This Privacy Policy explains how the GoldScout mobile app and website (together, the “Service”) collect, use, and protect personal data. GoldScout is an independent gold-coin price comparison service. We do not sell gold, hold client funds, or provide investment or tax advice.
1. Who we are
The data controller for the Service is Star and Cosmos Technologies LTD(“we”, “us”, “our”), a company registered in England and Wales.
- Company registration number: 17014702
- Registered office: 71-75 Shelton Street, London, WC2H 9JQ, England
- Privacy contact: privacy@goldscout.co.uk
2. The short version
- You can browse prices without an account. Viewing coin prices, premiums, charts, and comparisons requires no sign-in and no personal data.
- We only collect account data if you choose to Sign in with Apple to manage a subscription.
- Your portfolio holdings and price alerts stay on your device; we do not upload them to our servers.
- We use a crash-and-diagnostics tool (Sentry) to keep the app stable. If you choose to identify a coin by photo (available on supported devices), the image is analysed entirely on your device by Apple Intelligence and is never uploaded to us or anyone else.
- We use fully anonymised usage analytics (PostHog, hosted on its European Union cloud) to understand which features are used. Analytics events are never linked to your name, email, account, or device identifiers: the app assigns a random per-install identifier, never calls any “identify” function, and IP addresses are discarded at ingestion. You can switch analytics off at any time in Settings > Privacy inside the app.
- We do not sell your data, do not show ads, and do not track you across other apps or websites (no advertising identifiers, no App Tracking Transparency prompt needed).
3. What we process, why, and our lawful basis
| Data | Purpose | Lawful basis (UK GDPR) |
|---|---|---|
| Account data: your name and email address (or Apple’s private relay email), provided via Sign in with Apple. | To create your account and link your subscription across your devices. | Contract (Art. 6(1)(b)): to provide the account and subscription you request. |
| Subscription data: Apple transaction identifiers, product purchased, subscription status and renewal dates. We never receive your card or payment details. | To grant and maintain access to paid features and validate your subscription. | Contract (Art. 6(1)(b)). |
| Diagnostic & crash data: crash reports, performance traces, app-hang reports, device model, OS version, network request metadata, and a small sample of session replays (on-screen text and images are masked). | To detect, diagnose, and fix bugs, crashes, and performance problems. | Legitimate interests (Art. 6(1)(f)): keeping the Service stable and secure. |
| Anonymous usage analytics: feature-usage events (for example which tab or filter was used), app version, OS version, device type, and locale, tied only to a random per-install identifier. Never collected: your name, email, account, search text, portfolio values or counts, or any advertising identifier. IP addresses are discarded at ingestion and are never stored. | To understand which features are used and improve the app. Processed exclusively on PostHog’s European Union cloud. You can opt out at any time in Settings > Privacy inside the app. | Legitimate interests (Art. 6(1)(f)): improving the Service using data that cannot identify you, with an always-available in-app opt-out. |
| Beta signup email: the email address you submitted on our website to request a TestFlight beta invite before the public launch (the form is now closed). Nothing else was collected with it. | To send you a TestFlight invitation and, if you ask us to, tell you when the app launches. Not used for marketing and never shared. | Consent (Art. 6(1)(a)): you choose to submit your email. You can withdraw at any time by emailing us. |
Data that stays on your device
Your portfolio holdings (coins, purchase prices, dates, notes) and your price alerts are stored locally on your device (and in your private app group container). We do not transmit or store this information on our servers. If you delete the app, this data is removed with it. Coin photos used by the optional recognition feature (available on supported devices) are analysed on-device by Apple Intelligence and never leave your phone; we receive neither the photo nor the result.
4. Service providers (sub-processors)
We rely on a small number of trusted providers who process data on our behalf under contract:
| Provider | Purpose | Location |
|---|---|---|
| Apple | Sign in with Apple, App Store payments and subscription management, push/local notifications. | EU / global (per Apple’s terms) |
| Supabase | Database hosting and authentication. | United Kingdom (AWS London, eu-west-2) |
| Sentry (Functional Software, Inc.) | Crash reporting and performance diagnostics. | European Union (Germany) |
| PostHog (PostHog, Inc.) | Fully anonymised product analytics (feature usage). We use PostHog’s dedicated EU Cloud: events are ingested and stored in the European Union, and IP addresses are discarded at ingestion. | European Union (Frankfurt, Germany) |
5. International data transfers
Processing takes place in the UK or the EU. If personal data is ever transferred outside the UK, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
6. How long we keep data
- Account and subscription data: for as long as you have an account, and for up to 7 years afterwards where needed to meet legal, tax, and accounting obligations relating to your subscription.
- Diagnostic and crash data: retained for up to 90 days, then deleted or anonymised.
- Anonymous usage analytics:stored as anonymous event records on PostHog’s EU cloud for up to 7 years; because they carry no name, email, account, or device identifier, they cannot be linked back to you at any point. If you opt out in the app, no further events are sent.
- Beta signup emails: kept only for the duration of the beta programme and deleted within 90 days of public launch, or sooner if you ask us to remove yours.
- On-device data (portfolio, alerts): kept until you delete it or remove the app.
7. Your rights
Under UK GDPR you have the right to:
- access a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased (“right to be forgotten”);
- restrict or object to certain processing;
- data portability;
- withdraw consent at any time (for processing based on consent, such as beta signup emails), without affecting prior processing.
You can also object to usage analytics instantly, without contacting us: switch off “Share anonymous usage analytics” in Settings > Privacy inside the app and the app stops sending analytics events immediately. Because analytics events are anonymous, we cannot identify which events belong to you, so access, correction, and erasure requests cannot be applied to them (UK GDPR Art. 11).
You can delete your account directly in the app: Settings → Account → Delete Account. This permanently and immediately deletes your account and the sign-in data linked to it, and revokes the app’s Sign in with Apple authorisation. Your subscription is managed by Apple and is unaffected, and the coins in your stack remain on your device.
To exercise any other of these rights, email privacy@goldscout.co.uk. You also have the right to lodge a complaint with the UK’s supervisory authority, the Information Commissioner’s Office (ICO), at ico.org.uk, although we would welcome the chance to address your concern first.
8. Children
The Service is intended for adults and is not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
9. Security
We use industry-standard measures (including encryption in transit, access controls, and reputable infrastructure providers) to protect personal data. No method of transmission or storage is completely secure, but we take reasonable steps to safeguard your information.
10. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be reflected by updating the “Last updated” date above and, where appropriate, through an in-app notice.
11. Contact
Questions about this policy or your data? Email privacy@goldscout.co.uk or write to Star and Cosmos Technologies LTD at the registered office above.