Abditex

Abditex

Privacy policy

Effective 26 September 2026. Abditex is operated by Alleft Ventures, LLC, which is responsible for the data described here.

This is the plain-language version. The complete enumeration of every piece of data that ever leaves your device (every endpoint, every header, every retention window) ships inside the app as the Privacy Ledger. The ledger is the canonical source; this page summarizes it.

The short version

  • We don't ask for your name, email, phone number, or any account.
  • Your inventory lives on your device, encrypted at rest. We never see it.
  • If you use shared inventory, the shared data is end-to-end encrypted; we hold ciphertext and each sharing's member list, never the keys.
  • We don't run analytics, advertising SDKs, or third-party trackers. Anywhere. Ever.
  • Subscriptions are handled by Apple's App Store or Google Play. We never see your payment information.

What we don't collect

  • No accounts. The app does not require, support, or accept a login. There is no username, password, email address, or recovery token associated with you.
  • No location sent to us. Finding dealers near you uses a ZIP code you type or, only if you tap "Use my location", a single foreground GPS fix your phone takes and then discards. Either is used on your device to measure distances. Our server has no endpoint that accepts a coordinate or a ZIP code, so neither can reach us. Two things do tell us something about where you are looking, and both are described below: a US state you pick as a filter is sent with a directory search, and the nearby-dealer search lets our server work out the rough area you are browsing from your answers.
  • No analytics. No Google Analytics, no Firebase Analytics, no Mixpanel, no Amplitude, no Segment, no first-party event tracking. We don't know what screens you visit or what features you use.
  • No advertising identifiers. No IDFA, no AAID, no advertising SDKs of any kind.
  • No crash-reporting SDK. Abditex includes no Crashlytics, Sentry, Bugsnag, or equivalent. The app does not transmit crash data anywhere. If the app crashes, your operating system may retain a local crash log in the standard platform location, retrievable by you through OS tools. That's between you and the platform, not us.

What does cross the network, and why

The app makes a small, enumerated set of network calls. Each is documented in the in-app Privacy Ledger with full detail; here is the summary:

  • Spot-price updates. The app fetches current bullion spot prices from our server. The request names no metal and no currency; the server sees only that some device asked for prices. If you turn on price alerts or the daily digest, the app also checks prices on a schedule while it is closed, asking for price history for every metal as well. Those checks carry nothing about what you hold or which prices you watch, but they do not look like opening the app: our server could tell that a device has a price alert switched on, or uses the daily digest. The ledger's "Price alerts" and "Daily portfolio digest" entries list exactly what each sends.
  • Dealer directory searches. Searching the directory is a request to our server, and that request carries your search text and filters, including a US state if you pick one in Buy Local. Our application keeps nothing from it: there is no table that could record a query, and its log records the route, never the text. The web server in front of our application keeps an access log of its own, and since 3 October 2026 it records only the method and path of each request, never the search text or your IP address (see "Data we cannot produce" below). Your ZIP code and GPS fix are never in the request; distances are measured on your phone. Taking a GPS fix is your phone's own location service, which may consult Apple or Google to find you.
  • Nearby dealer search. Asking for dealers near you is a short back-and-forth. Our server proposes a spread of dealers, and your phone answers only which of those it proposed are within your radius, or which one is nearest; it never sends a coordinate, a ZIP code or a radius. Your answers do let the server work out roughly where you are browsing: it stops narrowing once the area holds 100 dealers or fewer, and never narrows it below a circle about a kilometre across. The final choice of the closest dealer is made on your phone. Nothing from the exchange is stored.
  • Exchange rates (Pro). If you display a currency other than US dollars, the app fetches the whole rate table from our server; the request names no currency, so switching currencies is a local re-render. A historical chart in another currency is the one request in the app that names the currency you are charting.
  • Subscription validation. The app sends a platform-issued receipt (Apple / Google) to our server to validate your subscription. Validated state is mapped to an opaque license token. We never see your payment method or store account. Redeeming an Abditex code sends the code and which platform you are on, and nothing else. While a license is active, the app sends its token each time you open it, to check the license is still active, and with its price-history requests, so our server can tell each time a Pro install is opened. What we keep is described under "Subscriptions and payments" below.
  • Attestation. Requests to our server carry an App Attest (iOS) or Play Integrity (Android) check, used solely for anti-abuse. Apple or Google issues it, so they learn that this app on your device is contacting us, and when. On iOS our server keeps the App Attest key identifier for your install and its public key, which it needs to check each request; they sit in a store of their own, joined to nothing else, and are deleted after 30 days unused. Android leaves nothing comparable on our server.
  • Your IP address. Every connection to our server comes from an IP address, as any connection on the internet does. The server's front end holds it in memory for up to a minute to rate-limit the two endpoints a device uses before it has proved anything, and does not pass it on to the application behind it. Neither our request log nor our web server's logs record it (since 7 October 2026; error-log lines written before then can hold the address of a connection that failed or was rate-limited, until the host's log rotation removes them).
  • Sync relay (Pro, opt-in). If you create or join a shared inventory, encrypted blobs, including photos on shared holdings, flow through our relay. The content we hold is ciphertext we cannot decrypt. We also hold each sharing's signed member list in the clear: every member device's public keys and role, never a name, and every past version of that list while the sharing exists. That is how the relay can tell that one device is in two sharings, and someone who has left a sharing can still read later versions of its list, though not its content. For each sharing we also keep counts of how many times its list and its key have changed, and we keep those after the sharing ends. Beside each shared photo we keep the public key of each member device that uploaded it or still uses it. When a sharing ends, its photos are deleted from our server within about three days.
  • Price alerts and the daily digest. Nothing is pushed to you. Your phone checks public spot prices itself and writes any notification itself. No alert rule, no notification token, and no record of a notification reaches our server or the platform's push service.
  • Unattended backup (Pro, opt-in). Each scheduled backup asks our server for one half of a split key. The server keeps no record of which backups exist, where they went, or when. While this is on, we learn when and how often this phone backs up. We never receive the file, its size, or anything in it.
  • Cloud backup destinations (opt-in). A backup written to iCloud Drive or Google Drive goes from your phone to that provider, not through us. The provider sees an encrypted file, its name (which says it is an Abditex backup), its size, and when it was written; Google also sees an authorisation scoped to files this app created, and the folder it writes to is called "Abditex Bullion". On Android you can instead choose a folder the app keeps permission to write to; that permission covers everything in the folder you pick, not only the app's own files.
  • Dealer map view (opt-in, iPhone only). Switching the local dealer list to a map loads map tiles from Apple, where the map is Apple's MapKit. Apple's servers see the map area and your IP address, as with any map; if you have used "Use my location", the map opens framed to include where you are. Our server is not involved and does not know you used it. The Android app has no map inside it and loads no map tiles.
  • Open in Maps (on tap). The "Open in Maps" button on a dealer, or on an Abditum you gave a location, hands that one address or coordinate to a maps app. On iPhone a dealer offers Apple Maps or Google Maps and an Abditum opens in Apple Maps; on Android it opens your default maps app. The maps company then has that location, under its own privacy policy. We are not told that you tapped it or what happened next.
  • Error reports (manual). Only if you open the report screen, read exactly what it contains, and submit: a fixed list of typed error events, the app version and build, the OS version, your device model (such as iPhone15,2), your language, and your subscription state as a single word. There is no free-text field, and nothing you entered into the app can be in it. We keep the report as a file for 30 days, then delete it. Like every request the app makes, it carries the Apple or Google check described above.

