Legal

Privacy Policy

Last updated: October 2026

Who I am

Collectsy is developed and operated by Zijlstra Studios, a sole proprietorship registered in the Netherlands (Dutch Chamber of Commerce / KVK 42067535), which acts as the data controller for your personal data. I run it on my own. Collectsy is an unofficial blind box and figure tracker app and is not affiliated with Pop Mart International Group or any other toy manufacturer.

What data I collect

When you sign in with Google or Apple I receive your name, email address, and an account identifier from that provider. If you use Sign in with Apple, you can choose to hide your email address, in which case Apple provides a private relay address that forwards to you. I store the following data associated with your account:

• Your display name, handle and avatar, and your profile photo if you upload one (Pro)
• Your country, taken from your App Store or Google Play storefront, or from your device region if that isn't available. It is never shown to other collectors.
• Your collection, wishlist, and trading preferences
• The date you got a figure, if you add it
• Where you got a figure and the price you paid, if you add them. These are optional and only you can see them.
• Posts you write: the caption, the figures you tag, and the photos you attach (Pro)
• Trade requests you send or receive in Exchange
• Comments you post
• Listings you create for figures you own
• Reports and blocks you submit (used to keep the community safe)
• Moderation records, including content removals, account strikes, and the results of automated photo screening
• Your in-app settings (theme, notification preferences)
• An Expo push notification token if you grant notification permission
• Your subscription status (verified via RevenueCat)
• Server access logs including your IP address (standard web server practice)

I remove location and other camera data from every photo before it is stored.

How I use your data

Your data is used to operate Collectsy:

• To display your collection and wishlist
• To show trade overlap with collectors you follow
• To show your Spent overview on Stats. Purchase details are never shown to other collectors.
• To show your posts and activity to other collectors according to your privacy settings
• To send push notifications you opted into
• To keep the community safe (handling reports and blocks, and screening uploaded photos)
• To apply your Pro subscription benefits
• To produce anonymous statistics (see below)

Photo screening. Every uploaded photo is checked automatically for explicit, violent or graphic content before anyone else can see it. A photo that fails is rejected, and a borderline one is held until I review it myself.

Anonymous statistics. I may share combined statistics built from many collectors with brands, shops and other partners. Examples are the share of figures bought in official stores versus secondhand in a country, or the average price paid for a series. These never include your name, handle or anything else that identifies you, and I only share a statistic when it is based on enough collectors that no one can be singled out.

I never sell your personal data, and I do not show ads.

Third-party services

Collectsy uses the following third-party services, each with their own privacy policies:

• Google Sign-In: authentication
• Sign in with Apple: authentication (iOS)
• Supabase: database and image hosting (EU region)
• RevenueCat: subscription management
• Expo Push Notification Service: delivering notifications (Apple APNs on iOS, Firebase Cloud Messaging on Android)
• Sentry: crash and error reporting
• Upstash (Redis): caching and rate limiting (EU region)
• Google Cloud Vision: automated screening of uploaded photos (EU region)

Figure images shown in the app are hosted on my own storage (Supabase, EU region) and are derived from publicly available product images. Photos you upload are hosted there too.

International data transfers

Your collection database and your uploaded photos are hosted in the European Union (Supabase, EU region), and photo screening runs in the EU region of Google Cloud Vision. Some of my other service providers, including RevenueCat, Sentry, Google, Apple, and the Expo Push Notification Service, are based outside the European Economic Area, primarily in the United States. Where your data is transferred outside the EEA, I rely on appropriate safeguards such as the EU Standard Contractual Clauses or equivalent mechanisms offered by those providers.

Data retention

I retain your data for as long as your account exists, with these exceptions:

• Purchase details are removed when you mark a figure as no longer owned.
• Posts and photos are kept until you delete them, you delete your account, or I remove them for breaking the Terms of Use.
• Photos that fail screening are deleted within 30 days.

You can permanently delete your account and all associated data at any time from Settings → Delete account.

Your rights (GDPR)

If you are in the European Economic Area, you have the right to:

• Access the data I hold about you (visible in-app)
• Request deletion of your data (use the Delete account option in Settings)
• Request a copy of your data (contact me)
• Object to or restrict processing

To exercise any of these rights, contact me at privacy@collectsyapp.com. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Children

Collectsy is not directed at children under 13. I do not knowingly collect data from children under 13.

Changes to this policy

I may update this policy from time to time. The updated date at the top of this page will reflect any changes. Continued use of the app after changes constitutes acceptance.

Contact

Questions about this policy? Email me at privacy@collectsyapp.com.