Who is responsible
Who is responsible
My Gunpla Collection (MGC) is the product and service name. The service is operated in the developer's own name by Cédric Hochedez (France), an individual (natural person), who acts as controller of the personal data processing described here. Contact for personal data requests: support@mygunplacollection.app. This policy covers the MGC app, its public website, account emails and enabled community services.
Account, device and private collection
We process your email, account identifier, sign-in provider, verification status, recorded legal acknowledgements, language and account settings. We also process primary-device/session information, plan information and technical integrity signals needed for account access. Your collection may contain kits, build status, notes, optional prices, sessions, journals, tasks, wishlist/shopping records, paint stock, mixes, progression and cards. Local files stay on the device unless a supported service transfers them. A record stored in Firebase is account-linked even if it is not publicly visible.
Photos and cloud
You retain ownership of your own photos. Free and the Pro one-time purchase do not include Premium photo cloud or subscriber multi-device access. Pro+ provides supported consultation/optimized collection and build-report copies and consultation-only utility images. Pro+ MAX may additionally store originals for supported collection and build-report categories. This is not universal original backup. A plan change does not automatically erase local copies. Cloud availability, supported formats and quotas follow the offer shown in the app. Recovery/export covers compatible modeled copies; it does not promise recovery of every legacy file or of local-only files from a lost device. The cloud recovery period after subscription expiry is separate from account deletion; the exact implemented period and purge mechanism must be identified in the published retention schedule.
Community, tutorials and messages
When you publish, other users may see your contribution, chosen author/profile details and attached media. Tips, Community Kits/Paint and, if publicly available, Mecha Exchange process contributions, reviews/ratings, reactions, view records, reports and moderation status. Conversation content is intended for its participants; authorized personnel may access relevant material where necessary to investigate a report, secure the service or assist you. Do not put another person's personal information in public content without a lawful reason. Publication is your choice; it is not consent to unrelated advertising.
Purposes and legal grounds
Providing the requested account, collection, publication, messaging and Premium services relies on the relevant service contract where necessary. Security, abuse prevention and proportionate moderation rely on documented legitimate interests where applicable, subject to your rights. Applicable legal duties govern records genuinely required by law. Optional launch/beta emails rely on your separate opt-in, which you can withdraw. Acknowledging this Privacy Policy does not provide blanket consent for all processing.
Purchases and support
Apple processes App Store payments. MGC uses account-linked product, transaction, plan, expiry, validation and restore information to supply and protect entitlements. We do not request your full payment-card details for these purchases. Support may process your email, request, voluntarily supplied attachments and relevant diagnostics. Send only information needed to resolve the issue. Limited transaction ownership records can be necessary to prevent another account claiming your purchase after deletion; the applicable retention rule must be specified rather than treating the record as anonymous.
Service providers and transfers
MGC uses Firebase/Google for sign-in, its database, files, app functions and authentication-related hosting; Apple for sign-in and purchases; and Brevo for account emails and management of historical website waitlist registrations. New registrations for that list are closed in V1. YouTube services are described in the “Websites and YouTube” section.
These services receive the information necessary for their role. Apple also processes some data for its own sign-in and purchase purposes. The main Firestore database is located in the United States. Hosting some functions in Europe therefore does not mean that all data remains in the European Union.
For transfers of European personal data outside the European Economic Area, the Google Cloud and Firebase terms provide, depending on the service and transfer, for the EU–US Data Privacy Framework for certified recipients and covered transfers, or the applicable standard contractual clauses. Transfers to a country recognised as adequate rely on that adequacy decision. The Google Cloud and Firebase terms below define their respective scope.
For Brevo, Appendix 3, section 9 of its terms provides for standard contractual clauses and supplementary measures; the EU–US framework may apply to the relevant US transfers while it remains valid. The safeguards and corresponding terms can be consulted at the following addresses: Google Cloud : https://cloud.google.com/terms/data-processing-addendum Google Cloud — DPF : https://cloud.google.com/terms/alternative-transfer-solution Firebase : https://firebase.google.com/terms/data-processing-terms Brevo : https://www.brevo.com/legal/termsofuse/#9-international-transfers
For questions about these recipients or data transfers, you can write to support@mygunplacollection.app.
