Privacy Policy

Last updated: September 14, 2026

This Privacy Policy explains what information the Toy Hub mobile application ("the App") collects, how it's used, and your choices.

1. Information you provide

• Account information: phone number or email address (or the details from Google or Apple described below), a nickname and avatar, and your @handle — a unique public username. Every account has one; we assign one when you register, and you can change it in the App.
• Sign in with Google or Apple: if you sign in with, or link, a Google or Apple account, we receive a sign-in token from that provider and keep:
  • the provider's account ID for you (a fixed identifier issued by Google or Apple, not your email address);
  • the email address the provider reports, if the provider has verified it. With Apple's "Hide My Email" this is a private relay address (…@privaterelay.appleid.com), not your real address. When a new account is created this way, that address also becomes the account's email address;
  • for a new account only: your first name (Google provides it in the token; Apple provides it only the first time you authorize the App), which we use as your starting nickname — if there is no name, we use the part of the email address before the "@", or a generic name. For Google, we also copy your Google profile photo into our own storage as your starting avatar. You can change both at any time.
  We don't receive your Google or Apple password, and we don't store Google or Apple access or refresh tokens.
• Content: posts, photos, and comments you choose to share.
• Collection data: which items you mark as owned or wanted.

2. Information collected automatically

We use Firebase (a Google service) for:

• Firebase Analytics — app usage events (e.g. which screens you visit, how you navigate the app) to understand how the App is used. This includes which sign-in method you used (phone, email, Google or Apple) — the method only, never the phone number, email address or provider account ID.
• Firebase Crashlytics — crash and error reports, so we can find and fix bugs.
• Firebase Performance Monitoring — app performance data (load times, network request timing).

These are standard mobile analytics/diagnostics tools; they don't include the content of your posts. See Firebase's own privacy documentation for details on how Google processes this data.

3. How we use your information

To operate the App's core features: signing you in (by verification code, or by checking a Google or Apple sign-in token), showing your posts to other users, letting you browse and mark collection items, sending you verification codes, and fixing bugs/improving the App based on crash and usage data.

We use the Google or Apple account ID and email only to sign you in and to connect the sign-in to the right Toy Hub account. If you sign in with Google or Apple and the verified email address it reports already belongs to a Toy Hub account, the sign-in is linked to that existing account instead of creating a new one.

4. What other users can see

Your nickname, @handle, avatar, and posts are visible to other users by default, and other users can find you and mention you by your @handle. Your phone number, email address, and linked Google or Apple accounts are not shown to other users. Your owned/wanted collection lists are only visible to others if you turn on that visibility yourself in your profile settings — off by default.

5. Data retention and deletion

You can unlink a Google or Apple sign-in from the App's "Account & sign-in" screen, which deletes the stored provider account ID and the email address that came with it. The App won't let you unlink the last way you have to sign in (an Apple private relay address doesn't count as one). An email address that became your account's email when the account was created stays on the account until you delete the account.

You can delete your account at any time from the same screen, which removes your account and profile information, including every linked sign-in. If a Sign in with Apple account is linked, the App asks you to confirm with Apple and we then ask Apple to revoke the App's authorization; if that step can't be completed, your account is still deleted, and you can remove the App from your Apple ID settings yourself. Some data may be retained where required for legal or fraud-prevention purposes. If you no longer have the App, see Delete your account for how to request deletion by email and exactly what is deleted and kept.

6. Data sharing

We don't sell your personal information. We share data with:

• Google/Firebase, as described in section 2, for analytics/crash reporting/performance
• Google and Apple, only when you choose to sign in with them: they process the sign-in under their own privacy policies, and when you delete an account with Sign in with Apple linked, we send Apple the request to revoke the App's authorization
• Law enforcement or regulators, only if legally required

We don't use third-party advertising networks in the App.

7. Children's privacy

The App isn't directed at children under 13, and we don't knowingly collect information from children under 13.

8. Changes to this policy

We may update this Privacy Policy from time to time. Continued use of the App after changes take effect means you accept the updated policy.

9. Contact

Questions about this policy or your data? Contact us at popbeanfamily@gmail.com.