Privacy Policy

Last updated: October 13, 2026

Ampfora ("we," "us") is operated by Reach Mobile, LLC and is currently a private beta. This policy explains what we collect, why, and the choices you have.

What we collect

• Account: your name and email from Apple or Google Sign In.
• Your content: photos you capture or upload (including receipts you choose to photograph or paste in), documents you attach to a piece (an appraisal, a receipt, a certificate, a deed, a survey, a policy), the items, how many of each you own, values, notes, stories, and target prices you save, and voice notes you record about a piece.
• Purchase details: if you photograph a receipt or paste one in from an email, we read the price, date, and place of purchase from it so your records are complete. The text of a pasted receipt is used only to read it, and only what we read from it is kept. You can edit or remove these at any time. We do not read figures out of a document you attach: an attached file is kept as evidence you already had, not mined for numbers.
• Insurance details, if you give them: your insurer's name, your agent's email address, the category limits you copy off your declarations page with the date you entered them, and three fields that let your agent file the document without coming back to you: the named insured, your policy or account number, and the address where the pieces are kept. We use these to read your own policy's figures instead of a standard form's, to address the rider email you send, and to print page one of your document. We never contact your insurer or your agent ourselves, and we fetch nothing from them. Leave any of them blank and the document prints a blank line instead.
• What happened to a piece that left: if you record a sale, a gift, a loss or a theft, we keep which of those it was and, for a sale, the date, the price and where you sold it. A price here is optional.
• Addresses and vehicle details: if you file a home or a parcel, we keep the address you enter so we can show the right local price index and the right lookup links. Tapping one of those links sends the address to that site (for the county record, to a Google search). If you file a car, we keep the VIN and mileage you enter so it can be priced. If you file a boat, an aircraft or a machine, we keep the hours you enter.
• Corrections: when you correct or confirm an identification, we keep the before-and-after (never including any price you paid) to make identification more accurate.
• Usage & diagnostics: how the app is used (analytics), crash reports, and basic device info. We also keep the day you last opened the app and the day you last exported your papers. The first is what tells us you have gone quiet, which matters only if you have asked a key to outlive your silence (below); the second is so we can tell you when the copy somebody else holds has gone out of date. Neither is shared with anyone.
• Notifications, if you allow them: a token from your phone that lets us deliver a price alert you asked for. If you never allow notifications there is no token and no alert. If you turn them off later, iOS stops showing them, but the token stays on file and a price alert you set is still sent to it until you clear that price or delete your account.

About your agent's email address. It belongs to someone else, so we treat it narrowly: it is used to address an email you choose to send, it is never shared with anyone, it is never used to contact them on our own behalf, and clearing the field removes it.

We do not collect your contacts or precise location, and we never run facial recognition.

How we use it

To identify and value your pieces, run the app's features, keep it reliable, and improve it. We do not sell your personal information and we show no third-party advertising.

Sharing you start

Nothing in Ampfora is public, and nothing is shared unless you start it:

