Privacy Policy

Privacy at a Glance

• We use account and collection information to provide collection tracking, alerts, subscriptions, exports, and support.
• Apple and Google provide sign-in and app-store purchase services. Google Firebase provides authentication, database, analytics, diagnostics, cloud functions, and messaging services.
• We do not sell or rent personal information, use it for third-party advertising, or permit cross-app or cross-site tracking for advertising.
• Search text and text placed on an exported image are not sent to Firebase Analytics. Exported images are created on your device.
• You can disable notifications, unsubscribe from marketing emails, correct your profile, and delete your account in the Application.
• An email address for suggestion follow-up is optional and is used only for that request, not marketing.
• Collector marketing emails are optional and use your account email after you choose to join. You can unsubscribe and keep an earned Endless Puzzles bonus.
• Price alerts save your chosen figure and target price. Item-plus-shipping alerts also save the country and ZIP or postal code you provide and send that destination to eBay when needed for a shipping estimate.
• Blind Box Tracker is a general-audience service and is not directed to children under 13.

This summary highlights important points. The complete policy below controls if the summary and the detailed terms differ.

1. Information We Collect

Account and profile information

When you sign in with Apple or Google, we receive an account identifier, authentication provider, and, depending on your provider settings, your name and email address. If you change your collector display name in the Application, we store the updated display name with your authentication profile.

Collection and preference information

We store the collectible and collection identifiers you choose to track, quantities marked as owned, wishlisted, or available for trade, collection progress, series and store watches, alert preferences, notification settings, and Application preferences.

Subscription and transaction information

We may receive and store product identifiers, transaction identifiers, app-store account tokens and purchase tokens, subscription status, trial or introductory-offer status, purchase and entitlement history, expiration and renewal information, and verification results. We do not receive or store your full payment-card number or complete billing credentials.

Notification and alert information

If you choose to enable alerts, we process your device push token, device platform, watched series or stores, alert preferences, delivery status, and records used to deliver notifications, maintain an alert inbox, and prevent duplicate notifications.

Price tracking and shipping estimates

When you save a price alert for a supported figure, we store the figure identifier, your target price, whether the target covers the item alone or the item plus shipping, and records of price checks, qualifying matches, and notifications associated with that alert. These preferences are linked to your account.

If you choose an item-plus-shipping alert, we also store the delivery country and ZIP or postal code you enter. Our servers send that destination to eBay when requesting shipping estimates for relevant listings. We do not include your Blind Box Tracker account identifier, name, or email address in those quote requests. Item-price-only alerts do not require a postal code.

We obtain listing information from eBay to provide current price references and, where enabled, price history and alerts. Shared listing caches and price histories may contain listing identifiers, titles, URLs, prices, shipping estimates, timestamps, and pseudonymous seller identifiers used to handle source-data deletion requests. Shared price histories do not include your account identity, target price, or postal code. Your saved alert preferences remain private to your account. Some tracking features may be paused or unavailable; an alert preference can remain saved while tracking is paused.

Usage and analytics information

We use Firebase Analytics to process Application instance or device identifiers, your internal user identifier after sign-in, authentication method, membership state, country or approximate region inferred by the provider, screen views, feature interactions, collection and collectible identifiers or names, collection counts and progress, tracking milestones, alert actions, paywall source, selected subscription plan, trial status, purchase results, and general engagement measurements.

For in-app searches, Analytics receives the query length, collection identifier, result count, and whether results were found. We do not send the search text itself as an Analytics event parameter. We do not send your name, email address, suggestion details, product links, notes, support-message text, or export-message text as Firebase Analytics event parameters.

Diagnostics and technical information

Firebase Crashlytics and our infrastructure providers may process crash reports, diagnostic logs, timestamps, App version, device model, operating-system version, Application instance or installation identifiers, IP address, network information, and technical state at the time of a crash, error, or request. We use this information for security, reliability, troubleshooting, and service operation.

Suggestions, support, and other communications

If you submit a blind box suggestion, we store the request type, brand, series or figure details you provide, optional product link and notes, submission and update timestamps, and review status.

You may optionally provide an email address if you would like a reply about that suggestion. We use that address only to respond to or follow up on the request, not to subscribe you to marketing emails. You can submit a suggestion without providing an email address.

