Privacy Policy

This policy explains what personal information hobbyray.com collects, why, who we share it with, and what you can do about it. It is written to be read, not to be survived.

Who we are. hobbyray.com is operated by Eternita LLC, 1627 S. River Grove Way, Eagle, ID 83616, USA ("we", "us"). For anything in this policy, write to [email protected].

What this covers. The hobbyray.com website — the coin catalog, user collections and galleries, and the Lucky Coin Store — and our two mobile apps, CoinVision and Hobbyray Organizer (section 5). It replaces the separate Coin Vision Privacy Policy (last modified February 10, 2024) and Hobbyray Privacy Policy (last modified September 5, 2020). One policy now covers all of it.

1. The short version

• You can browse the catalog and the store without an account and without telling us who you are.
• An account needs an email address and a username. Both are visible choices: your username is public, your email address is not.
• If you buy something, we receive your name, shipping address and email address from PayPal so we can ship the coin. We never see your card or bank details — PayPal handles payment and does not pass them to us.
• Our apps use your camera, so you can photograph a coin. They do not ask for your location, and they do not collect receipts, card numbers, or anything about your travel. See section 5.
• We show advertising from Google and use Google's analytics tags. Those set their own cookies and can be used for personalized ads. Section 6 says how to turn that off.
• We do not sell your personal information. Section 8 explains what we do and do not share, including what advertising means under California law.
• Anything you post to the catalog — collections, galleries, articles, listings, your profile — is public by design. See section 9.

2. Information you give us

An account. A username, an email address, and a password. Optionally a first and last name, a country, a website, and a profile picture. You choose how much of this to fill in; only the username, email and password are required.

Signing in with Google. If you use Google sign-in, Google gives us your email address, your name and your Google profile picture. We do not receive your Google password and we cannot see anything else in your Google account.

Orders. When you buy from the store, we record the order, what was in it, and the amount. The buyer name, email address and shipping address come from your PayPal account (see section 4). We also record the IP address the order was placed from, as a fraud-prevention measure.

Things you contribute. Coin records, images, collections, galleries, articles, comments, and store listings if you are a seller. See section 9 — most of this is public.

Messages. If you email support or use a contact form, we keep the message and our reply.

3. Information collected automatically

Server logs. Our servers record the IP address, browser user-agent string, referring page, requested URL, timestamp, and your username if you are signed in. We use IP addresses to work out an approximate country, to fight abuse, and to tell real visitors apart from bots.

Searches. We log search phrases, together with the session identifier and the IP address the search came from. This is how we learn which coins people are looking for and cannot find. We do not build advertising profiles from it.

Cookies. See section 6.

4. Information from other companies

PayPal. All payments go through PayPal. When a payment completes, PayPal tells us the payer's name, the email address on the PayPal account, the confirmed shipping address, and whether the payment succeeded. PayPal does not give us your card number, bank account details, or PayPal password, and we never ask you for them. PayPal's own handling of your information is governed by PayPal's privacy statement, not this one.

Google. If you sign in with Google, see section 2.

We do not buy personal information about you from data brokers.

5. Our mobile apps

This policy covers both of our Android apps:

• CoinVision — identifies a coin from a photograph. play.google.com/store/apps/details?id=net.coinshome.coinvision
• Hobbyray Organizer — organises and searches your own collection. play.google.com/store/apps/details?id=com.hobbyraymobile

Your camera. CoinVision asks for camera permission so you can photograph a coin. The photograph is sent to our servers to be matched against the catalog. Android asks you for that permission and you can withdraw it at any time in your device settings — the app simply stops being able to take pictures. You can also pick an existing photo instead.

Photographs are content, not just data. A coin photo you upload from an app is treated exactly as one uploaded from the website: it becomes part of the catalog, it is served from a public content delivery network, and section 9 applies to it. Identification results are software suggestions, not appraisals.

Your account. If you sign in, the apps use the same account as the website, and everything in section 2 applies. If you do not sign in, you can still identify coins, and we hold the photograph and the usual server-log information (section 3) without knowing who you are.

What the apps do not collect. Earlier versions of our app policies were written from a generic template that claimed far more than these apps have ever done. To be unambiguous, our apps do not collect:

• your location — no GPS, no Bluetooth beacons, no wifi positioning. CoinVision does not request a location permission at all;
• scanned receipts, or any information from them;
• card numbers or any part of one, including the last four digits;
• contacts, calendar, microphone, SMS or call data;
• anything about your travel.

Google Play. The apps are distributed by Google Play, which shows its own data-safety summary and collects its own information about downloads. That is Google's, not ours.

Deleting app data. The apps hold nothing that the website does not. Deleting your account (section 11) covers both; uninstalling an app removes it from your device but does not delete your account.

6. Cookies and similar technologies

Turning them off. Your browser can block or delete cookies — every browser has this in its settings. Blocking the strictly necessary cookies will break signing in and the cart. You can turn off personalized Google advertising specifically at Google Ads Settings, and opt out of interest-based ads from many other companies at optout.aboutads.info and optout.networkadvertising.org. Those opt-outs are stored by your browser, so you have to repeat them on each browser and device you use.

We do not currently respond to the "Do Not Track" browser header, because there is still no agreed standard for what a site should do when it sees one. We do honour Global Privacy Control signals where our advertising partners support them.

7. What we use it for

• Running the site: your account, your collections, your session, your cart.
• Fulfilling orders: taking payment through PayPal, shipping the coin, handling returns and refunds, and answering questions about an order.
• Identifying coins you photograph, and improving how well that works.
• Emailing you about things you asked for: order confirmations, shipping notices, refunds, password resets, and notifications you have opted into. You can turn off notification emails in your profile; you cannot turn off transactional emails about an order you placed.
• Keeping the site working and honest: security, abuse and fraud prevention, rate-limiting bots, debugging.
• Understanding what people want: aggregate statistics, search analysis, which catalog pages get used.
• Advertising, as described in sections 6 and 8.
• Meeting legal, tax and accounting obligations.

