Privacy Policy

This Privacy Policy explains how Ahmed Sohail Malik, an independent app developer ("ToyGem", "we", "us", or "our"), handles information in connection with the ToyGem mobile application for iOS (the "App").

ToyGem does not require you to create an account, and we do not sell your personal information. Your collection is stored on your device and backed up to our cloud service so it can be restored if you reinstall the App on the same device. The free version of the App shows ads; ToyGem Pro has none. On first launch the App asks for tracking permission; if you grant it, we use your device's advertising identifier to measure our marketing and to show ads that fit you.

1. Who We Are (Data Controller)

ToyGem is developed and operated by an individual developer. For the purposes of the EU/UK General Data Protection Regulation ("GDPR"), the data controller is:

• Data controller: Ahmed Sohail Malik (individual developer)
• Contact: maximusislamabadg84@gmail.com

All privacy questions and requests should be sent to the email address above. We handle every request through email; there is no postal contact channel for this App.

2. Information We Process

2.1 Toy images you capture

When you scan a toy, the App captures an image using your device camera or an image you select from your photo library. If the App needs a closer look, it may ask you for one more photo, such as a tag, the base, or the box number. These images are transmitted to our servers and/or our image-processing providers so we can:

• Identify the toy (for example, its name, brand, line or series, and year where available). If the App can't identify a toy, the name you type is sent to our AI provider together with the photos;
• Estimate its market value. Standard value estimates are generated by AI. Live market checks — available with ToyGem Pro and on a free user's first scans — also search the web for recent sold and listed prices for the identified toy and show their sources; and
• Show a condition estimate: a price range for each of four conditions (sealed in box, box damaged, loose and complete, and loose with parts missing), together with a price-confidence letter and a rarity tier.

Toy images are ordinarily photographs of toys and their packaging and are not intended to contain personal information about you. Please avoid capturing faces, documents, or other personal content in the frame. We do not use toy images to identify individuals, and we do not collect biometric identifiers or facial recognition data.

Images are processed by our AI provider, OpenAI. OpenAI does not use data sent through its API to train its models, but may retain it for up to 30 days to monitor for abuse before deleting it.

A copy of each scanned image of a toy you save is retained in our cloud storage (Cloudflare R2) so that your scans and collection can be restored if you reinstall the App on the same device. Only photos of toys you save are backed up; a scan you close without saving is not uploaded to our storage. Images are kept for as long as the associated toy remains in your collection, and are deleted when you delete that toy from the App, use Settings → Delete My Data, or ask us to delete your data (see Sections 8 and 9).

2.2 Collection data (on your device and in our cloud)

Toys you save, your collections, and any purchase prices you set are stored on your device and synchronized to our cloud database (Google Firebase Firestore) so your collection can be restored if you reinstall the App on the same device. This data is stored under an anonymous app-generated identifier tied to your device, not under your name or email address. A new device receives a new identifier, so a collection cannot be moved from one device to another.

Because this data is held in our systems, we are technically able to access it. We access it only to operate and troubleshoot the service, to investigate an issue you report to us, or where we are required to by law — never to build a profile of you or for advertising.

2.3 Technical and usage data

We and our service providers automatically process limited technical information so the App works, stays secure, and so we can fix problems:

• Device model, operating system version, App version, language and region settings;
• A non-permanent app-generated identifier or vendor identifier (IDFV);
• A device-integrity check (Firebase App Check using Apple's App Attest), which confirms that requests to our servers come from a genuine copy of the App on a genuine Apple device. It is used for security only and does not identify you;
• Short-lived usage counts tied to your installation's identifier, used to prevent abuse and deleted after 30 days;
• Anonymous, aggregated scan counts (which toys are scanned, counted once per installation using a one-way code, kept 9 days) to build the Most Scanned This Week list;
• Crash logs, error reports, and performance diagnostics;
• Aggregated in-app usage events (for example, number of scans performed, features opened);
• IP address, which may indicate approximate country-level location. We do not collect precise GPS location.