You must be signed in to submit a suggestion so the request can be authenticated and rate limited, but we do not store your account identifier with the suggestion or automatically copy your account name or email into it. Suggestions containing an optional contact email are identifiable through that email. Because suggestions are not linked to your account identifier, account deletion does not automatically remove them. You may request removal of your optional contact email or suggestion by contacting the Privacy Officer.

If you contact us, we process the information contained in your message, your contact details, and related correspondence to respond, investigate issues, and keep appropriate support records. Please do not send sensitive personal information that is unnecessary for us to assist you.

Collector emails and the optional puzzle bonus

If you choose "Join & Unlock" during onboarding or enable "Collector emails" in Settings, we use the email address associated with your sign-in account to send occasional marketing emails about collections, collector tips, app news, and related updates. Joining is optional; you can continue onboarding without joining.

We store your account identifier, email address, subscription preference, consent and opt-out timestamps, unsubscribe-link identifiers, and bonus-unlock status to manage the mailing list, record your choice, and process unsubscribe requests. We do not automatically subscribe you merely because you sign in or provide a suggestion contact email.

You can turn off Collector emails in Settings or use the unsubscribe link in a marketing email. Unsubscribing does not remove an Endless Puzzles bonus you have already earned and does not stop required account, security, legal, support, or service messages.

Information processed on your device

Text you add to an exported collection image is processed on your device and is not uploaded to us solely because you create the export. If you grant photo-library permission, the Application uses that permission to save an export you request; it does not use that permission to upload your existing photo library to us.

Website and external-link information

Our website host may process standard request information such as IP address, browser or device information, requested URL, and timestamps to deliver and secure the website. Our services also check official and selected retailer product pages to provide availability information. If you choose to open an external source or store link, the operator of that website receives information normally transmitted by your browser or device and applies its own privacy policy.

Our collection and app website pages use Vercel Web Analytics to measure page views and general website use. This may process the page URL, referrer, timestamp, approximate location derived from the request, and browser, operating-system, and device type. Vercel describes this service as using aggregated statistics without third-party cookies or identifiers for tracking visitors across different websites.

2. Sources of Information

We obtain information:

• directly from you when you use the Application, manage your collection, enable alerts, submit a suggestion, or contact us;
• automatically from the Application, your device, and our website when you interact with the service;
• from Apple or Google when you authenticate;
• from Apple or Google in connection with purchases and verification through the applicable app store;
• from eBay for listing information, price references, and shipping estimates you request; and
• from service providers such as Firebase when they provide analytics, diagnostics, messaging, hosting, security, or other operational services.

3. How and Why We Use Information

We use information to:

• authenticate users and maintain accounts;
• provide collection tracking, wishlists, trade quantities, progress, exports, watchlists, release information, store availability, and supported price references, histories, shipping estimates, and price alerts;
• deliver alerts you enable and maintain alert preferences and delivery records;
• process, verify, restore, and administer subscriptions, trials, renewals, cancellations, expiration, refunds, revocations, and premium access;
• provide support, evaluate blind box suggestions, and reply about a suggestion when you choose to provide a contact email;
• measure feature use and subscription funnels, improve the Application, and understand reliability;
• detect, investigate, and prevent fraud, abuse, security incidents, unauthorized entitlement claims, and technical failures;
• send required account, legal, security, purchase, support, and service communications;
• send collector marketing emails after you opt in, manage consent and unsubscribe choices, and provide an earned puzzle bonus independently of whether you later unsubscribe; and
• establish, exercise, or defend legal rights and comply with applicable law.

Legal bases for EEA and UK users

Where European Economic Area or United Kingdom data-protection law applies, our legal bases depend on the processing:

• Contract: processing needed to provide your account, collection tracking, alerts you request, subscriptions, exports, and support.
• Consent: processing based on an optional permission or choice, such as push notifications and marketing communications, and other processing where consent is required by law. You may withdraw consent, but withdrawal does not affect earlier lawful processing.
• Legitimate interests: securing, maintaining, troubleshooting, and improving the Application; understanding feature performance; preventing fraud; and protecting users and our business, where those interests are not overridden by your rights.
• Legal obligation: processing necessary to comply with tax, accounting, consumer-protection, law-enforcement, or other legal requirements.

We do not use personal information for solely automated decisions that produce legal or similarly significant effects.

