Legal

Privacy Policy

Last updated: June 2026

Who we are

Collectsy is developed and operated by Zijlstra Studios, a sole proprietorship registered in the Netherlands (Dutch Chamber of Commerce / KVK 42067535), which acts as the data controller for your personal data. Collectsy is an unofficial blind box and figure tracker app and is not affiliated with Pop Mart International Group or any other toy manufacturer.

What data we collect

When you sign in with Google or Apple we receive your name, email address, and an account identifier from that provider. If you use Sign in with Apple, you can choose to hide your email address, in which case Apple provides a private relay address that forwards to you. We store the following data associated with your account:

• Your display name and handle
• Your collection, wishlist, and trading preferences
• Trade requests you send or receive in Exchange
• Reports and blocks you submit (used to keep the community safe)
• Your in-app settings (theme, notification preferences)
• An Expo push notification token if you grant notification permission
• Your subscription status (verified via RevenueCat)
• Server access logs including your IP address (standard web server practice)

How we use your data

Your data is used solely to operate Collectsy:

• To display your collection and wishlist
• To show trade overlap with collectors you follow
• To send push notifications you opted into
• To keep the community safe (handling reports and blocks)
• To apply your Pro subscription benefits

We do not sell your data. We do not show ads. We do not use your data for any purpose beyond running this app.

Third-party services

Collectsy uses the following third-party services, each with their own privacy policies:

• Google Sign-In — for authentication
• Sign in with Apple — for authentication (iOS)
• Supabase — for database and image hosting (EU region)
• RevenueCat — for subscription management
• Expo Push Notification Service — for delivering notifications (Apple APNs on iOS, Firebase Cloud Messaging on Android)
• Sentry — for crash and error reporting
• Upstash (Redis) — for caching and rate limiting (EU region)

Figure images shown in the app are hosted on our own storage (Supabase, EU region) and are derived from publicly available product images.

International data transfers

Your collection database is hosted in the European Union (Supabase, EU region). Some of our other service providers — including RevenueCat, Sentry, Google, Apple, and the Expo Push Notification Service — are based outside the European Economic Area, primarily in the United States. Where your data is transferred outside the EEA, we rely on appropriate safeguards such as the EU Standard Contractual Clauses or equivalent mechanisms offered by those providers.

Data retention

We retain your data for as long as your account exists. You can permanently delete your account and all associated data at any time from Settings → Delete account.

Your rights (GDPR)

If you are in the European Economic Area, you have the right to:

• Access the data we hold about you (visible in-app)
• Request deletion of your data (use the Delete account option in Settings)
• Request a copy of your data (contact us)
• Object to or restrict processing

To exercise any of these rights, contact us at privacy@collectsyapp.com.

Children

Collectsy is not directed at children under 13. We do not knowingly collect data from children under 13.

Changes to this policy

We may update this policy from time to time. The updated date at the top of this page will reflect any changes. Continued use of the app after changes constitutes acceptance.

Contact

Questions about this policy? Email us at privacy@collectsyapp.com.