• Sharing your collection: if you invite someone, they see the pieces you share. Values are hidden unless you turn them on, and so is who each piece is meant for: you can choose to show that too, in which case they also see any note you have left that person, including a note meant for somebody else. A piece you have held back stays hidden either way. You can revoke access at any time. When a key you gave stops working, whether you revoked it or it simply lapsed, the person holding it sees that the collection is no longer shared with them and the day it ended. They are never told which of the two happened.
• A professional's copy: you can give a named attorney, agent or executor a standing read-only view of your schedule. It always carries values, because a schedule without them is not a schedule, and the app says so when you create it. You can also choose to show who each piece is meant for, along with any note you have left them. You can see the key exists, see the day it was last opened, and revoke it at any time.
• Letting someone add to your record: on a key you choose, the person holding it can add a piece or a care note to your record. Each addition is marked as theirs, and they can never change or remove anything of yours. It is off unless you turn it on for that key.
• Household papers: on a key you choose, your pieces can count in that person's own Papers and coverage read: the photograph, the name and description, how it came to you, the serial number and the condition, with values only if that key already shows them. A piece you have held back stays out, and so do a property's street address and where you keep things. It is off unless you turn it on for that key.
• If you go quiet: on any key you have already given someone, you can ask that it start showing your estate record, which is who each piece is meant for and any note you have left them, if you stop opening the app. You arm it yourself, per key, and it is off unless you do. Nothing happens for six months of silence; then we email you three times over about a month; then, only if all three were sent and none brought you back, that one key starts showing it. Opening the app resets the clock at any point and closes it again if it had opened, and the app tells you plainly that it happened. It never creates access, never reaches anyone you have not already named, and never touches a piece you have held back. Nobody can start it but you, there is no way for anyone to claim your record by presenting a document, and deleting your account removes it with everything else.
• A shelf a few collectors share: you can start a group, or join one with a code somebody sends you. Everybody in it sees the pieces that are on the shelf, as a photograph and a name. No prices ever travel: the group read carries no value of any kind, so nobody there can see what anything of yours is worth. You choose what the group sees of yours: only the pieces you pick, one at a time, or everything you own, and you can change that whenever you like. A piece you have held back stays hidden either way. Anyone with the code can join, so the number of people who can see your shelf can grow; if you started the group you can rotate the code, which stops new people and removes nobody. Leaving takes your pieces off the shelf straight away. Only the main photograph of a piece is visible, never your close-ups, your receipts or your documents.
• The rider email: when you send it, you send it. It goes from your own mail app to the address you chose, and we do not send mail on your behalf.
• A record of what has left: when you export Papers, a single piece's plate, a donation record or your data, send the rider email, share a card, or cut or end a key, Ampfora writes one line in your own record of it: what it was, the day, the piece's name where it concerned one, and your own words for who it was for. It is yours alone, nobody you let in can read it, and nothing in it can be edited or removed, which is the point of keeping it. It records that the document was made and handed to your phone; it cannot know whether the person opened it, and the app says so where you read it. Deleting your account removes it with everything else.
• Duels: a friendly market game. Your rival sees only the name you type for yourself and the market models you both pick. Your collection, your photos, and your values never cross.

Who processes your data

We share only what's needed with providers who process data on our behalf:

• Supabase: hosting, database, storage, and sign-in.
• Anthropic: AI identification; the photos and item details you submit, and the text of any receipt you paste in, are sent to generate a result.
• Remove.bg: background removal when you beautify a photo (the image is sent for that step).
• eBay: market price lookups (item details only; no personal information is sent).
• Serper: web search for cited retail references (item names only; no personal information is sent).
• metals.dev: daily precious-metal prices (no personal information is sent).
• MarketCheck: car valuations (the VIN, mileage, and a postal code are sent; your name and contact details are not).
• NHTSA vPIC: decodes a VIN into its year, make, model and trim (the VIN only; a free United States government service).
• US Census Bureau geocoder: completes a street address you type into its full form with its ZIP code and county (the address only; a free United States government service).
• RentCast: home valuations and county property records (the property address is sent; your name and contact details are not). We request the owner name the county holds for an address you filed as your own, and we store it only if you confirm it is right. We never store the owner mailing address it returns.
• Resend: sends the warning emails described above, and only those. They go to you, at the address on your account, and only if you armed a key to outlive your silence. We send no other mail, and we never email anyone else about you.
• Expo: delivers a price alert you turned on to your phone through Apple's notification service (your phone's notification token, an identifier for this install, and the alert itself, which names the piece, its current reading and the price you set), and answers the app's check for updates (an identifier for this install, the app's version and update status, and, after a crash, the error message; no account details).
• Getty Research Institute (ULAN): checks an artist or maker name against its public list when you view or confirm one (the name only; a free public service).
• PostHog: product analytics. Sentry: crash diagnostics.

Each is bound to use the data only to provide its service to us.

How it's protected

Data is encrypted in transit. Your photos and voice notes live in private storage, and database access is row-secured: only you can see your data, unless you choose to share it as described above. You can also switch on a lock so Ampfora asks for Face ID, Touch ID or your passcode when you open it, which keeps your collection closed if you hand someone your unlocked phone. It is a door rather than a safe: it does not encrypt anything, and it cannot reach papers you have already exported or a key you have already given. It is off unless you turn it on, it stays on your phone, and we are never told whether you use it.

Your choices

Remove any item at any time, sign out from the You screen, or delete your account in-app. You can also email us to request a copy of your data.

Retention

We keep your data while your account is active. On a deletion request we remove your account data within 30 days, except where the law requires us to keep it.

Children

Ampfora is for adults (18+) and is not directed to children.

Changes & contact

We'll update this policy as the app evolves and revise the date above. Questions: support@ampfora.com.