Privacy Policy

1. Who this covers

This policy explains what Gems Guild collects when you browse the marketplace, register as a seller, or are recorded as a buyer by a seller. Gems Guild is a listing platform based in Sri Lanka.

2. If you are just browsing

You do not need an account to browse gems. We do not ask visitors for a name, email or phone number.

We use Google Analytics (loaded through Google Tag Manager) to understand which pages and gems are popular. This sets cookies in your browser and shares standard analytics data — pages viewed, approximate location, device and browser type — with Google. You can block these with any cookie- or script-blocking browser setting or extension without losing access to the site.

Some listings link a seller's YouTube video. Nothing is requested from YouTube unless you press play — the preview you see first is the seller's own photograph. If you do play it, YouTube receives the request and may set its own cookies, under Google's privacy terms.

3. If you register as a seller

We store the details you provide: your email address, shop name, shop description, shop logo, WhatsApp number, location, and any social media handles you add.

Your password is never stored. We keep only a bcrypt hash of it, which cannot be reversed. If you enable two-factor authentication we also store the secret your authenticator app uses and hashes of your backup codes.

We record the date you accepted the Seller Terms and which version, and we count failed login attempts so accounts can be locked temporarily after repeated failures.

4. If you buy a gem

Buyers do not create accounts. When you contact a seller it happens on WhatsApp, outside this platform — your conversation is between you and the seller, and WhatsApp's own privacy terms apply.

If the seller later records the sale in their dashboard, they may enter your name and a contact detail against that gem so they have a record of who bought it. That information is visible to that seller and to the site administrator. It is not shown publicly and is not shared with other sellers.

5. Cookies we set ourselves

A `session` cookie is created when you sign in as a seller or administrator. It is httpOnly, lasts seven days, and exists only to keep you logged in. A short-lived `preauth2fa` cookie is used for five minutes during two-factor sign-in.

Your light or dark theme preference is stored in your browser's local storage, not sent to us. We do not use advertising or cross-site tracking cookies of our own.

6. Where your data is held

The site and its database run on Railway's infrastructure in Singapore. Uploaded gem photographs, videos and shop logos are stored on the same server.

Encrypted backups of the database and uploaded files are taken nightly and stored with GitHub so the marketplace can be restored after a failure. Backups are kept for thirty days and then deleted automatically.

7. What we never do

We do not sell your data, rent it, or share it with advertisers. We do not process payments, so we never see card or bank details — payment is arranged directly between buyer and seller.

8. Keeping it secure

All traffic is served over HTTPS. Passwords are hashed, seller accounts can be protected with two-factor authentication, and repeated failed logins lock an account temporarily.

No system is perfectly secure, but if a breach affects your personal information we will tell you promptly.

9. Your choices

Sellers can view and change their own details at any time from the shop profile page, and change their password there.

You can ask us for a copy of the information we hold about you, ask us to correct it, or ask us to delete your account and its data. Contact us using the details on our contact page. Some records may be retained where we are required to keep them, and copies persist in backups until those backups expire.

10. Children

This marketplace is intended for adults trading gemstones. We do not knowingly collect information from children.

11. Changes

If we change this policy we will update the version and date at the top of this page. Material changes affecting sellers will be communicated to them directly.