Privacy Policy

1. Information We Collect

Account information. If you create an account with email and password, we store your email address. If you sign in with Google, see "Google Sign-In" below. If you use Dahabi as a guest, see "Using Dahabi as a Guest" below — no email or name is collected unless you choose to sign up.

Your jewelry data. Photos you take or upload of your jewelry, item details you enter or that our AI analysis suggests (item type, metal, karat or purity, weight, gemstone information, brand), purchase and sold prices and currencies, store names, notes, and any purchase receipts (photos or PDFs) you choose to upload.

Collection value history. To draw the value chart on your Portfolio, we record your collection's total estimated value every six hours.

Preferences. Your chosen display language and currency.

Device identifier (guests, mobile app only). While you use the Dahabi mobile app as a guest, we read a persistent identifier for your device — not your name, email, or any other personal information — solely to limit abuse of the free AI-scan trial (for example, repeatedly clearing app data to get a new trial). It is not used once you create an account.

Sign-in security records. To protect accounts against automated guessing, we record sign-in, sign-up, and password-reset attempts, including the email address entered and your IP address, and use them only to limit repeated attempts. Sign-up is also protected by Cloudflare Turnstile, which checks technical signals from your browser or device to tell people from bots.

Error reports. When something goes wrong in the app, a technical error report is sent to our error-monitoring provider (Sentry). It can include the page you were on, your device and browser type, and internal item identifiers. We remove cookies and sign-in credentials from these reports before they are sent, and we don't attach your name or email to them.

2. Using Dahabi as a Guest

You can use Dahabi without an account. Your data is then tied to an anonymous session on your device rather than to any personal identity. If you later sign up or sign in, the items you added as a guest are moved into that account. Guest data can't be recovered if you clear the app's data or switch devices before signing up, because there is no account to restore it from.

3. Google Sign-In

If you choose to sign in or sign up with Google, Google shares your email address, name, and profile picture with us so we can create or link your Dahabi account. We never see or store your Google password. You can review or revoke Dahabi's access from your Google Account's security settings at any time.

4. AI Photo and Receipt Analysis

When you scan a jewelry photo, or add a purchase receipt (a photo, or the first three pages of a PDF), that image is sent to an AI analysis provider — to suggest the item type, metal, karat, gemstones, and weight, or to read the store, date, and price from a receipt. We use two providers: Anthropic (Claude) and Alibaba Cloud (Qwen, through its Model Studio service). Which one analyzes a scan depends on our current settings, and if the first one can't answer, the same image may be sent once to the other so your scan still works. We send only the image and our instructions; we don't send your name, email, or account details.

Under Anthropic's commercial terms, data sent through its API is not used to train its models by default and is deleted from Anthropic's systems within 30 days. Alibaba Cloud states that it never uses customer data to train its models; it does not publish a fixed period after which data sent to Model Studio is deleted, so we can't promise one. The results are only used to pre-fill suggestions for you to review and edit — nothing is saved until you confirm it.

5. Service Providers

We use the following providers to run Dahabi. Each receives only what it needs to do its job:

• Supabase — our database, sign-in, and file storage. Your account and jewelry data, photos, and receipts are stored in Supabase's Seoul, South Korea region.
• Vercel — hosts the app and website and runs our server code, in the United States. Like any web host, it keeps standard request logs, which include IP addresses.
• Anthropic — AI analysis of photos and receipts (see section 4), in the United States.
• Alibaba Cloud — AI analysis of photos and receipts through its Model Studio service (see section 4). We use its Singapore region; Alibaba Cloud stores request data in that region, and the analysis itself may run in other countries within the service's "International" deployment scope.
• Sentry — error monitoring (see section 1), hosted in the European Union.
• Cloudflare Turnstile — bot protection on sign-up.
• Resend — delivers the sign-in and verification code emails we send you.
• Google — only if you choose Google Sign-In.
• metals.dev — supplies the metal prices and exchange rates used for valuations. Our servers fetch prices from it on a schedule; we don't send it any information about you.

Because these providers operate in different countries, your data may be processed outside the country where you live.

6. How We Protect Your Data

Your data is stored with Supabase, which encrypts customer data at rest (AES-256) and in transit (TLS). Access is restricted so that your account can reach only its own items. Jewelry and receipt photos are kept in private storage — never publicly listed or browsable — and are shown to you only through short-lived links that only your account can create.

App lock. You can turn on an optional app lock in Profile → App lock. It asks for a 4–6 digit PIN, and optionally your fingerprint or face, whenever Dahabi opens or returns from the background, even if your phone is already unlocked. Your PIN is never stored in plain text or sent to us: only a secure hash of it is kept, on your device. Fingerprint and face checks are done by your phone, and we never receive any biometric data. While the app lock is on, the Dahabi mobile app also hides its content from your phone's recent-apps screen.

7. Data Kept on Your Device

To work quickly and survive interruptions, the app keeps some information on your device: an unfinished item you're adding (including its photo) and changes that haven't finished saving, recently viewed photos (for up to 30 days), your language and display preferences, and — if you use the app lock — the PIN hash. This data stays on your device. It is cleared when a different account signs in on the device, and you can remove it at any time by clearing the app's data. On Android, Dahabi's app data is excluded from your phone's cloud backups.

8. We Do Not Sell Your Data

We do not sell, rent, or trade your personal information or jewelry data to anyone, for marketing or any other purpose. Data is shared only with the service providers listed in section 5, each solely to operate the features you use.

9. Cookies

Dahabi uses cookies to keep you signed in and to remember your language before you're signed in. We do not use advertising or third-party tracking cookies, and we do not use analytics trackers.

10. Emails

We email you only when you ask for it — sign-up verification codes, sign-in codes, and password-reset codes. We don't send marketing emails.

11. Exporting Your Data

You can download your data at any time from Profile → Export Data: a CSV file of every item (active and sold) with all of its details, or a PDF report of your collection.

12. Data Retention and Deletion

We keep your data for as long as you have an account (or guest session). You can permanently delete your account at any time from Profile → Delete Account — this works for guests too. It removes your profile, every jewelry item, every photo and receipt, and your value history, and cannot be undone.

For our own cost accounting we record each AI scan's type, the AI model used and how much processing it took — never the image or the result. When you delete your account these records are kept but no longer linked to you.

Copies held by our service providers are removed on their own schedules: images sent for AI analysis are deleted by Anthropic within 30 days and kept by Alibaba Cloud under its own terms (it publishes no fixed period), error reports expire under Sentry's retention settings, and routine backups and logs are overwritten over time.

13. Your Choices and Rights

You can view and correct your information directly in the app, export it (section 11), and delete it (section 12). For any other request about your personal data — for example, a copy of the information we hold about you — contact us at the address below and we'll respond within 30 days.

14. Children

Dahabi is not intended for anyone under 16, and we don't knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, contact us and we'll delete it.

15. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we'll update the "Last updated" date above. Continuing to use Dahabi after a change means you accept the revised policy.

16. Contact Us

Questions about this policy or your data? Reach us at support@dahabi-app.com.