Privacy Policy

Last updated: April 9, 2026

ToyColor, operated by David Wilson in New Zealand, ("we", "our", "us") provides the ToyColor mobile application. This Privacy Policy explains how we collect, use, and protect your information.

Information We Collect

Account information: When you create an account, we collect your email address, name, and authentication credentials via Apple Sign In or Google Sign In. We process this data to provide and maintain your account (legal basis: contract performance).

Photos: When you use ToyColor, you take or select photos of toys. These photos are sent to third-party AI services to generate coloring pages. Our primary provider is xAI (Grok), operated by xAI Corp., with Google Gemini as a fallback provider. Photos are transmitted to servers in the United States for processing. You will be asked for explicit consent before your first photo is processed by AI. Photos may also be stored in our cloud service (Supabase, hosted on AWS in the United States) to sync across your devices.

Purchase history: If you subscribe to ToyColor Premium, your purchase information is processed by Apple (via the App Store) and RevenueCat (our subscription management provider, based in the United States). We receive subscription status information but do not have access to your payment details.

Usage data: We collect analytics data about how you use the app, including features used, generation counts, and app performance metrics, using PostHog. This may include device identifiers and session data. This helps us improve the app experience (legal basis: legitimate interest).

Crash data: We collect crash reports and performance data using Sentry to identify and fix bugs. This may include device type, OS version, and app state at the time of a crash.

How We Use Your Information

• To provide and maintain the ToyColor service
• To process your toy photos into coloring pages using AI services (xAI Grok and Google Gemini)
• To manage your subscription and account
• To sync your creations across devices
• To improve app performance and fix bugs
• To send important service updates (e.g., changes to terms)

Third-Party Services

We use the following third-party services to operate ToyColor. Your data may be transferred to servers outside New Zealand as described below:

• Supabase (United States) — authentication, database, and file storage. Privacy policy
• xAI (Grok) (United States) — primary AI image generation. Photos are sent to xAI for processing. Privacy policy
• Google Gemini (United States) — fallback AI image generation. Photos are sent to Google for processing. Privacy policy
• Apple (United States) — App Store payments and Apple Sign In. Privacy policy
• Google Sign In (United States) — authentication. Privacy policy
• RevenueCat (United States) — subscription and purchase management. Privacy policy
• PostHog (United States) — product analytics. Privacy policy
• Sentry (United States) — crash reporting and performance monitoring. Privacy policy

We take reasonable steps to ensure these providers offer an adequate level of data protection in accordance with the New Zealand Privacy Act 2020.

International Data Transfers

Your personal information is transferred to and processed in the United States by the third-party services listed above. By using ToyColor, you consent to these transfers. We ensure that each provider maintains appropriate data protection standards.

Data Storage and Security

Your data is stored securely using industry-standard encryption. Account data and images are stored in Supabase (hosted on AWS in the United States). We implement appropriate technical and organizational measures to protect your personal information.

Data Retention

We retain your account data and creations for as long as your account is active. If you delete your account, your data will be removed within 30 days. Analytics data may be retained for up to 12 months. Crash reports are retained for up to 90 days.

Children's Privacy

ToyColor is designed to be family-friendly, but account creation requires users to be at least 13 years old. Children under 13 may use the app under parental supervision using a parent's account. We do not knowingly collect personal information directly from children under 13. If you believe we have collected information from a child under 13, please contact us and we will promptly delete it.

Your Rights

You have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request deletion of your data (via app settings or by contacting us)
• Export your data
• Object to processing based on legitimate interests
• Restrict processing of your data
• Withdraw consent for data processing (this does not affect the lawfulness of prior processing)

To exercise any of these rights, contact us at privacy@toycolor.app. We will respond within 20 working days as required by the New Zealand Privacy Act 2020.

Complaints

If you are not satisfied with how we handle your personal information, you may lodge a complaint with:

• New Zealand: The Office of the Privacy Commissioner — privacy.org.nz
• EU/UK: Your local data protection authority

Data Breach Notification

In the event of a data breach that poses a risk of serious harm, we will notify the New Zealand Privacy Commissioner and affected individuals as required by the Privacy Act 2020.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes through the app or via email.

Contact Us

If you have questions about this Privacy Policy, contact us at privacy@toycolor.app.