Privacy Policy

Data controller: ToyVault
Privacy contact: privacy@toyvault.app

For access, correction, deletion, or other privacy requests, email privacy@toyvault.app.

You can browse the public catalog without an account. In that case we only process limited technical data needed to run the site (see our Cookie Policy).

If you create an account, we process the data you provide to use the service: email and password, profile details, collection and wishlist, Marketplace listings and messages, catalog suggestions, and notifications. We may email you about your account and Marketplace alerts.

Public profiles: if you make your profile public, other members may see your profile and collection. Catalog pages may show anonymous have/want counts from public profiles only. You can switch back to private in account settings.

We do not sell your personal data and we do not use advertising or behavioural tracking cookies.

• To provide the service (GDPR Art. 6(1)(b)): your account, collection, Marketplace, and related emails.
• To run the community catalog (Art. 6(1)(b) and/or 6(1)(f)): reviewing suggestions and showing public profiles you enable.
• Security and legal obligations (Art. 6(1)(f) and 6(1)(c)): keeping the service safe and complying with the law.
• Site analytics (Art. 6(1)(f)): privacy-friendly page-view statistics and Core Web Vitals, without advertising or cross-site tracking.

We use service providers to operate ToyVault:

• Supabase — accounts, database, and file storage
• Vercel — hosting, privacy-friendly analytics, and Speed Insights
• Apple iCloud Mail — sending transactional email

We may fetch public eBay sold-listing data to calculate catalog market values (a two-year average of matching sales). That does not share your account data with eBay.

We may disclose data if required by law or to protect users and the public.

Some providers may process data outside the EEA. Where that happens, we rely on appropriate safeguards such as EU Standard Contractual Clauses or adequacy decisions.

We keep account and related data until you delete it or ask us to erase your account, plus a short period for backups and legal obligations. We may keep catalog contributions and moderation records as needed for the integrity of the database.

If you are in the EEA, UK, or Switzerland you can ask to access, correct, delete, or export your data, and to object to certain processing. Email privacy@toyvault.app. We may need to verify your identity and aim to respond within one month.

You can also lodge a complaint with your local data protection authority. Our lead authority is the Autoriteit Persoonsgegevens (AP), Netherlands.

ToyVault is not directed at children under 16. If you believe a child has provided us data, contact us and we will delete it.

We use encrypted connections (HTTPS) and access controls. No service is 100% secure; please use a strong, unique password.

We may update this policy from time to time. The date at the top will change when we do.