Privacy Policy

This Privacy Policy explains how Ahmed Sohail Malik, an independent app developer ("Toydex", "we", "us", or "our"), handles information in connection with the Toydex mobile application for iOS (the "App").

Toydex does not require you to create an account, and we do not sell your personal information. Your collection is stored on your device and backed up to our cloud service so it can be restored if you reinstall the App on the same device. On first launch the App asks for tracking permission; if you grant it, we use your device's advertising identifier to measure which marketing campaign led to your install.

1. Who We Are (Data Controller)

Toydex is developed and operated by an individual developer. For the purposes of the EU/UK General Data Protection Regulation ("GDPR"), the data controller is:

• Data controller: Ahmed Sohail Malik (individual developer)
• Contact: maximusislamabadg84@gmail.com

All privacy questions and requests should be sent to the email address above. We handle every request through email; there is no postal contact channel for this App.

2. Information We Process

2.1 Toy images you capture

When you scan a toy, the App captures an image using your device camera or an image you select from your photo library. That image is transmitted to our servers and/or our image-processing providers so we can:

• Identify the toy (for example, its name, brand, line or series, and year where available);
• Estimate its market value. Standard value estimates are generated by AI. If you have a Toydex Pro subscription and run a live price check, the App also searches the web for recent sold and listed prices for the identified toy; and
• Show a condition estimate — the toy's packaging condition (for example, sealed, box damaged, or loose) — together with a price-confidence letter and a rarity tier.

Toy images are ordinarily photographs of toys and their packaging and are not intended to contain personal information about you. Please avoid capturing faces, documents, or other personal content in the frame. We do not use toy images to identify individuals, and we do not collect biometric identifiers or facial recognition data.

Images are processed by our AI provider, OpenAI. OpenAI does not use data sent through its API to train its models, but may retain it for up to 30 days to monitor for abuse before deleting it.

A copy of each scanned image is retained in our cloud storage (Cloudflare R2) so that your scans and collection can be restored if you reinstall the App on the same device. Images are kept for as long as the associated toy remains in your collection, and are deleted when you delete that toy from the App, use Settings → Delete My Data, or ask us to delete your data (see Sections 8 and 9).

2.2 Collection data (on your device and in our cloud)

Toys you save, your collections, and any purchase prices you set are stored on your device and synchronized to our cloud database (Google Firebase Firestore) so your collection can be restored if you reinstall the App on the same device. This data is stored under an anonymous app-generated identifier tied to your device, not under your name or email address. A new device receives a new identifier, so a collection cannot be moved from one device to another.

Because this data is held in our systems, we are technically able to access it. We access it only to operate and troubleshoot the service, to investigate an issue you report to us, or where we are required to by law — never to build a profile of you or for advertising.

2.3 Technical and usage data

We and our service providers automatically process limited technical information so the App works, stays secure, and so we can fix problems:

• Device model, operating system version, App version, language and region settings;
• A non-permanent app-generated identifier or vendor identifier (IDFV);
• A device-integrity check (Firebase App Check using Apple's App Attest), which confirms that requests to our servers come from a genuine copy of the App on a genuine Apple device. It is used for security only and does not identify you;
• Short-lived usage counts tied to your installation's identifier, used to prevent abuse and deleted after 30 days;
• Crash logs, error reports, and performance diagnostics;
• Aggregated in-app usage events (for example, number of scans performed, features opened);
• IP address, which may indicate approximate country-level location. We do not collect precise GPS location.

2.4 Subscription and purchase data

Toydex offers a free tier and an optional paid subscription, Toydex Pro, available as Weekly and Yearly auto-renewing subscriptions. All purchases are processed by Apple through the App Store. We never receive or store your payment card number, billing address, or Apple ID password. We receive only the subscription status and anonymized transaction receipt needed to unlock paid features and handle refunds or restore-purchase requests. See Apple's Privacy Policy.

2.5 Information you send us voluntarily

If you contact support, submit feedback, report a mis-identified toy, or request data deletion, we process the email address and any content you choose to include, solely to respond to you.

2.6 Camera and photo library permissions

The App requests access to your camera to scan toys, and optionally to your photo library if you choose to import an existing image. We access only the specific images you capture or select. You can revoke these permissions at any time in iOS Settings → Privacy & Security; scanning features will not work without camera access.

2.7 Push notifications

The App registers with Firebase Cloud Messaging and stores the resulting device token so we can send you notifications. The token identifies your installation for delivery only; it does not contain your name, email, photos, or collection. You only see notifications if you allow them, and you can turn them off at any time in iOS Settings → Notifications → Toydex.