Email, website and optional communications
Address-verification and password-reset emails are sent by Firebase Auth using Brevo SMTP transport. Brevo settings confirmed on 23 October 2026 enable per-contact tracking-consent management and refuse tracking when consent is unknown. Anonymous transactional tracking is enabled within the scope confirmed by that check. Registering for communications or requesting an account email does not constitute explicit consent to individual opening or click tracking. These settings do not mean that all pixels or rewritten links disappear; provider technical mechanisms may remain. Transport logs are configured for a maximum of one month for security and support, with non-retention of previews confirmed. This configuration guarantees neither deletion of every copy nor a universal deletion period.
MGC’s product policy is no sale of personal data, no third-party advertising display and no cross-app advertising tracking. This policy does not replace an accurate description of email processing.
New website waitlist registrations are closed in V1. Historical registrations in Brevo list 3 could include email, language, optional beta interest, device preference and submitted source/UTM information. They do not create an MGC account. To request removal or exercise your rights, write to support@mygunplacollection.app with the subject “Waitlist removal”. This is a support process, not an automated unsubscribe button; no deadline for deletion of all copies is guaranteed here.
Browser language, theme and pricing-country preferences are stored locally until you clear them in your browser or reset them. Optional trackers, if any, require separate information and legally required consent before use.
Websites and YouTube
MGC uses YouTube API Services to obtain limited video/channel reference metadata, including titles, channel names, thumbnails, duration and availability, and resolves limited metadata for website resource cards. YouTube API metadata must be refreshed or removed before the applicable 30-day limit. YouTube thumbnails remain third-party files, are not rehosted by MGC and may contact the image provider before video playback. A website opens when you choose its link. The privacy-enhanced embedded YouTube player is initialized after your playback action and may transmit technical information under YouTube’s policies. MGC does not download or store YouTube videos and claims no ownership of linked videos, channels or thumbnails. Google’s Privacy Policy is available at https://policies.google.com/privacy. External providers process technical data under their own policies. Restricted report/moderation records may contain resource identifiers, URLs, relevant snapshots and reasons under the purposes and retention criteria described in this policy.
Retention and deletion
Data associated with your account and publications is retained to provide those functions for their useful lifetime. When a publication is withdrawn or an account is deleted, the relevant data falls within the deletion process, subject to the limited exceptions described here. Other participants’ own content remains separate.
Terms acceptance, Privacy Policy acknowledgement and consent to publish content remain three separate acts. Their records are kept to evidence those acts during the life of the account and must be erased in its deletion process.
Minimized report evidence isolated during account deletion is subject to a retention period of 363 days from its first capture in that process. Retrying deletion does not restart that period. Access is restricted to establish the facts and allow a moderation decision to be challenged.
An actual dispute may justify separate retention of only the data needed to handle it, with restricted access and a defined end. Other exceptions must also have a specific purpose and a justified retention period or end criterion. They do not permit indefinite retention.
Account-email delivery logs are configured for a maximum of one month for security and support, without retaining previews of new emails. Closing the waitlist does not delete historical registrations: their retention ends on requested withdrawal or when their prelaunch purpose ends, subject to any legally justified retention. You can request their removal at support@mygunplacollection.app. Rules specific to YouTube metadata are set out in the “Websites and YouTube” section.
Your choices and rights
Contact support@mygunplacollection.app to request access, correction, deletion, restriction or portability where applicable, or to object to processing based on legitimate interests. You may withdraw an optional consent without affecting earlier lawful processing. We may verify identity proportionately and explain any lawful limitation or retention requirement. You can complain to a competent data-protection authority, including the authority available to you under applicable law; this policy does not require every user to complain only to the CNIL. Export tools available in the app do not replace your right to submit a data request.
Children, changes and contact
Do not create an account or publish content if you cannot lawfully use the service under the applicable age and capacity rules. The Apple age rating describes content; it is neither age verification nor a contractual minimum age for creating an account. Material changes are dated and communicated through appropriate app/site notices. New versions may require a new Terms acceptance and Privacy acknowledgement; older recorded acknowledgements are not silently rewritten.