2.4 Subscription and purchase data

ToyGem offers a free tier, which includes one free scan a day and shows ads, and an optional paid subscription, ToyGem Pro, available as Weekly and Yearly auto-renewing subscriptions. All purchases are processed by Apple through the App Store. We never receive or store your payment card number, billing address, or Apple ID password. We receive only the subscription status and anonymized transaction receipt needed to unlock paid features and handle refunds or restore-purchase requests. See Apple's Privacy Policy.

2.5 Information you send us voluntarily

If you contact support, submit feedback, report a mis-identified toy, or request data deletion, we process the email address and any content you choose to include, solely to respond to you.

2.6 Camera and photo library permissions

The App requests access to your camera to scan toys, and optionally to your photo library if you choose to import an existing image. We access only the specific images you capture or select. You can revoke these permissions at any time in iOS Settings → Privacy & Security; scanning features will not work without camera access.

2.7 Push notifications

The App registers with Firebase Cloud Messaging and stores the resulting device token so we can send you notifications. The token identifies your installation for delivery only; it does not contain your name, email, photos, or collection. The App may also schedule an on-device reminder when your free daily scan is available. You only see notifications if you allow them, and you can turn them off at any time in iOS Settings → Notifications → ToyGem.

3. What We Do Not Do

• We do not sell your personal information.
• We do not use your toy images or collection data to build advertising profiles about you.
• We do not use your toy images to train AI models (see Section 5).
• We do not collect precise GPS location, biometric identifiers, or facial recognition data.
• We do not knowingly collect data from children (see Section 10).

3.1 Advertising, the advertising identifier and your choices

The free version of ToyGem shows ads. ToyGem Pro subscribers never see ads.

Ads are provided by Google AdMob, which may fill them through these ad networks: AppLovin, InMobi, Liftoff (Vungle), Meta Audience Network, Mintegral and Pangle (ByteDance). To show and measure ads, these companies may collect your device's advertising identifier (only if you allow tracking), an approximate location derived from your IP address, device and performance information, and information about the ads you see and tap. Each uses this under its own privacy policy; Google's is at https://policies.google.com/technologies/ads

Apple's tracking prompt: on first launch the App asks whether it may track you. If you allow it, the advertising identifier (IDFA) is used to show ads that fit you and, through AppsFlyer, to measure which campaign led to your install and purchases. If you decline, no IDFA is collected; you still see ads, but they are not personalised, and every feature works the same. Change this any time in iOS Settings → Privacy & Security → Tracking.

EEA, UK and Switzerland: before any ad is requested, the App asks for your consent using Google's consent form. You can accept, refuse, or choose per purpose, and change your choice any time in the App: Settings → Ad Privacy Choices. If you refuse, you may still see limited, non-personalised ads.

US states with privacy laws: you can opt out of the sale or sharing of your personal information for targeted advertising in the App: Settings → Ad Privacy Choices (where shown).

Product analytics (Firebase Analytics, Mixpanel) help us understand how features are used and are not used to track you across other companies' apps or websites.

4. Why We Process Your Data and Our Legal Bases (GDPR)

• Identify scanned toys, return value estimates, condition prices, and rarity tiers, and run live market checks
  • Data used: Toy images, any toy name you type, technical data
  • Legal basis: Performance of a contract (Art. 6(1)(b))
• Operate, secure, and troubleshoot the App, verify app integrity, and prevent abuse
  • Data used: Technical data, crash logs, App Check results, usage counts
  • Legal basis: Legitimate interests (Art. 6(1)(f))
• Show ads to free users
  • Data used: Device and ad interaction data; IDFA where you have allowed tracking
  • Legal basis: Consent in the EEA, UK and Switzerland, given in the consent form (Art. 6(1)(a)); legitimate interests elsewhere (Art. 6(1)(f))
• Build the Most Scanned This Week list
  • Data used: Anonymous, aggregated scan counts
  • Legal basis: Legitimate interests (Art. 6(1)(f))
• Send push notifications
  • Data used: Firebase Cloud Messaging device token
  • Legal basis: Consent, given through iOS notification permission (Art. 6(1)(a)); legitimate interests for token storage (Art. 6(1)(f))
• Improve product features
  • Data used: Aggregated usage data
  • Legal basis: Legitimate interests (Art. 6(1)(f))
• Measure marketing campaigns (install and purchase attribution)
  • Data used: Install attribution data and purchase events; IDFA only where you have allowed tracking
  • Legal basis: Consent for IDFA (Art. 6(1)(a)); legitimate interests otherwise (Art. 6(1)(f))
• Provide and manage subscriptions
  • Data used: Subscription status, receipt data
  • Legal basis: Performance of a contract (Art. 6(1)(b))
• Respond to support requests
  • Data used: Email address, message content
  • Legal basis: Legitimate interests / consent (Art. 6(1)(a)/(f))
• Comply with legal obligations and enforce our terms
  • Data used: As required
  • Legal basis: Legal obligation, legitimate interests (Art. 6(1)(c)/(f))