3. What We Do Not Do

• We do not sell your personal information.
• We do not share your personal information with third parties for their own advertising or marketing.
• We do not use your toy images or collection data to build advertising profiles about you.
• We do not use your toy images to train AI models (see Section 5).
• We do not collect precise GPS location, biometric identifiers, or facial recognition data.
• We do not knowingly collect data from children (see Section 10).

3.1 Advertising identifier and App Tracking Transparency

The App presents Apple's App Tracking Transparency ("ATT") prompt when you first open it, and links Apple's AdSupport framework in order to do so.

• If you allow tracking: the App may access your device's Advertising Identifier (IDFA) and include it in the install-attribution data we send to our attribution provider, AppsFlyer. We use this to understand which marketing campaign led to your install and how our advertising performs.
• If you decline: no IDFA is collected, and attribution is performed without it. Declining has no effect on your ability to use any feature of the App.

The App briefly waits for your response to the ATT prompt before sending its first attribution event, so that the event reflects the choice you actually made. You can change your decision at any time in iOS Settings → Privacy & Security → Tracking.

Separately from attribution, we use product analytics (Firebase Analytics and Mixpanel) to understand how features are used within the App. These are not used to track you across other companies' apps or websites.

4. Why We Process Your Data and Our Legal Bases (GDPR)

• Identify scanned toys, return value estimates, condition estimates, and rarity tiers, and run Pro live price checks
  • Data used: Toy images, technical data
  • Legal basis: Performance of a contract (Art. 6(1)(b))
• Operate, secure, and troubleshoot the App, verify app integrity, and prevent abuse
  • Data used: Technical data, crash logs, App Check results, usage counts
  • Legal basis: Legitimate interests (Art. 6(1)(f))
• Send push notifications
  • Data used: Firebase Cloud Messaging device token
  • Legal basis: Consent, given through iOS notification permission (Art. 6(1)(a)); legitimate interests for token storage (Art. 6(1)(f))
• Improve product features
  • Data used: Aggregated usage data
  • Legal basis: Legitimate interests (Art. 6(1)(f))
• Measure marketing campaigns (install attribution)
  • Data used: Install attribution data; IDFA only where you have allowed tracking
  • Legal basis: Consent for IDFA (Art. 6(1)(a)); legitimate interests otherwise (Art. 6(1)(f))
• Provide and manage subscriptions
  • Data used: Subscription status, receipt data
  • Legal basis: Performance of a contract (Art. 6(1)(b))
• Respond to support requests
  • Data used: Email address, message content
  • Legal basis: Legitimate interests / consent (Art. 6(1)(a)/(f))
• Comply with legal obligations and enforce our terms
  • Data used: As required
  • Legal basis: Legal obligation, legitimate interests (Art. 6(1)(c)/(f))

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

5. Model Training

We do not use your scanned toy images or collection data to train or improve AI models. Images are sent to our AI provider only to identify the toy and estimate its value, condition, and rarity for you. OpenAI does not train its models on data sent through its API, but may retain it for up to 30 days to monitor for abuse. If we ever want to use images to improve recognition, we will update this policy and ask for your permission in the App before doing so.

6. Who We Share Data With

We share data only with service providers ("processors") that help us run the App, under terms requiring them to protect it and to use it only on our instructions:

• Cloud hosting and database: Google Cloud / Google Firebase (Firestore) — collection data
• Cloud object storage: Cloudflare R2 — scanned toy images
• AI / image recognition processing: OpenAI — retains API inputs for up to 30 days for abuse monitoring and does not train on them
• App integrity: Firebase App Check, using Apple App Attest
• Push notifications: Firebase Cloud Messaging
• Crash reporting: Apple App Analytics, Firebase Crashlytics
• Product analytics: Firebase Analytics, Mixpanel
• Install attribution and marketing measurement: AppsFlyer (receives the IDFA only where you have allowed tracking — see Section 3.1)
• Payments and subscription management: Apple

7. International Transfers

Our service providers may store and process data in the United States and other countries, which may be outside the country where you live. Where personal data is transferred out of the EEA, UK, or Switzerland, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum. You can request details of the safeguards we use by emailing us.

