Wire & Wood Privacy Policy
Effective Date: Sep 17, 2026 · Last Updated: Sep 16, 2026
1. Information We Collect
Account Information
When you create an account, we collect your email address and password (processed securely through our authentication provider, Supabase). We do not store your password in plain text.
Instrument Data You Provide
When you log an instrument, we collect the information you choose to enter, which may include:
- Category, brand, model, year, and serial number.
- Photos and photo captions.
- Story and build notes.
- Estimated and insured value.
- Item number (self-created or auto-generated).
- Location: Where you store the instrument. This field is private by default and is never shown on public certificates, the public verification page, or resale documents. It may appear only on insurance-type certificates, which are intended for private sharing with your insurer.
- Acquisition Details: Acquisition source/vendor ("acquired_from"), acquisition date, location, and price paid. These fields are strictly private-by-design and are never displayed on public pages, resale certificates, or verification links.
- Originality Status & Detail Notes: Detailed notes regarding the originality, modifications, structural integrity, or physical characteristics of the instrument. These fields remain private unless you explicitly choose to include them in a certificate snapshot.
- Third-Party Authentication Records & Uploads: Documentation, certificates, and appraisal PDFs issued by third-party authenticators that you upload to your account.
- Maintenance and restoration records.
Account Status Metadata ("Dark Accounts")
We maintain metadata regarding whether an account is active, inactive, or restricted/banned ("gone dark"). This status helps manage the integrity of the database during administrative lookups.
Provenance and Certificate Data
We maintain a permanent, timestamped history of actions taken on each item (photos added, details revised, maintenance logged, ownership transferred, certificates issued). This history is designed to be tamper-evident and, once created, entries in this history cannot be edited or deleted — this permanence is core to how Wire & Wood works.
When you generate a certificate, a snapshot of the item's information at that moment (including photos and captions) is saved permanently and cannot be altered afterward, even if you later update the item.
Payment Information
Subscription and certificate payments are processed by Stripe. Wire & Wood does not receive or store your full credit card number — Stripe handles this in compliance with PCI security standards. We retain records of your subscription tier, billing status, and transaction history as needed to manage your account.
Communications
If you contact us through the Contact / Feedback form, we collect the category, subject, message, and your account email so we can respond. Submissions may be reviewed by our team and, for internal notification purposes, forwarded to us via our email service provider (Resend).
Usage and Technical Information
We may collect standard technical information (such as browser type, device information, and general usage patterns) to maintain and improve the service.
2. How We Use Your Information
We use the information we collect to:
- Provide and operate your account and instrument records.
- Generate certificates and maintain provenance history.
- Process subscription billing and one-time certificate charges.
- Send account-related communications (e.g., ownership transfer notifications, billing receipts, responses to your inquiries).
- Respond to support and feedback requests.
- Maintain the security and integrity of the platform.
- Comply with legal obligations and facilitate legitimate ownership/stolen instrument investigations as outlined herein.
3. What Becomes Public
Wire & Wood is designed around shareable, verifiable certificates. When you generate a certificate for an item, the following information becomes accessible to anyone with the certificate's link (no account required), because that is the intended purpose of a verification certificate:
- Category, brand, model, year, and serial number.
- Photos and captions on record at the time of issuance.
- Story of the instrument and build notes.
- Registered owner name (as entered on your profile).
- Declared/insured value.
- Provenance history summary and certificate version history.
Note on Location: Location is never included on resale or public certificates, and is excluded from the public verification page regardless of certificate type, with the sole exception of insurance-type certificates, which are intended for you to share privately with an insurer rather than post publicly.
You control when certificates are generated and can choose what information to include in an item's story or build notes before doing so.
4. Administrative Searches, Lost/Stolen Lookups & Data Tiers
To protect user privacy while supporting lost or stolen instrument recovery, Wire & Wood categorizes data into distinct tiers and restricts administrative database searches accordingly:
Data Tier Classifications
| Tier | Category | Included Data |
|---|---|---|
| Tier 1 | Public Data | Category, brand, model, serial number, public photos, public story/notes, and generated public certificate snapshots. |
| Tier 2 | Private User Data | Storage location, acquisition details (acquired_from, date, location, purchase price), private originality notes, and owner contact details. |
| Tier 3 | Third-Party Records | External authentication records, appraisal PDFs, and third-party expert documentation uploaded by the owner. |
Scope of Administrative Searches & Inactive ("Dark") Accounts
Authorized administrators may perform internal searches across active and inactive, deactivated, or restricted ("dark") accounts when checking serial numbers for lost or stolen instruments. Accounts that have "gone dark" remain indexed in administrative searches because an inactive account may belong to someone hiding a disputed item as easily as someone who has simply stopped using the platform.
