Who dey responsible
Who dey responsible
My Gunpla Collection (MGC) na di product and service name. Cédric Hochedez (France), one individual (natural person), dey run di service for di developer own name and na im dey control di personal-data processing we describe here. For personal-data requests, contact support@mygunplacollection.app. Dis policy cover di MGC app, im public website, account emails and community services wey dem don enable.
Account, device and private collection
We dey process your email, account identifier, sign-in provider, verification status, legal acknowledgements wey dem record, language and account settings. We also dey process primary-device/session information, plan information and technical integrity signals wey account access need. Your collection fit contain kits, build status, notes, optional prices, sessions, journals, tasks, wishlist/shopping records, paint stock, mixes, progression and cards. Local files remain for di device unless one supported service transfer dem. Any record wey dey Firebase still link to di account even if di public no fit see am.
Photos and cloud
Your own photos still belong to you. Free and di Pro one-time purchase no include Premium photo cloud or subscriber access from several devices. Pro+ provide supported collection and build-report copies for viewing or in optimized form, plus utility images for viewing only. Pro+ MAX fit also store original files for supported collection and build-report categories. Dis no be backup of every original file. If your plan change, local copies no go automatically erase. Cloud availability, supported formats and quotas follow di offer wey di app show. Recovery/export cover compatible modeled copies; e no promise to recover every legacy file or files wey dey only inside one lost device. Di cloud recovery period after subscription expire dey separate from account deletion. Di published retention schedule must identify di exact period wey dem implement and di purge mechanism.
Community, tutorials and messages
When you publish, other users fit see your contribution, di author/profile details wey you choose and attached media. Tips, Community Kits/Paint and, if dem make am public, Mecha Exchange dey process contributions, reviews/ratings, reactions, view records, reports and moderation status. Conversation content na for di participants. Authorized personnel fit access relevant material when dem need am to investigate report, secure di service or help you. No put another person personal information inside public content without lawful reason. Na you choose to publish; that choice no mean say you consent to unrelated advertising.
Why we process data and di legal grounds
Where e necessary, di relevant service contract na di basis to provide di account, collection, publication, messaging and Premium services wey you request. Where e apply, security, abuse prevention and proportionate moderation rely on documented legitimate interests, subject to your rights. Applicable legal duties govern records wey law truly require. Optional launch/beta emails rely on your separate opt-in, and you fit withdraw am. To acknowledge dis Privacy Policy no mean blanket consent for every kind of processing.
Purchases and support
Apple dey process App Store payments. MGC dey use product, transaction, plan, expiry, validation and restore information wey link to your account to provide and protect your access rights. We no dey request your full payment-card details for these purchases. Support fit process your email, request, attachments wey you choose to supply and relevant diagnostics. Send only di information wey dem need to solve di problem. Limited transaction-ownership records fit be necessary to stop another account from claiming your purchase after deletion. Di applicable retention rule must be specified; dem no fit just call that record anonymous.
Service providers and data transfers
MGC dey use Firebase/Google for authentication, database, files, functions and Auth hosting; Apple for sign-in and purchases; and Brevo for account-email transport and website contact-list processing. We describe external YouTube services below. Di default Firestore database dey nam5 for United States. To host some functions for Europe no mean say all data remain inside European Union. Providers receive di information wey dem need for their role, subject to their applicable contractual duties or their responsibilities as independent data controllers. Wen European personal data dey move go outside European Economic Area, di Google Cloud and Firebase terms provide for EU–US Data Privacy Framework for certified recipients and transfers wey di framework cover, or standard contractual clauses wey apply, depending on di service and di transfer. If data dey go country wey dem recognise say get adequate data protection, di transfer dey rely on that adequacy decision. Di Google Cloud and Firebase terms below explain wetin each one cover.
For Brevo, Appendix 3, section 9 of e terms provide for standard contractual clauses and extra safeguards; di EU–US framework fit apply to di relevant transfers go United States as long as di framework still valid. You fit read di safeguards and di terms wey concern dem for these addresses: Google Cloud : https://cloud.google.com/terms/data-processing-addendum Google Cloud — DPF : https://cloud.google.com/terms/alternative-transfer-solution Firebase : https://firebase.google.com/terms/data-processing-terms Brevo : https://www.brevo.com/legal/termsofuse/#9-international-transfers
New waitlist signup close for V1; old contacts need separate handling through support@mygunplacollection.app.
Email, website and optional communications
Firebase Auth dey send verification and password-reset email through Brevo SMTP.