8. How Long We Keep Data

• Scanned toy images (cloud storage): Retained for as long as the associated toy remains in your collection, so that your scans can be restored after a reinstall on the same device. Deleted when you delete the toy in the App or use Settings → Delete My Data, or within 30 days of a verified email deletion request.
• Images and data sent to OpenAI: Retained by OpenAI for up to 30 days for abuse monitoring, then deleted
• Collection data on your device: Until you delete it, use Settings → Delete My Data, or uninstall the App
• Collection data in our cloud database: Retained so your collection can be restored after a reinstall on the same device. Deleted when you delete the toy in the App or use Settings → Delete My Data, or within 30 days of a verified email deletion request. Uninstalling the App alone does not delete it.
• Usage counts (abuse prevention): Deleted after 30 days
• Push notification token: Until it is replaced by a new token, or deleted when you use Settings → Delete My Data or we process a deletion request
• Install attribution data (including IDFA where you have allowed tracking): 24 months
• Crash logs and diagnostics: 90 days
• Aggregated usage analytics: 24 months, in aggregate form
• Subscription and transaction records: As required by tax and accounting law, typically 7 years
• Support correspondence: 24 months after the matter is closed

9. Your Rights

9.1 If you are in the EEA, UK, or Switzerland (GDPR)

You have the right to: access your personal data; request rectification of inaccurate data; request erasure; request restriction of processing; object to processing based on legitimate interests; receive your data in a portable format; withdraw consent; and lodge a complaint with your local supervisory authority. In the UK this is the Information Commissioner's Office.

9.2 If you are a California resident (CCPA/CPRA)

You have the right to know what personal information we collect and how it is used and shared; the right to delete personal information; the right to correct inaccurate personal information; the right to opt out of the sale or sharing of personal information; the right to limit the use of sensitive personal information; and the right not to receive discriminatory treatment for exercising these rights.

We do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we have not done so in the preceding twelve months. We do not knowingly sell or share the personal information of consumers under 16 years of age. You may exercise your rights by emailing us; we will verify your request using the information reasonably available to us, which may be limited because the App does not use accounts.

9.3 Other US state privacy laws

Residents of states including Virginia, Colorado, Connecticut, Utah, and Texas have comparable rights to access, delete, correct, and port their data, and to opt out of targeted advertising and profiling. We honor these rights through the same contact channel.

9.4 How to exercise your rights

Delete everything in the App: open Settings → Delete My Data. In one tap it permanently removes your saved toys, collections, and photos from your device and our servers. We keep a record of your purchases for billing and refunds, and short-lived usage counts (deleted after 30 days) to prevent abuse; neither contains your photos or collection. Crash diagnostics, aggregated analytics, and attribution data held by our providers are kept for the periods listed in Section 8.

You can also delete individual toys inside the App. Uninstalling the App removes the copy on your device but does not delete the backup on our servers, so use Delete My Data before uninstalling if you want everything gone.

For any other request, or if you can no longer open the App, email maximusislamabadg84@gmail.com with the subject line "Privacy Request". We will respond within 30 days (or 45 days for CCPA requests, extendable where permitted). Exercising these rights is free unless a request is manifestly unfounded or excessive.

10. Children's Privacy

Toydex is not directed to children under 13 (or under 16 in the EEA/UK), and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

11. Security

We use industry-standard safeguards including TLS encryption in transit, encryption at rest for stored images, app-integrity checks on requests to our servers, restricted access to production data, and regular review of our providers' security posture. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and the relevant authorities where required by law.

12. Third-Party Services and Links

Standard value estimates shown in the App are generated by AI. Live price checks available with Toydex Pro search the web for recent sold and listed prices. Both are provided for informational purposes only; they are estimates, not appraisals or financial advice. Condition estimates, price-confidence letters, and rarity tiers are AI predictions, not official grades, and Toydex does not grade toys in the way AFA, CAS, CGA, or any other grading company does. Toydex is not affiliated with, endorsed by, or sponsored by any grading company, toy manufacturer, brand owner, or marketplace. The App may link to third-party sites governed by their own privacy policies.

13. Apple App Store Disclosures

Our App Store privacy labels reflect the practices described here. The App presents Apple's App Tracking Transparency prompt on first launch and, if you grant permission, may use the Advertising Identifier (IDFA) for install attribution as described in Section 3.1. You can withdraw that permission at any time in iOS Settings → Privacy & Security → Tracking.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised version at this URL and update the "Last updated" date. If changes are material, we will provide notice in the App before they take effect. Continued use of the App after the effective date means you accept the updated policy.

15. Contact Us

For any questions, complaints, or privacy requests relating to Toydex, contact:

• Developer: Ahmed Sohail Malik
• Email: maximusislamabadg84@gmail.com