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

5. Model Training

We do not use your scanned toy images or collection data to train or improve AI models. Images are sent to our AI provider only to identify the toy and estimate its value, condition, and rarity for you. OpenAI does not train its models on data sent through its API, but may retain it for up to 30 days to monitor for abuse. If we ever want to use images to improve recognition, we will update this policy and ask for your permission in the App before doing so.

6. Who We Share Data With

We share data with service providers ("processors") that help us run the App, under terms requiring them to protect it and to use it only on our instructions. The ad networks that serve ads in the free version use the data they collect under their own privacy policies (see Section 3.1).

• Cloud hosting and database: Google Cloud / Google Firebase (Firestore) — collection data
• Cloud object storage: Cloudflare R2 — scanned images of toys you save
• AI / image recognition processing: OpenAI — retains API inputs for up to 30 days for abuse monitoring and does not train on them
• App integrity: Firebase App Check, using Apple App Attest
• Push notifications: Firebase Cloud Messaging
• Crash reporting: Apple App Analytics, Firebase Crashlytics
• Product analytics: Firebase Analytics, Mixpanel
• Advertising (free version): Google AdMob and, through it, AppLovin, InMobi, Liftoff (Vungle), Meta Audience Network, Mintegral and Pangle (ByteDance)
• Install attribution and marketing measurement: AppsFlyer, including purchase events for measuring campaigns (receives the IDFA only where you allowed tracking)
• Currency exchange rates: ExchangeRate-API (receives only an ordinary web request; no personal data)
• Payments and subscription management: Apple

7. International Transfers

Our service providers may store and process data in the United States and other countries, which may be outside the country where you live. Where personal data is transferred out of the EEA, UK, or Switzerland, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum. You can request details of the safeguards we use by emailing us.

8. How Long We Keep Data

• Scanned toy images (cloud storage): Only for toys you save. Retained for as long as the toy remains in your collection, so that your scans can be restored after a reinstall on the same device. Deleted when you delete the toy in the App or use Settings → Delete My Data, or within 30 days of a verified email deletion request.
• Images and data sent to OpenAI: Retained by OpenAI for up to 30 days for abuse monitoring, then deleted
• Collection data on your device: Until you delete it, use Settings → Delete My Data, or uninstall the App
• Collection data in our cloud database: Retained so your collection can be restored after a reinstall on the same device. Deleted when you delete the toy in the App or use Settings → Delete My Data, or within 30 days of a verified email deletion request. Uninstalling the App alone does not delete it.
• Usage counts (abuse prevention): Deleted after 30 days
• Most Scanned counts: 9 days
• Push notification token: Until it is replaced by a new token, or deleted when you use Settings → Delete My Data or we process a deletion request
• Advertising data held by ad networks: Under each network's own privacy policy
• Install attribution data (including IDFA where you have allowed tracking): 24 months
• Crash logs and diagnostics: 90 days
• Aggregated usage analytics: 24 months, in aggregate form
• Subscription and transaction records: As required by tax and accounting law, typically 7 years
• Support correspondence: 24 months after the matter is closed

9. Your Rights

9.1 If you are in the EEA, UK, or Switzerland (GDPR)

You have the right to: access your personal data; request rectification of inaccurate data; request erasure; request restriction of processing; object to processing based on legitimate interests; receive your data in a portable format; withdraw consent; and lodge a complaint with your local supervisory authority. In the UK this is the Information Commissioner's Office. You can withdraw or change your advertising consent at any time in the App: Settings → Ad Privacy Choices.

