Privacy Policy

What this policy covers

This policy covers the Exergue Android app for cataloguing coins, banknotes and related objects, this website at exergue.osavus.com and messages you send us about Exergue.

Osavus Technology OÜ, also presented as Osavus Technology Ltd or Osavus, publishes Exergue and is the controller of personal data handled as described here. We are registered in Estonia, registry code 12514773, at Narva mnt 5, 10117 Tallinn, Estonia. Our privacy and support contact is app@osavus.com.

Exergue has no user accounts, advertisements, in-app purchases, analytics, telemetry or crash-reporting service. Its internet access is used only for the optional connection described below. It does not request your location, contacts, camera, microphone, photo library or advertising identifier.

Your collection stays on your device

Exergue stores what you record: items and their identity, references, grades and physical details, acquisition details, prices and values, notes and stories, storage locations, tags, albums and saved views, together with the photographs and documents (such as PDF receipts) you attach, and your app settings. This information is kept in the app's private storage on your device. Exergue does not send it to us or to anyone else.

When you take a photograph, Exergue opens your device's camera app, which returns the picture to Exergue. When you add an existing photograph or document, you choose the individual file through Android's file picker. Exergue receives only the files you select. Opening an attached receipt passes that file to a viewer app you choose on your device.

Exergue is configured to exclude its data from Android's cloud backup and from device-to-device transfer, so your collection is not copied to a Google account or a new phone without your action. Use the app's own backup, described below, to keep or move your collection.

If something unexpected goes wrong, Exergue writes a technical entry to a log on your device, with a short reference you can quote to us. The log stays on the device and is never sent automatically.

Google Play and Android may process installation, update and device diagnostic information under your device settings and Google's own policies. Those platform services are separate from Exergue's local storage.

Backups and restore

In the Vault, you can choose a folder through Android's document system. Exergue writes its backup there, on request or on a daily schedule. The backup is a ZIP archive containing your catalogue records (as JSON and CSV), your photographs and documents, and a description of the format, so it stays readable without the app.

The folder you choose decides where the backup goes. It can be local storage or a folder provided by another app. If that provider syncs the folder to the cloud, the provider performs that transfer under its own terms and privacy policy. Backups are not encrypted by Exergue: keep them somewhere you trust, and remember that anyone with the file can read your collection.

Your Numista key, if you added one, is never written to a backup. Restoring a backup asks before replacing your current collection, and asks you to enter any key again.

Optional Numista connection

Exergue works fully without any external service. If you have your own Numista account, you can add your personal Numista API key to look up catalogue types, fill in specifications for an item you confirm and show Numista's indicative values beside your own. No key ships with the app.

What is sent: once your key is added, the words you type into a catalogue lookup and Numista catalogue type numbers already on your screen are sent to Numista's API at api.numista.com, over an encrypted connection, when you start a lookup or confirm an item. A request you make while offline may be queued and sent when a connection returns. Each request includes your key so Numista can authorise it, and, like any internet request, your IP address and basic technical information. Your photographs, notes, prices, storage locations and other collection records are never sent.

Who handles it: Numista receives and handles these requests as an independent service, under its own terms and privacy policy, and can associate them with the Numista account that owns your key. Osavus does not receive your key, your lookups or Numista's responses.

Your key: stored on your device, encrypted with a key held by the Android keystore, and excluded from backups. Removing the key stops all requests to Numista. Information already fetched stays in your catalogue with its source label until you edit or delete it.

The app's network layer refuses every destination that is not on its allowlist and refuses unencrypted connections. The app's What leaves this device page lists each case.

Features not in this version

Exergue's in-app privacy page also describes features that may be offered later: encyclopedic context from Wikipedia and Wikidata, which would send a page title or catalogue identifier when you open it, and identifying an item from a photograph, which would send only the photographs you pick for that one request to a provider you choose. These features are not available in the current version, and no photograph leaves your device.

Before any such feature becomes available, we will update this policy and the in-app information to explain what is sent, to whom and why. A feature that sends your content will run only when you choose to use it.

Deleting your data

There is no Exergue account to delete, and we hold no copy of your collection. You remain in control of the data on your device:

• Individual items: deleting an item moves it to Trash, where it can be restored for 30 days before it is permanently removed.
• Everything in the app: open Android Settings → Apps → Exergue → Storage → Clear data (sometimes called Clear storage), or uninstall Exergue. This removes your collection, photographs, documents, settings, stored Numista key and local log. It cannot be undone.
• Backups: backups you created stay in the folder you chose, and in any cloud service syncing that folder, until you delete them there. Clearing or uninstalling the app does not remove them.

