Legal

Privacy Policy

Last updated: 13 September 2026

This policy explains what information Toy Syndicate collects, why, who it is shared with, how long it is kept, and the choices and rights you have. We aim to collect only what we need to run the service. It forms part of our Terms of Service.

Information we collect

Account details — your email address, handle, and display name when you register, and your password in hashed form. We never see your password in plain text.
Profile content — anything you add to your profile: bio, links, location, avatar, cover image, and your privacy settings.
Collection activity — the releases you mark as owned or wanted, your display photos and the releases you tag in them, follows, blocks, contributions, reviews, and any trades you record through a Plastic Handshake.
Community content — your posts, comments, reactions, glossary entries, and direct messages.
Contributions and moderation records — catalog edits and submissions you make, and the decisions taken on them.
Support and feedback — what you send us through the Contact page, the feature board, and bug reports.
Search terms — only if you accept analytics consent: the searches you submit and how many results they returned. Never what you type as you type it, never if you decline, and never if your browser sends a Do Not Track signal. Deleted after 90 days.
Usage data — only with your consent: an anonymous session identifier and which pages are visited. If Microsoft Clarity is enabled, also heatmap and session-replay data (clicks, scrolling, mouse movement).
Technical data — basic information your browser sends, and records needed to operate and secure the service, such as request logs, error reports, and security and rate-limiting records.

We do not ask for, and you should not send us, government identifiers, payment card numbers, health information, or other sensitive categories of data.

How we use it, and our legal basis

To provide the core features — your collection, wishlist, display, messages, trades, and the community. Basis: performance of our contract with you.
To maintain the community-verified catalog and review contributions. Basis: legitimate interests in keeping a shared record accurate.
To keep the service secure, prevent abuse and fraud, and enforce our terms. Basis: legitimate interests, and legal obligations.
To respond to your support requests and feedback. Basis: performance of our contract, and legitimate interests.
To send service email about your account. Basis: performance of our contract.
To measure how the service is used, and to credit referrals. Basis: your consent, which you can withdraw at any time.
To comply with law, and to establish, exercise, or defend legal claims. Basis: legal obligations and legitimate interests.

If you are in Canada, we rely on your express consent where you give it and on implied consent where it can reasonably be inferred from what you are doing; in a small number of situations set out in PIPEDA — such as investigating a breach of an agreement, detecting fraud, or responding to a subpoena or court order — we may process information without consent. If you are in the EEA or the UK, the italicised bases above are the GDPR bases we rely on.

What's public

Your handle, display name, avatar, and any content you choose to make public — such as public display photos, posts, comments, glossary entries, follows, and reviews — may be visible to other members and, where a page is publicly indexable, to search engines and anyone on the web. You control the visibility of your display photos and can keep your profile private in Settings. Direct messages are not public, but they are not end-to-end encrypted; see section 10 of the Terms.

Who we share it with

We do not sell your personal information, we do not rent it, and we do not share it with advertisers. We share it only in these situations:

Service providers who run the service for us, and only so that they can: Supabase (database, authentication, and file storage), Vercel (hosting), Cloudflare (image storage and delivery, and content recommendations), an email delivery provider for account email, Photoroom (only when you use the photo editor's background removal, which sends that image to them), Anthropic (generating descriptions and alt text for catalog images), and Microsoft (Clarity, only if it is enabled and only if you have consented).
Other members, to the extent you have made content public or sent it to them.
Legal and safety — where we believe in good faith that disclosure is required by law, or is necessary to enforce our terms, investigate a report, protect our rights and property, or protect someone from harm.
Business transfers — if Toy Syndicate is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will tell you if it happens and if it changes how your information is handled.

Where your information goes

Our providers operate in Canada, the United States, and the European Union, so your information is transmitted to and stored on systems outside the country where you live, and may be accessible to the courts and authorities of those countries. Where the law requires it, we rely on recognised transfer mechanisms such as the European Commission's standard contractual clauses.

How long we keep it

We keep your account and profile information for as long as you have an account. When you delete your account, the categories listed in section 26 of the Terms are deleted, and your posts, comments, catalog and glossary contributions, and sent messages remain but are shown as belonging to a deleted member. Submitted search terms are deleted after 90 days. Security, moderation, and audit records are kept for as long as we need them for the purpose they were created for, and backups are kept for a limited period before being overwritten.

Security

We use industry-standard measures to protect your data — encryption in transit, access controls, and row-level security in the database. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your password safe and for the activity on your account.

Cookies & local storage

Some of what we store in your browser is necessary — your sign-in and the preferences you have set yourself, such as page size, card style, feed filter, and theme. It is kept in local storage rather than in cookies sent to us, and it cannot be switched off without signing you out on every click.

Three things are optional and happen only if you consent: referral attribution (a code so whoever introduced you is credited), usage measurement (an anonymous session id and which pages are visited), and, when it is enabled, Microsoft Clarity — a third party that builds heatmaps and can replay how a page was used, including clicks, scrolling, and mouse movement. Clarity is the only thing on the site that sets cookies in the ordinary sense: two of them, _clck and _clsk. Decline and nothing sets a cookie at all.

We ask on your first visit and you can change your answer at any time from Cookie settings in the sidebar menu; withdrawing consent stops the optional processing and clears the identifiers involved. We do not run advertising trackers. The full breakdown is in section 18 of the Terms of Service.

Do Not Track

Most browsers offer a Do Not Track setting. There is no agreed standard for responding to it, but we do: if your browser sends the signal, submitted search terms are not recorded at all, regardless of your consent choice.

Your rights

Access and correction — view and edit your profile and account details at any time, or ask us for a copy of what we hold.
Deletion — delete your account from Settings. Some contributions remain as anonymised, community-owned records, as described above and in the Terms.
Portability — request a copy of your collection and profile data in a portable format.
Withdraw consent — change your cookie choice at any time from Cookie settings.
Object or restrict — where we rely on legitimate interests, you can object to that processing, and you can ask us to restrict it while we consider your objection.
Complain — you can complain to a regulator: in Canada, the Office of the Privacy Commissioner; in the EEA or UK, your national data protection authority. We would rather you came to us first.

To exercise any of these, contact us through the Contact page and choose the “Account & Privacy” topic. We may need to verify who you are before acting, and we respond within the time the applicable law allows.

Age

Toy Syndicate is for adults. The service is not directed to anyone under 18, registration by under-18s is not permitted, and we do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has created an account or given us information, tell us through the Contact page and we will close the account and delete the data. See section 3 of the Terms.

Changes

We may update this policy. Material changes will be reflected by the “last updated” date above and, where significant, announced in the app. Continuing to use Toy Syndicate after a change means you accept it.

Contact

Questions about privacy? Reach us through the Contact page — choose the “Account & Privacy” topic.