Privacy

Last updated: October 18, 2026

We collect only what we need to get your coins to you, and we never sell it. There are no ad trackers, no analytics profiles and no mailing lists you didn't ask for. Here is exactly what we keep, and why.

Never soldNot to advertisers, not to anyone.

No trackersOnly the cookies the site needs to work.

Yours to controlSee, correct or delete it on request.

What we collect

When you order: your name, email, phone, shipping address and what you bought. We need these to ship to you and to contact you about your order.
When you pay: for e-Transfer, the reference your bank sends us. For cards, Stripe handles the payment on its own secure page. We never see or store card numbers.
If you create an account: your name, email, phone number, password (stored only in scrambled form, which we can't read) and preferred language. We don't verify your phone number; we ask for it so we can reach you about an order and to help stop fraud. We also keep a dated record of your sign-up (time, IP address, browser and the version of our Terms you accepted) as proof of your agreement and to protect your account.
If you choose to sign in with Google (optional; an email and password always work too): Google sends us your name, your email address and the permanent account ID it uses for you. We use the ID only to recognise you when you sign in, and the name and email only to set up or match your account. We don't receive your Google password, contacts or photos, and we never post anything for you.
Sign-in security record: when two-step verification changes, backup codes are used or replaced, trusted devices are cleared, a sign-in is locked after too many wrong codes, an account is reset after email proof, or Google sign-in is linked or removed, we log the time, IP address and browser to protect your account.
If you enter a giveaway: your email and preferred language.
When you message us: your name, email and message.
Automatically: your IP address when you order or send a message, which we use only to stop fraud and spam.

How we use it

We use it to process, ship and support your order, to answer your messages, to prevent fraud, to run giveaways you've entered, and to keep the records Canadian tax law requires. That's all. We don't send marketing emails unless you ask for them.

We share the minimum needed with:

Canada Post or another carrier: your name, address and phone, to deliver your parcel.
Stripe, if you pay by card, to process the payment.
Our web and email host, which stores the site and its data on our behalf.
Google, only if you choose to sign in with Google. You sign in on Google's site, so Google knows you are signing in to Canada Coin Vault. We don't send Google anything from your account.

Some of these providers may store data outside Québec and Canada, including in the United States or the European Union. Our payment and hosting providers are bound by contract to protect it and to use it only for the service they provide to us. Google (Google LLC) is based in the United States and may process your information outside Québec and Canada. It handles it as part of your own Google account, under the Google Privacy Policy. We never sell or rent your information to anyone.

Google sign-in is optional. We recognise you only by the account ID Google gives us, never by your email alone. If your Google email matches an existing Canada Coin Vault account, we link the two only after you prove the account is yours with its password (and two-step code, if it has one) or a one-time link we email you. The site's administrator account can't use Google sign-in at all.

To unlink: sign in, go to Account → Sign-in & security, enter your password and choose Remove Google sign-in. If you've never set a password, set one there first so you can still get in. Removing it deletes the link from our records right away; your Canada Coin Vault account stays. You can also remove our access from your side in your Google Account's security settings.

Cookies

We use only essential cookies: one that keeps your cart and sign-in working, and one that remembers your language. We use no advertising or tracking cookies, so there's nothing to opt out of.

How long we keep it

We keep order records for six years, as Canadian tax law requires. We keep your account until you ask us to delete it, or until three years after your last sign-in; your sign-up record is kept with it, or for six years if you placed an order. Messages are kept until they're resolved, and for two years at most. Consignment documents are kept for the length of the agreement plus six years. If you sign in with Google, we keep the link (the account ID and the email it had when you linked it) until you remove it or your account is deleted. Backup copies are replaced on a rolling basis and kept for twelve months at most. You can ask us to delete your information sooner, and we will unless the law requires us to keep it.

How we protect it

The whole site runs over an encrypted connection. Passwords are stored only in scrambled form that no one, including us, can read, and password-reset links work once and expire. Access to order data is limited to the people who pack and ship your order. In the unlikely event of a breach that could harm you, we'll notify you and the Commission d'accès à l'information du Québec promptly, as the law requires.

Your rights

You can ask to see what we hold about you, to correct it, to delete it, to get a copy in a portable format, or to withdraw your consent, subject only to the records the law requires us to keep. Write to hello@canadacoinvault.com and we'll respond within 30 days, usually much sooner.

If you're not satisfied, you can contact the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.

Who is responsible

The owner of Canada Coin Vault is personally responsible for protecting your personal information. Reach them at hello@canadacoinvault.com, Vaudreuil-Dorion, Québec, Canada.