We cannot recover a deleted collection for you. Deleting local data does not delete messages you separately sent us; contact us to request that.

When you email support

If you email app@osavus.com, we receive your email address, your message, its delivery metadata (such as sender, recipient and date) and any attachments you choose to include. We use them to reply, investigate the issue and follow up on your request. Please send only what is needed: never passwords or your Numista key, and not a full backup unless we have agreed it is necessary.

Our mailbox uses Microsoft 365. Access is limited to people authorised to handle support or administer the service. We do not add support contacts to a marketing mailing list. Contacting us is voluntary, though we may need relevant details to answer.

For ordinary support and feedback, our legal basis is our legitimate interest in responding to people who contact us and supporting Exergue. For statutory privacy requests and records we must keep by law, the basis is the relevant legal obligation.

When you visit this website

Microsoft Azure hosts and delivers this website. To serve and protect its pages and files, Azure's infrastructure processes technical request information such as your IP address, the requested address, time, browser information and response status. Our legal basis is our legitimate interest in providing a reliable, secure website.

The site's images, films and fonts are served from this website. We do not add analytics, advertising trackers, tracking pixels, session recording, embedded third-party media or contact forms, and the site does not set cookies or use browser storage. We do not export visitor access logs to a separate analytics or logging service; Microsoft may retain operational and security records as described under retention.

Following a link to the Osavus website, Google Play, Numista or another external site sends a request to that destination, which handles your visit under its own privacy policy.

Providers, sharing and international processing

We do not sell personal data or share it for targeted advertising. Microsoft provides Azure website hosting and Microsoft 365 email delivery and storage, acting on our behalf under contractual data-protection obligations. Google distributes the app through Google Play under its own terms. Numista, and any backup or cloud-storage provider you choose, act independently for the requests and files you send them.

We may disclose relevant correspondence to professional advisers or competent authorities where necessary to meet a legal obligation or to establish, exercise or defend a legal claim, limited to the information needed.

We are based in Estonia, in the European Economic Area. Microsoft and its service providers may process website request information or correspondence outside the EEA, including in the United States. Where required, transfers rely on an adequacy decision or contractual safeguards such as the European Commission's Standard Contractual Clauses, described in Microsoft's Products and Services Data Protection Addendum. Contact us for information about the safeguards applicable to your data.

Retention and security

Collection data: stays on your device and in backups you create until you delete it as described above. We hold no server copy.

Support correspondence: kept while we handle your request and for any follow-up that remains necessary. If a complaint, dispute or legal claim requires a record, we keep the relevant information for that purpose and the applicable legal period. When information is no longer needed, we delete or anonymise it.

Provider records: Microsoft may keep technical, security and service records to operate and protect its services and meet its obligations. Retention depends on each record's purpose and sensitivity; there is no single fixed period. See the Microsoft Privacy Statement for its retention criteria.

Exergue keeps your data in app-private storage, encrypts your Numista key with the Android keystore and uses only encrypted connections. This website is served over HTTPS. No measure guarantees absolute security: protect your device with a screen lock, and keep your backups and email account secure.

Your privacy rights

Contact app@osavus.com to ask about information you have sent us, or to request access, correction or deletion. Depending on applicable law, you may also have the right to restrict processing, to object to processing based on legitimate interests and to receive a portable copy of information you provided. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. We do not make solely automated decisions about you that have legal or similarly significant effects.

We may ask for proportionate information to verify a request. We respond without undue delay and normally within one month; if a permitted extension is necessary, we explain it within that first month.

Exergue is a general-audience tool for collectors and is not directed at children. If you believe a child has sent us personal information, contact us and we will take appropriate action.

You may raise a concern with your local data-protection authority. In Estonia, that is the Data Protection Inspectorate (Andmekaitse Inspektsioon).

Contact and changes

Privacy and support: Osavus Technology OÜ, Narva mnt 5, 10117 Tallinn, Estonia; app@osavus.com.

The current policy is published at exergue.osavus.com/privacy.html. We update it when Exergue's data practices change and show the effective date above. For material changes, we give appropriate notice on this website or in the app, and ask for consent where it is required.