9.2 If you are a California resident (CCPA/CPRA)

You have the right to know what personal information we collect and how it is used and shared; the right to delete personal information; the right to correct inaccurate personal information; the right to opt out of the sale or sharing of personal information; the right to limit the use of sensitive personal information; and the right not to receive discriminatory treatment for exercising these rights.

The free version shows ads, which can count as "sharing" for targeted advertising under these laws. You can opt out in the App: Settings → Ad Privacy Choices (where shown), or by turning off tracking in iOS Settings → Privacy & Security → Tracking. We do not knowingly sell or share the personal information of consumers under 16 years of age. You may exercise your other rights by emailing us; we will verify your request using the information reasonably available to us, which may be limited because the App does not use accounts.

9.3 Other US state privacy laws

Residents of states including Virginia, Colorado, Connecticut, Utah, and Texas have comparable rights to access, delete, correct, and port their data, and to opt out of targeted advertising and profiling. The free version shows ads, which can count as targeted advertising under these laws. You can opt out in the App: Settings → Ad Privacy Choices (where shown), or by turning off tracking in iOS Settings → Privacy & Security → Tracking. We honor other requests through the same contact channel.

9.4 How to exercise your rights

Delete everything in the App: open Settings → Delete My Data. In one tap it permanently removes your saved toys, collections, and photos from your device and our servers. We keep a record of your purchases for billing and refunds, short-lived usage counts (deleted after 30 days) to prevent abuse, and the anonymous app identifier; none of these contains your photos or collection. Crash diagnostics, aggregated analytics, attribution data, and data held by ad networks are kept for the periods listed in Section 8.

You can also delete individual toys inside the App. Uninstalling the App removes the copy on your device but does not delete the backup on our servers, so use Delete My Data before uninstalling if you want everything gone.

For any other request, or if you can no longer open the App, email maximusislamabadg84@gmail.com with the subject line "Privacy Request". We will respond within 30 days (or 45 days for CCPA requests, extendable where permitted). Exercising these rights is free unless a request is manifestly unfounded or excessive.

10. Children's Privacy

ToyGem is not directed to children under 13 (or under 16 in the EEA/UK), and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we will delete it promptly. Ads in the App are limited to content suitable for general audiences.

11. Security

We use industry-standard safeguards including TLS encryption in transit, encryption at rest for stored images, app-integrity checks on requests to our servers, restricted access to production data, and regular review of our providers' security posture. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and the relevant authorities where required by law.

12. Third-Party Services and Links

Standard value estimates shown in the App are generated by AI. Live market checks, available with ToyGem Pro and on a free user's first scans, search the web for recent sold and listed prices and show their sources. Both are provided for informational purposes only; they are estimates, not appraisals or financial advice. Condition prices, price-confidence letters, and rarity tiers are AI predictions, not official grades, and ToyGem does not grade toys in the way AFA, CAS, CGA, or any other grading company does. ToyGem is not affiliated with, endorsed by, or sponsored by any grading company, toy manufacturer, brand owner, or marketplace. The App may link to third-party sites, and shows third-party ads, governed by their own privacy policies.

13. Apple App Store Disclosures

Our App Store privacy labels reflect the practices described here. The App presents Apple's App Tracking Transparency prompt on first launch and, if you grant permission, may use the Advertising Identifier (IDFA) for install attribution and advertising as described in Section 3.1. You can withdraw that permission at any time in iOS Settings → Privacy & Security → Tracking.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised version at this URL and update the "Last updated" date. If changes are material, we will provide notice in the App before they take effect. Continued use of the App after the effective date means you accept the updated policy.

15. Contact Us

For any questions, complaints, or privacy requests relating to ToyGem, contact:

• Developer: Ahmed Sohail Malik
• Email: maximusislamabadg84@gmail.com