The ledger documents, for each call, exactly what data it carries, exactly what the server stores, and exactly how long retention runs.

Subscriptions and payments

Subscriptions are sold and managed entirely by the App Store (iOS) or Google Play (Android). Abditex never sees your name, billing address, payment method, or store account. We see the platform-issued receipt, which we exchange for an opaque license token.

Beside each license token we keep a short record: the store's identifier for the purchase, the product, the expiry, and whether the license was bought or granted with a code. The purchase identifier is pseudonymous: it is not your Apple ID, your Google account, your name or your email. It is stable, though. Every device that activates the same purchase gets the same license token, so the identifier ties together your devices that use Pro, including in other Abditex apps, and it is how a renewal, cancellation or refund reaches that token. On Apple, each member of a Family Sharing group gets an identifier of their own and Apple tells us nothing that links them, so our records cannot tell that two subscribers are one family. Whether Google does the same has not been established; if it gives a family one identifier, that identifier also ties together your family's devices that use Pro. Fourteen days after a subscription ends we delete those license records. Our record of each notification the store sends us about the subscription, which carries the same identifier, goes thirty days after it arrived. If the purchase was refunded or revoked, we keep a one-way hash of its identifier for 400 days, so that the purchase cannot unlock Pro again.

A license granted with an Abditex code is different in one respect: we keep a note of why we issued each code and our own list of whom we sent it to, and the license a code becomes records that code. So a granted license can be tied to the person we gave the code to. A bought license cannot.

Children

Abditex is not directed at children under 13 (or the equivalent minimum age in your jurisdiction). Because we collect no personal information from anyone, we do not knowingly collect personal information from children either.

Data we cannot produce

Because we do not have your decryption keys and do not store plaintext inventory, we cannot produce your inventory in response to legal process. This is by architectural design, not policy choice.

What we could produce is what we hold, and none of it contains your holdings:

  • the encrypted content of shared inventories, which we cannot decrypt;
  • each sharing's member list (device public keys and roles, no names), its past versions, and its change counts;
  • license records, including the store's pseudonymous purchase identifier and whether a license was bought or granted;
  • for 30 days, our record of each subscription notification the store sent us, with the same purchase identifier; and for 400 days, a hash of the identifier of a purchase that was refunded or revoked;
  • the codes we issued, with our note on each and, once redeemed, the license it became; for a code we gave you, that ties your license to you;
  • our web server's access log, which since 7 October 2026 holds only the kind of each request (a fixed word such as “sync” or “pricing”, never its address), with its time and status, and no IP address; older lines hold the path of each request (including the ids of sharings), and lines from before 3 October 2026 the full address, until the host's log rotation removes them;
  • if you use unattended backup, our half of its split key and when it was last asked for;
  • error reports you chose to send, for the 30 days we keep them;
  • for iPhones, the App Attest key identifiers our server keeps to check requests.

Your rights, wherever you live

Privacy laws such as the EU and UK GDPR and California's CCPA give you the right to know what a company holds about you, to get a copy, to have it corrected or deleted, and to object to its use. We honour those rights for everyone, not only where the law requires it.

In practice there is little to act on. We have no account, name, email or phone number for you, so nothing we hold is filed under you, and we usually cannot tell which records are yours. What we hold is listed above under "Data we cannot produce". If you write to privacy@abditex.com, we will tell you what, if anything, we can find from what you give us (a licence you can show us, for instance) and delete it on request. We will answer within 30 days. Your inventory lives on your device, so deleting the app removes it, and ending a sharing removes our copy of it on the schedule the Privacy Ledger gives.

We do not sell or share personal information, for advertising or anything else, and we do no profiling or automated decision-making about you. You can also complain to your local data-protection authority.

Changes to this policy

If we change what data crosses the network, the change appears in the in-app Privacy Ledger first, in the same release that introduces the change. This page is updated to match. The ledger's version history is preserved across releases.

Contact

Alleft Ventures, LLC. Privacy questions: email privacy@abditex.com. Security disclosures go to the security page.