8. Who we share it with

We do not sell your personal information for money.

We share it with:

• PayPal, to take and refund payments.
• Shipping carriers (USPS, UPS, FedEx), which need the delivery address to deliver the coin.
• Google, through the analytics and advertising tags described in section 6, for sign-in if you use it, and as the distributor of our apps.
• Amazon Web Services, which hosts our images and static files. Images you upload are served from a content delivery network and are public.
• Service providers who work on our behalf — email delivery, hosting, error monitoring — and only as needed to do that work.
• Authorities and others, where we are legally required to, or where it is genuinely necessary to investigate fraud or abuse, enforce our terms, or protect someone's safety.
• A buyer or successor, if the business or part of it is ever sold, merged or reorganised.

About advertising and "sharing". California and several other states treat disclosing personal information for cross-context behavioural advertising as a "sale" or "share" even when no money changes hands. The Google advertising tags on this site can work that way. If you would rather they did not, the controls that take effect immediately are the ones in section 6 — Google Ads Settings, the industry opt-out pages, and your browser's own cookie settings. You can also record the choice against your account through Do not sell my personal information, which is linked from the footer of every page.

9. What is public

The catalog is a community project, and most of it is public on purpose. Assume that anyone — including search engines — can see:

• your username, profile picture, country, website, and anything you put in your profile;
• your collections and galleries — there is currently no setting that makes a collection private, so treat everything you add to one as published;
• coin records and articles you contribute. Catalog articles are shared, versioned, and can be edited by other contributors and by us; the edit history is retained;
• images you upload, from the website or from an app, which are served from a public content delivery network. Anyone with the URL can view an image, whether or not they can see the page it came from;
• store listings, if you are a seller.

Your email address, password, postal address and order history are not public. Your name is public only if you choose to put it in your profile — it is not published because you bought something.

Once you have posted something to a shared catalog page, other people's edits are part of that page's history, so removing your contribution entirely is not always possible. Think of a catalog edit as a public act.

10. How long we keep it

• Your account and what you have contributed: until you ask us to delete the account. Public catalog contributions may remain, as described in section 9.
• Orders, payments and refunds: seven years from the end of the tax year the order falls in, because tax and accounting rules require us to be able to show what we sold and to whom. We keep these even if you close your account.
• Server logs and search logs: we do not currently delete these on a fixed schedule. We are narrowing that, and when we set a retention period we will say so here.
• Support email: as long as needed to deal with the matter, and then in our mail archive.

11. Your choices and your rights

Everyone can:

• see and change most account information in their profile;
• turn off notification emails in their profile, and unsubscribe from any marketing email;
• withdraw camera permission from an app in their device settings;
• ask us to delete their account — email [email protected] from the address on the account;
• use the Do not sell my personal information page, and the advertising controls in section 6.

If you live in California, you have the right to know what personal information we collect, use, disclose and share; to get a copy of it; to have it corrected; to have it deleted; to opt out of its sale or sharing for cross-context behavioural advertising; and to limit the use of sensitive personal information — although we do not collect personal information for that last purpose. We will not discriminate against you for exercising any of these rights.

If you live in Colorado, Connecticut, Virginia, Utah, Texas or another state with a comparable law, you have broadly the same rights: access, correction, deletion, portability, and an opt-out of targeted advertising.

If you are in the European Economic Area, the United Kingdom or Switzerland, you have the rights to access, rectification, erasure, restriction, portability and objection, and the right to complain to your data protection authority. Our lawful bases are: performing our contract with you (your account and your orders), our legitimate interests (running, securing and improving the site), your consent (advertising and analytics cookies, camera access, marketing email), and legal obligation (tax and accounting records).

To exercise any of this, email [email protected]. We will ask you to confirm that you control the account or email address in question — not to obstruct you, but because handing account data to whoever asks would be the actual privacy failure. We answer within 45 days, and will tell you if we need longer. An authorised agent may act for you with written proof.

12. Children

hobbyray.com is not for children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has created an account, email [email protected] and we will delete it. If you are between 13 and 18, please use the site with a parent's involvement, and note that purchases require an adult's payment method.

13. Security

The site is served over HTTPS, payment goes through PayPal so that card details never reach our servers, and we limit who on our side can reach production data.

No website is perfectly secure, and we are not going to tell you otherwise. Please use a password you do not use anywhere else, and sign out of shared computers. If you think your account has been accessed by someone else, email [email protected] and we will act on it.

14. Where your information goes

Eternita LLC is a US company and your information is stored and processed in the United States, whichever country you are in. Our service providers — PayPal, Google, Amazon Web Services — may process it elsewhere. If you are in the EEA, the UK or Switzerland, that means your information is transferred outside your country; where such transfers need a legal mechanism, we rely on the European Commission's Standard Contractual Clauses or another approved safeguard.

15. Changes

We will change this policy from time to time. When we do, we will update the date shown at the top of this page, and if a change materially affects you we will say so on the site. Continuing to use hobbyray.com after a change means you accept the updated policy.

16. Contact

Eternita LLC
1627 S. River Grove Way, Eagle, ID 83616, USA
[email protected]

Write to us before you escalate — most privacy questions are a misunderstanding we can clear up in one email. If you are in the EEA or UK you may also complain to your national data protection authority; if you are in California you may contact the California Privacy Protection Agency.

See also our Terms of Service and, for purchases, our Return Policy.