the country of your phone when you sign up. Accounts that we learn belong to someone below the age limit are blocked and deleted. See also our child safety standards.
Changes to this policy
If we make significant changes, we will let you know in the app. The latest version is always available on this page.
---
Klenod is run by Spitakolus AB, Svängrumsgatan 46, 421 71 Västra Frölunda, Sweden. Reg. no. 559554-6101 · VAT no. SE559554610101 · support@spitakolus.com