PRIVACY POLICY

We collect personal information necessary to maintain your physical precious metals custody and process depository orders:

• Account Identity: Display name, email address, and authenticated Shopify Customer GID.
• Physical Delivery Information: Verified domestic shipping address, phone number, and delivery contact when requesting physical shipment.
• Session & Security Telemetry: Device identifiers, OS build, IP address, and security logs required to authenticate sessions and protect against fraudulent checkout manipulation.

We use collected data solely for:

• Issuing and certifying physical gold specimen serial numbers in our depository registry.
• Processing secure payments, checkouts, and Sierra Credit ledger adjustments.
• Generating tamper-evident shipping manifests and scheduling delivery dispatch.
• Maintaining statutory compliance records for physical precious metals custody bails.

Sierra never sells, rents, monetizes, or trades your personal information with third-party data brokers, marketers, or advertisers.

Information is shared strictly with essential infrastructure partners under strict confidentiality agreements:

• Shopify: For customer identity authentication and payment gateway processing.
• Cloudflare: For secure Edge API transit and DDoS mitigation.
• Shipping Couriers: Certified delivery carriers for physical custody dispatch and transit confirmation.

Sierra integrates FIDO2 WebAuthn Passkeys via Apple iCloud Keychain and Google Password Manager. When you authenticate using Face ID, Touch ID, or your device passcode, your biometric template never leaves your personal device.

Sierra servers only receive cryptographic public key verification signatures and never have access to biometric scan data.

When you request physical delivery of vault holdings, your shipping address and contact telephone are transmitted securely to our certified delivery partners solely to coordinate safe transit.

Transit records and delivery confirmations are retained only as required to establish legal delivery completion and custody handoff.

All network communication uses modern TLS 1.3 encryption. On-device customer sessions and security tokens are stored strictly within the hardware-backed Apple iOS Keychain and Android Keystore using Expo SecureStore.

All cloud databases enforce AES-256 encryption at rest and strict role-based access control.

Regardless of your geographic location, Sierra grants all customers full control over their personal data:

• Right to Know & Export: Request a complete machine-readable copy of your personal data and custody ledger.
• Right to Delete: Initiate account deletion directly within the mobile app profile settings.
• Non-Discrimination: Exercising your privacy rights will never result in price penalties or degraded service.

We retain personal information only for as long as your account remains active or as required by federal commercial statutes governing physical gold custody bails, tax reporting, and anti-money laundering (AML) compliance.

Account deletion requests require prior settlement of any active physical custody holdings or unredeemed credits.

Sierra services are strictly reserved for adults aged 18 and older. We do not knowingly collect personal information from individuals under 18. If we discover an account belongs to a minor, it will be terminated immediately.

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, contact our designated Data Privacy Officer at privacy@sierragoldexchange.com.

You may also initiate an automated data export or deletion preflight directly from the Profile settings in the mobile application.