Last updated: 06 October 2026
This Privacy Policy explains how Toyby ("Toyby," "we," "us," or "our") collects, uses, and shares information when you visit https://toyby.app (the "Website") or use the Toyby mobile and web applications (collectively, the "App"). Toyby is an AI-powered toy and collectible identifier: you photograph an item, and the App identifies it, estimates its value, grades its condition, and helps you track your collection.
By accessing or using the App or Website, you agree to this Privacy Policy and our Terms of Use. If you do not agree, please do not use Toyby.
1. Information We Collect
- Account and Profile Information: Email, username, and password when you register. The App also creates an anonymous account on first launch, which you can later convert to a registered account.
- Authentication Data: We maintain an authentication token to keep you signed in. On mobile, this token is stored in secure device storage.
- Content You Provide: Photos of toys and collectibles you take with your camera or choose from your photo library, the identification and appraisal results we generate from them, the collections you build, and the messages you send to the in-app assistant. This content is saved to your account so you can revisit it later.
- Shared Results: If you choose to share an appraisal, we create a public web page for it at
https://toyby.app/a/<id>. Anyone with the link can view that page, including the photo and result. Shared pages are not listed in search engines by us, and you can stop sharing at any time from the App. - Device and Usage Information: Device model, OS version, app version, IP address, language, in-app events, and general interaction data. We may infer coarse location from IP address; we do not collect precise GPS location.
- Crash and Performance Diagnostics: Crash reports and performance diagnostics to help us troubleshoot and improve stability.
- Push Notification Tokens: If you enable notifications, we collect a device push token to deliver them. You can disable notifications in your device settings.
- Purchase Information: Subscription and purchase status, entitlement information, and related identifiers necessary to provide paid features and restore purchases. In-app purchases are processed by Apple App Store or Google Play. Toyby does not receive full payment card details.
- Attribution Identifier: Toyby does not show advertisements. To measure which marketing campaigns lead to installs and purchases, we may read the device advertising identifier (IDFA on iOS, GAID on Android) for install attribution only. On iOS we ask for permission through the App Tracking Transparency prompt first; if you decline, the identifier is not used. You can reset or limit this identifier in your device settings.
- Email Communications: We use your email address to send account emails (verification, password reset, sign-in codes) and, where permitted, occasional product updates or reminders. Every marketing message includes an unsubscribe link.
- Cookies and Similar Technologies (Website): We use cookies and similar technologies on the Website for essential functionality, analytics, and preference storage. Your browser may offer controls to manage cookies.
Toyby does not ask for access to your contacts, microphone, or precise location. The camera and photo library permissions are used only to capture or select the photos you choose to analyze.
2. How We Use Information
- Provide, operate, and improve the App and Website
- Authenticate users, maintain sessions, and secure accounts
- Identify and appraise the items in your photos and answer your questions about them
- Process purchases, manage entitlements, and restore access
- Measure performance and usage (analytics) and improve quality (crash logs)
- Measure which marketing campaigns lead to installs, subject to consent where required
- Send service communications, updates, and, where permitted, marketing messages
- Comply with law, enforce terms, and protect the rights, safety, and security of users and the service
3. Legal Bases (EEA/UK users)
Where GDPR or similar laws apply, we rely on one or more of the following legal bases: performance of a contract, legitimate interests (e.g., to secure and improve the App), consent (e.g., cookies and tracking where required), and compliance with legal obligations.
4. Sharing and Disclosures
We do not sell your personal information. We may share information with:
- Service Providers: To host, process, and operate the App (e.g., backend, analytics, crash reporting, push messaging, email delivery, payments/subscriptions, install attribution). These providers process data on our behalf and, except for the attribution partner noted below, do not use it for their own purposes.
- AI Identification and Chat: The photos you submit for analysis and the messages you send to the in-app assistant are processed by third-party AI model providers (currently Google and OpenAI models) accessed through OpenRouter. They are used only to produce your result and are not used by us to train models.
- Reverse Image Matching: To find visually similar listings and comparable prices, the photo you submit is made available at a temporary web address and looked up through Google Lens via SerpAPI. Only the photo is shared; no account information accompanies it.
- Analytics: Google Firebase Analytics to measure feature usage and improve the App.
- Crash and Performance Monitoring: GlitchTip (a Sentry-compatible error tracker) to collect crash reports and performance diagnostics linked to your account ID.
- Subscription and Purchase Processing: RevenueCat to manage entitlements, link purchases to your account, and restore access.
- Install Attribution: Tenjin to measure which marketing campaigns lead to installs and purchases, using the advertising identifier where you have allowed it.
- Push Notifications: Google Firebase Cloud Messaging to deliver notifications to your device.
- Email Delivery: Brevo to send account emails and, where permitted, product updates.
- Backend and Storage: Our own API and database (PocketBase-based) and DigitalOcean object storage to hold your account, photos, results, collections, and chat history.
- Legal/Compliance: If required by law, to protect rights and safety, or in connection with a merger, acquisition, or asset transfer.
The "Live Listings" feed on the Home screen is built from generic marketplace searches we run on our own; none of your data is used to produce it.
5. Cookies and Choices
On the Website, you can manage cookies via your browser settings. Mobile platforms provide settings to reset or limit advertising identifiers (IDFA/GAID), and on iOS you can withdraw tracking permission at any time under Settings → Privacy & Security → Tracking. We do not respond to "Do Not Track" signals. In supported regions (e.g., EEA/UK), we use consent dialogs for non-essential cookies/analytics and tracking where legally required. You can update your choices at any time via the Website's cookie preferences link.
6. Data Retention
We retain information as long as necessary to provide the App, comply with law, resolve disputes, and enforce agreements. Retention varies by data type, account status (e.g., active vs. deleted), and legal requirements. When you delete your account, your photos, results, collections, and chat history are deleted with it.
7. Your Rights
Depending on your location, you may have rights to access, correct, delete, or port your data; object to or restrict certain processing; and withdraw consent where processing is based on consent. You can delete your account and all data associated with it at any time from the App under Profile → Account → Delete Your Account; you can also request deletion by contacting us at the email below. If you delete your data, some features may no longer work. You may also have the right to complain to a supervisory authority.
8. Security
We use technical and organizational measures appropriate to the risk (e.g., secure storage for tokens, encryption in transit) to protect your information. No method of transmission or storage is fully secure.
9. International Transfers
We may process and store information in countries outside your own. Where required, we implement appropriate safeguards for cross-border transfers, such as the European Commission's Standard Contractual Clauses for transfers to countries without an adequacy decision.
10. Children's Privacy
Toyby is not directed to children. We do not knowingly collect personal information from children under 13 (or under 16 in the EEA/UK). If you believe a child has provided information, contact us and we will take steps to delete it.
11. Changes to This Policy
We may update this Privacy Policy. We will post updates here and update the "Last updated" date. Material changes will be communicated as required by law.
12. Contact Us
If you have questions or wish to exercise your privacy rights, contact us:
Email: info@pixoby.space
Links: Terms of Use, Privacy
13. California Privacy Rights (CPRA)
California residents have the right to know, access, correct, delete, and port certain personal information, and to opt out of the sale or "sharing" (cross-context behavioral advertising) of personal information. We do not sell personal information. To the extent our use of an install attribution partner constitutes "sharing," you may opt out by contacting us at info@pixoby.space with the subject "CPRA Opt-Out." Where supported, we will honor applicable opt-out preference signals (e.g., Global Privacy Control) as required by law.