Trigger Thresholds for Data Disclosure
- Self-Reported Tips / Informal Inquiries: If a user or third party alerts us to a potential lost or stolen instrument, administrative searches will only verify serial numbers and cross-reference Tier 1 (Public) Data and the permanent Provenance Timeline. We will not disclose Tier 2 private acquisition/financial data or Tier 3 third-party documents based on informal tips or self-reported claims.
- Law Enforcement Requests & Compulsory Legal Process: We require a formal, official law enforcement request, subpoena, warrant, or court order before surfacing or disclosing Tier 2 Private Data (such as acquisition source, purchase price, or storage location) to law enforcement or third parties.
- Third-Party Authentication Records (Tier 3): Uploaded third-party documents (e.g., authenticator reports) represent the intellectual property and work product of external parties. We will only disclose Tier 3 records under compulsory legal process (e.g., a subpoena or court order specifically naming those documents) or with the explicit written consent of the originating authenticator or account holder.
Authoritative Record & Audit Trail Logging
- Authoritative Record: In any dispute or legal inquiry, the timestamped, immutable Provenance Timeline (who changed what when) and frozen Certificate Snapshots serve as the official, authoritative historical record.
- Admin Audit Logging: All administrative searches, lookup queries, and data disclosures are permanently logged in an internal audit log (recording the searching administrator ID, target serial number/parameters, timestamp, and legal case reference) to ensure strict oversight and accountability.
5. Ownership Transfer
If you initiate an ownership transfer, we share the item's provenance record with the email address you provide for the recipient, and that person will need to create a Wire & Wood account to claim it. Once claimed, the new owner gains access to the item's full history, which is preserved and passed on as part of the item's permanent record.
6. Account Deactivation ("Going Dark")
You may deactivate your account at any time from Account Settings. Deactivating your account:
- Immediately cancels any active subscription.
- Blocks your ability to log in.
- Does not delete your data. All items, photos, provenance history, and issued certificates remain fully intact and continue to be publicly verifiable, because this information forms part of the permanent record of the instruments themselves, which may be relied upon by future owners, buyers, or insurers.
To reactivate a deactivated account, contact us through the Contact / Feedback form. We do not offer permanent account or data deletion, because doing so would break the integrity of the provenance chain for instruments that may have changed ownership or been relied upon by third parties. If you have concerns about specific data, please contact us to discuss available options.
7. Data Export
You may export your own collection data (the fields you choose) as a CSV file at any time from Account Settings.
8. Third-Party Service Providers
We rely on the following third parties to operate Wire & Wood. Each processes data on our behalf under their own privacy and security practices:
- Supabase: Database, authentication, and file storage.
- Stripe: Payment processing and subscription billing.
- Resend: Transactional email delivery.
- Lovable: Application development platform.
We do not sell your personal information to third parties, and we do not use your data for advertising purposes.
9. Data Security
We use industry-standard measures to protect your information, including encrypted connections, database-level access controls, and restricted administrative access. No method of storage or transmission is 100% secure, and we cannot guarantee absolute security.
10. Your Choices and Rights
Depending on your location, you may have rights to access, correct, or request information about the personal data we hold about you. Because of the permanent-record nature of provenance and certificate data described above, some information (particularly data already reflected in an issued certificate or another user's provenance chain) may not be eligible for deletion. Contact us through the Contact / Feedback form with any requests, and we will respond as required by applicable law.
11. Children's Privacy
Wire & Wood is not directed at children under 13 (or the relevant minimum age in your jurisdiction), and we do not knowingly collect personal information from children.
12. International Users
Wire & Wood is operated from the United States. If you access the service from outside the United States, your information will be processed in the United States, which may have different data protection laws than your home country.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated version on this page with a revised "Last Updated" date.
14. Contact Us
Questions about this Privacy Policy or your data can be sent through the Contact / Feedback form in your account, or by emailing info@wirenwood.com.