Settings wey dem confirm for 23/10/2026: consent management per contact ON; tracking when consent no known OFF; anonymous transactional tracking ON. To register or request email no mean explicit consent for individual tracking; technical pixel or rewritten links fit remain. Transport logs dey set to one month maximum, no be fixed 30 days; new email previews no dey stored. This no prove say every provider copy don delete. MGC no dey sell personal data, show third-party ads or do cross-app ad tracking. New waitlist signup close for V1, but old contacts no delete because of that.
Old registrations for Brevo list 3 fit include email address, language, optional beta interest, device preference and source/UTM information wey person submit. Those registrations no create MGC account. To ask removal or use your rights, write to support@mygunplacollection.app with subject “Waitlist removal”.
Ask removal through support@mygunplacollection.app; no be automatic deletion or guarantee for every copy. Browser language, theme and price-country choices remain until you clear or reset am; Any optional tracker need separate information and consent wey law require before dem use am. Transport logs na for delivery problems, security and support.
Websites and YouTube
MGC dey use YouTube API Services to obtain limited video/channel reference metadata, including titles, channel names, thumbnails, duration and availability. E also resolve limited metadata for website resource cards. YouTube API metadata must refresh or be removed before di applicable 30-day limit. YouTube thumbnails remain third-party files; MGC no rehost dem, and dem fit contact di image provider before video playback. A website open when you choose im link. Di privacy-enhanced embedded YouTube player initialize after your playback action and fit transmit technical information under YouTube policies. MGC no download or store YouTube videos, and e no claim ownership of linked videos, channels or thumbnails. Google Privacy Policy dey at https://policies.google.com/privacy. External providers process technical data under their own policies. Restricted report/moderation records fit contain resource identifiers, URLs, relevant snapshots and reasons, under di specific purposes and retention criteria inside di schedule.
This duty no prove automatic purge don run; no promise of automatic purge after 29 days.
How long data stay and how deletion work
Data wey link to account or published content stay for di time wey e still useful, then e enter di confirmed withdrawal or account-deletion process. Your own contributions and content of messages wey you send dey separate from other participants own content.
Separate proof for Terms acceptance, Privacy acknowledgement and UGC consent dey support those acts while account dey alive and must delete inside account-deletion process. Only real dispute fit justify separate, minimum, restricted-access retention with defined end. Di agreed period to keep report evidence wey dem reduce to di minimum data wey dey needed and separate during account deletion na 363 days from di first time wey dem capture am for that same process (retainedAt), with restricted access. To try di account deletion again no restart di period. Dis rule no cover all moderation history and no prove say dem don already delete di evidence. To restore personal data from old backup no allowed inside authorized operations until independent erasure register and quarantine dey ready. This no prove IAM lock or allow deletion markers to remain forever.
To describe account deletion and cleanup for current device, talk only about di scope wey actual evidence support. No guarantee to clean exports, outside copies or every other device. Email settings no prove every copy don delete. If deletion never complete, show the state and offer safe retry or support, no claim total erasure.
Restricted access to moderation evidence na to establish facts and allow person challenge moderation decision. Separate retention because of dispute na only to handle that real dispute. Erasure markers and hashed or pseudonymous identifiers fit still be personal data; dem no get permission to stay forever. Di backup-restore restriction no prove say every backup don expire. Brevo settings wey dem read back on 23 October 2026 set transactional logs to one month and no keep new email previews, for security and support purposes wey P08 explain. To close new waitlist registrations no delete old contacts; support dey handle removal requests. One month no mean fixed thirty days or deletion of every provider copy. YouTube metadata duties dey separate; no promise of automatic purge after 29 days. Other retention exceptions must get justified purpose and specific end or criterion inside «How long data stay and how deletion work». No universal deletion deadline or guarantee to erase every copy dey.
To keep old waitlist registrations must end when person ask to withdraw dem or when di reason to keep dem before launch don end, unless valid legal reason to keep dem still dey.
Your choices and rights
Contact support@mygunplacollection.app to request access, correction, deletion, restriction or portability where e apply, or to object to processing wey rely on legitimate interests. You fit withdraw optional consent without affecting lawful processing wey happen before. We fit verify identity in proportionate way and explain any lawful limit or retention requirement. You fit complain to a competent data-protection authority, including any authority wey applicable law make available to you. Dis policy no require every user to complain only to CNIL. Export tools for di app no replace your right to submit a data request.
Children, changes and contact
No create account and no publish content if applicable age and legal-capacity rules no allow you use di service lawfully. Material changes get dates, and dem communicate dem through appropriate app/site notices. New versions fit require new Terms acceptance and Privacy acknowledgement; dem no silently rewrite older recorded acknowledgements.
Apple age rating dey describe content; no be age verification or contractual minimum age.