Privacy Policy

1. Information We Collect

• Account Information: When you create an account, we collect your username, email address, display name and hashed password credentials, and, if you enter them, your first and last name and your closest major city. If you sign in with Apple or Google, we store the account identifier that Apple or Google gives us, and with Google the address of your Google profile picture. When you create an account, we record which version of the Terms of Service you agreed to and when. If you sign in with Apple, we keep the token Apple issues for your account, encrypted, so that we can withdraw Penventory's access to your Apple ID when you delete your account. A later sign-in replaces it. If you choose a home currency, we store it on your account so that the app and the website show your totals in it. While a change of email address is pending, we store the new address and the time of the request.
• Collection Data & User Content: Information you voluntarily input to manage your vault, including pen specifications, nib details, ink logs, purchase dates, valuations, and photos you upload.
• Reports and Blocks: If you report a comment, a public profile or a public item, we store who made the report, what was reported, the reason you chose, anything you wrote in the report, a copy of the reported text at that moment (the comment, the name of the item, or the public name of the profile), the date, and, once the report is closed, its outcome, a note and which administrator closed it. If you block someone, we store who blocked whom and when. The person you block is not told.
• Device & Security Data: Basic application state indicators (such as local biometric authentication preferences and offline caching records) stored locally on your device.
• Security and Usage Records: Our server keeps a security log of sign-ins, failed sign-in attempts (with the username that was typed), changes of email address and account deletions, for up to 90 days. The app sends usage events with an anonymous device identifier and, when you are signed in, your account number; we keep them for up to 90 days. Visits to pages of the website are counted per day and page, without identifiers.

2. How We Use Your Information

• To authenticate your session and synchronize your collection across your iOS devices and web browsers.
• To calculate collection statistics, valuations, preventative maintenance schedules, and achievement progression.
• To display your public collector profile and shared pens or trays only when you explicitly enable public visibility.
• To provide customer support, troubleshoot technical issues, and improve platform reliability.
• To review reports and act on them. Administrators are told of each new report in the app and by email. The email says what kind of content was reported and why; it contains no name and none of the reported text.
• To change your email address when you ask for it: we send a confirmation link to the new address, valid for one hour, and a notice to your old address; a second notice goes to the old address when the change is made. Neither notice names the new address. Your address changes only when you open the link and confirm on the page.

3. No Third-Party Tracking or Data Selling

We do not sell, rent, or trade your personal data to third parties. We do not use third-party advertising tracking frameworks or IDFA cross-app tracking. Your collection information belongs solely to you.

To convert prices, our server fetches the daily reference rates of the European Central Bank once a day. This request contains no personal data, no cookies and no identifiers. The app and the website receive the rates from our server. Test versions of the iPhone app distributed before October 2026 fetched the rates directly from ExchangeRate-API (open.er-api.com); like any web request, this showed that service your device's network address, and nothing else about you.

4. Data Security

We implement industry-standard encryption in transit (HTTPS/TLS) and secure salted hashing (bcrypt) for credentials. Access to our database infrastructure is strictly restricted.

When you edit an item, the app may send a one-time key that prevents the same edit from being applied twice. We keep these keys, with the item they belong to, for 30 days, and delete them with your account.

5. Account Deletion & Data Rights

In compliance with App Store guidelines and international privacy laws (including GDPR and CCPA), you maintain full control over your data. You may delete your account and all associated vault records at any time directly in the iOS app (via Account > Session & Account Management > Delete Account & All Data) or via the web platform. Account deletion removes your pens, nibs, inks, photos and account data from our live systems at once. Some records remain for a limited time: the log of sent emails, with the recipient address, and the security log, each for up to 90 days, and database backups until newer ones replace them. We keep a record of the deletion itself (account number, time and the file names of deleted photos), so that the deletion can be repeated if a backup is ever restored. Reports that other people made about you are kept without your identity, as described below.

When you delete an account that is linked to Apple, or unlink Apple, we ask Apple to revoke the token we keep for it. If Apple cannot be reached, the deletion still goes ahead and the failure is recorded.

When you delete your account, the blocks you made and the blocks against you are deleted, and so are the reports you filed. Reports that other people made about you, your comments or your items are kept so that moderators can still act on them: your account number, the ids of your items and your public name are removed from them, and your username, email address, display name and first and last name are replaced by "[deleted account]" in their texts. The text of a reported comment stays with the report, and what the reporter wrote may still describe you in other words. Reports are kept without a time limit, including closed ones.

6. Contact & Support

If you have any questions, feedback, or privacy requests, please contact us at:
Krause Advising
Email: support@thepenventory.com
Website: https://krauseadvising.com/penventory