Privacy Policy

We collect only what the Watch Desk needs to work for you:

• Account information — the email address you sign in with, and membership status.
• Gift purchases — when someone buys a gift membership: the giver’s email address and, if given, their name; the recipient’s name, the note on the card and the card design; and, only when the giver asks us to email the gift, the recipient’s email address and the day to send it. Payment details go to our payment provider, never to us.
• Your watch records — the details you enter or import: maker, model, reference, year, case and movement details, condition notes, serial numbers, provenance, and distinguishing marks.
• Documents and media — receipts, service papers, certificates, photos, and video you upload.
• Service, packet, and recovery activity — service ledger entries, sale/insurance/estate packets you build, desk notes, saved references, theft-check records, and recovery cases.
• Payment information — handled by our payment processor. We receive your membership status and limited billing metadata; we never see or store full card numbers.
• Usage and security information — which pages are visited and how the site is used, as described under Cookies and analytics below; server logs used to keep the service reliable and secure; and your network (IP) address, which we use to limit repeated sign-up and password-reset attempts and to check that a person, not a script, is sending those forms.

Your records are yours. Access is enforced at the database layer (row-level security), so one collector can never read another’s data. Beyond that, we treat the most sensitive fields with extra care:

• Serial numbers are private and redacted. Full serials are hidden in shares, previews, and the optional ChatGPT connection. AI intake reads a serial only if you choose that for a single run (see below).
• Documents and media are private. They are stored in private cloud storage and served only through short-lived, owner-scoped links — never on a public URL.
• Packet recipients stay confidential. Who you share a packet with is never exposed to third parties.

• To provide and operate the Watch Desk — storing and displaying your records, media, service history, packets, and recovery workflows.
• To process your membership and send transactional messages (welcome, billing, and the notifications you’ve enabled).
• To keep the service secure, prevent abuse, and troubleshoot problems.
• To understand which of our pages and campaigns lead people to sign up and become members, through Runner as described below.
• To improve the product. We do not sell your personal data or use your private records to advertise to you.

You can optionally connect Crown Quorum to ChatGPT. When you do, the connection is read-only and scoped to your own account. It can list your records, find which still need details, and draft a redacted packet summary. It never adds, edits, deletes, shares, sends, or publishes anything, and it never reveals full serials, private documents, or packet recipients. The connection is off until you enable it, and you can disconnect it at any time, either under Connected apps on your account's Membership page or from ChatGPT's settings. Disconnecting from your account ends ChatGPT's access straight away.

AI-assisted intake is optional, and you start each run. When you use it, photos of your watch (dial, bracelet, clasp, movement, or on the wrist) are sent to our AI provider, OpenAI, to suggest fields you review and correct. Those photos can show a serial, for example on a dial's inner ring or a movement; the AI is told not to return serials, and its answers are checked for them. Reading the serial is a separate choice you make for a single run: then the caseback or serial photo is sent too, and the serial it reads is shown to you to confirm before anything is saved. Requests are sent with OpenAI's response storage turned off. Under OpenAI's API terms, what we send through the API isn't used to train OpenAI's models, and OpenAI may keep it for up to 30 days to monitor for abuse before deleting it, unless the law requires longer.

If you ask for an AI review of a lead on a recovery case, the listing text and link you pasted are sent to OpenAI with your watch's maker, model, reference, year, case size, and movement. The lead's contact details are not sent.

When you submit a possession check, you can tick an option to let an AI model check that your one-time code is readable in the photo. It is unticked by default, and a reviewer looks at your photos either way. If you tick it, only the code photo is sent to OpenAI, with its location and camera details removed, under the same terms as above. The AI is not told your code: it reads what it sees, and we compare the result ourselves. We keep only whether the code could be read, never what the AI read or a copy of the photo, and verification photos are never used to train or improve any model.

Helping improve identification is a separate, optional choice. If you opt in, then while AI intake runs, the details it read from your photos (maker, model, reference, year, case, movement) are compared with identification examples kept by our search provider, Pinecone, and those details from each watch you confirm through AI intake are kept there as examples, under a pseudonymous key, and may help suggestions for other collectors. No serial, photo, or account detail is included. If you haven't opted in, nothing is sent to Pinecone. Turning the option off removes the examples you shared, deleting a watch removes its example, and deleting your account removes them all.

We use a small set of trusted providers (sub-processors) to run the service. They process data only to provide their function and under their own security and privacy commitments:

• Supabase — Database and authentication, including the account emails it sends through Amazon SES.
• Google Cloud Storage — Private media and document storage.
• Vercel — Application hosting and delivery.
• Stripe — Membership payments (we never store card numbers).
• Amazon Web Services (Amazon SES) — Delivers the account emails our authentication provider sends on our behalf, such as sign-up confirmation and password reset links.
• Google (Gmail) — Delivers our membership emails (welcome, renewal reminders, payment and cancellation notices) and the email notifications you have turned on.
• OpenAI — Optional AI features you start yourself: field suggestions from your watch photos, serial reading only when you choose it for a single run, a check that your possession-check code is readable in the photo when you tick it for that check, AI review of a recovery lead, and the optional ChatGPT connection. Requests are sent with OpenAI's response storage turned off. Under OpenAI's API terms, what we send through the API isn't used to train OpenAI's models, and OpenAI may keep it for up to 30 days to monitor for abuse before deleting it, unless the law requires longer.
• Pinecone — Search index for the optional identification examples, used only for collectors who opt in: while their AI intake runs, it compares the catalog attributes AI read (maker, model, reference, year, case, movement; never photos, serials, notes or your name) with stored examples, and keeps those attributes from each watch they confirm as an example under a pseudonymous key. Turning the option off, deleting a watch, or deleting your account removes your examples.
• Google Analytics — Usage measurement. Measures visits without cookies until analytics are allowed. Google Signals and ad personalisation are turned off, and no advertising runs on this site.
• Vercel Analytics — Page usage measurement. Runs only when analytics are allowed.
• Microsoft Clarity — Heatmaps, scroll depth, and session recordings on our public pages only — never on your desk, your records, your documents, or any page you sign in to reach. Runs only when analytics are allowed.
• Runner (SHMAPLEX) — Our own customer and revenue platform. It shows our privacy notice and cookie settings, and runs our first-party measurement: which pages are viewed and which organisation a visit appears to come from, under a random id. That measurement honours Global Privacy Control. When you create an account, our server sends Runner your email address and account id, with that random id when your browser has one, so the account can be linked to the visits that led to it. While you are signed in, your browser tells Runner your account id, so your visits are linked to your account. When your membership starts, changes plan, or ends, Runner receives the plan, its price and billing interval, your account id, and our payment processor's customer id. Our server also keeps Runner up to date on where your account stands: whether you hold a membership and its plan and status, when it began, renews or ended, whether it is set to end, and how many watch records are on your desk (a count only, never what a record says), under your account id. For an account opened before September 17, 2026, the first of these summaries also carries your email address, so Runner can link it to your account. When you buy a gift membership, Runner receives what was bought (its term, price and currency, whether we email it or you give it by hand, and the card's design) and our payment processor's customer id, with that random id when your browser has one, so the purchase can be linked to the visits that led to it, and it is told how much comes back if the payment is later refunded or lost to a dispute. It never receives your email address, the recipient's name or email address, or your note. When you write to us from our forum pages, Runner receives what you put in the form (your name and email address, your forum's address, your role, and your message) and passes it to our team, with that random id when your browser has one. Runner also checks the bot protection on sign-up, password reset, the gift checkout, and the forum pages' contact form, and receives your network (IP) address for that check.
• Cloudflare Turnstile — Bot protection on sign-up, password reset, the gift checkout, and the forum pages' contact form. Runner's script loads it in your browser to check that a person, not a script, is sending the form, and Runner confirms the result with Cloudflare. A security control, so it runs whatever you choose about analytics.

We do not sell your personal data. We share it only with the sub-processors above to run the service, when you explicitly direct us to (for example, generating a share packet you send), or when required by law. Any stolen-watch or recovery outreach is owner-initiated and owner-reviewed — never automatic.

Data is stored with our database and storage providers, protected by row-level security and private, signed-URL access to media. Traffic is encrypted in transit. No system is perfectly secure, but we design for least-privilege access and keep sensitive fields out of shares, logs, emails, and third-party surfaces.

We keep your records for as long as your account is active. If your membership lapses, your desk becomes read-only but your records are not deleted — you can resume or export them. When you delete a record or your account, we remove the associated data from active systems; routine backups age out on their normal cycle.

For a gift membership: the recipient’s email address is used only to send the gift and is removed as soon as it has been sent, or sooner if the gift is redeemed, refunded, disputed or expires. If a gift is refunded, disputed or expires unredeemed, the recipient’s name and the note are removed with it. The giver’s email address and name are removed 30 days after the gift is redeemed, refunded, disputed or expired, and at once if the purchase is abandoned before payment. The gift record itself — what was bought, when, and the redeemed membership — is kept with the recipient’s account like any other membership record, without the giver’s details after those 30 days.

• Access and export — you can view and export your records, documents, and history.
• Correction — you can edit or remove any record at any time.
• Deletion — you can delete records or ask us to delete your account and data.
• Notifications — you control which notifications you receive, in-app and by email, from your desk settings.
• Depending on where you live, you may have additional rights (such as access, portability, or erasure). To exercise any of them, contact us at support@crownquorum.com.

We use essential cookies to keep you signed in and to run the service. We use analytics to understand how the site is used: Google Analytics and Vercel Analytics record which pages you visit, including pages inside your desk, and Microsoft Clarity records heatmaps, scroll depth, and session recordings on our public pages — never your desk or your records. We do not use your private records for advertising, and we do not run advertising on this site: Google Analytics is set up with Google Signals and ad personalisation turned off.

You make your analytics choice in the privacy notice shown on your first visit. Depending on where you are, analytics are either off until you allow them or on by default with that notice. Whenever analytics are not allowed, Vercel Analytics and Microsoft Clarity do not run, and Google Analytics measures visits without using cookies.

You can change your mind at any time in cookie settings. Turning analytics off stops Vercel Analytics and Microsoft Clarity immediately, including on the page you are reading, and returns Google Analytics to measuring without cookies.

Crown Quorum is intended for adults and is not directed to children. We do not knowingly collect personal information from anyone under 18.

We may update this policy as the product evolves. We’ll revise the “last updated” date above and, for material changes, let you know in the app or by email.

Questions about privacy or your data? Email support@crownquorum.com.