4. When We Disclose Information

We do not sell or rent personal information. We do not use personal information for third-party advertising or permit cross-app or cross-site tracking for advertising. We disclose information only as described below.

Service and data providers

• Google Firebase: Authentication, Cloud Firestore, Cloud Functions, Analytics, Cloud Messaging, and Crashlytics.
• Apple: Sign in with Apple, App Store purchases and subscriptions, transaction verification, fraud prevention, and Apple Push Notification service delivery.
• Google: Google Sign-In and associated account authentication, and Google Play purchases, subscriptions, and transaction verification where available.
• eBay: listing and price information and, for item-plus-shipping alerts, shipping estimates using the destination country and ZIP or postal code you provide.
• Vercel: website hosting and Web Analytics for website usage statistics.
• Operational providers: website hosting, email, and support services used to operate the Application and respond to requests.

These providers process information on our behalf or as independent providers under their own terms and privacy policies. Relevant information is available from Firebase Privacy and Security, Google Analytics for Firebase, Apple, Google, eBay, and Vercel Web Analytics.

Legal, safety, and business purposes

We may disclose information when reasonably necessary to comply with applicable law or a valid legal process; investigate fraud, abuse, or security incidents; protect the rights, safety, and property of users, Egghead Labs, or others; enforce our agreements; or establish, exercise, or defend legal claims.

If Egghead Labs is involved in a merger, financing, acquisition, reorganization, bankruptcy, or transfer of all or part of the Application or business, information may be reviewed or transferred as part of that transaction, subject to appropriate confidentiality and legal safeguards.

User-directed sharing

When you export or share collection information, you decide where and with whom to share the resulting content. Third-party applications or services you choose to use for sharing apply their own privacy practices.

5. Analytics and Diagnostics

Firebase Analytics helps us understand adoption, navigation, collection activity, alerts, and subscription performance. Crashlytics helps us identify crashes and technical failures. These services may associate pseudonymous Application or device identifiers with events and diagnostics and may process information outside your country.

We configure our own Analytics events not to include your search text, name, email address, suggestion details, product links, notes, support-message text, or export-message text. Information may nevertheless be processed by Firebase as described in Google's documentation and privacy terms.

Website usage statistics are processed separately through Vercel Web Analytics as described under "Website and external-link information."

6. Notifications and Store Alerts

We request notification permission only when you choose to enable alerts. You can disable push notifications through the Application or your device settings. Disabling device permission stops push presentation, but saved watch preferences or alert records may remain until you remove them or delete your account.

7. Subscriptions and Purchases

Apple or Google processes payments and billing information for purchases through the applicable app store. We receive the product, transaction or purchase-token, store account-token, and entitlement information needed to verify and provide subscription or one-time access, restore purchases, prevent duplicate or unauthorized claims, resolve support issues, and account for subscription status changes. The app store retains purchase and account records under its own policies.

Deleting the Application or your Blind Box Tracker account does not cancel an active app-store subscription. You must manage or cancel the subscription through your Apple or Google Play account settings, as applicable.

8. Retention and Account Deletion

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, including providing the Application, maintaining security, resolving disputes, enforcing agreements, and meeting legal, accounting, and fraud-prevention obligations. Retention depends on the type of record and why it is processed:

• Account and core collection data are generally retained while your account is active.
• Notification tokens and alert preferences are retained while needed to provide alerts or until they are disabled, replaced, or deleted.
• Saved price-alert targets and delivery destinations remain until you remove the alert or delete your account. Turning off push notifications alone does not remove these preferences. Qualifying matches and shipping-quote caches expire separately from the saved preference; expired source data is removed through routine cleanup. Where enabled, shared price history is limited to the approved retention window, up to 90 days, and is removed sooner when required by source-data deletion requests.
• Mailing-list records, consent and unsubscribe choices, and bonus status are retained while needed to manage your account, honor your choices, and document consent. Unsubscribing stops marketing delivery but does not immediately erase the subscription record or an earned bonus. Account deletion removes account-linked mailing-list and unsubscribe-link records through our deletion process, subject to the limited legal and backup retention described in this policy.
• Subscription and transaction-verification records may be retained after account deletion where reasonably necessary for entitlement verification, accounting, fraud prevention, refunds, disputes, or legal compliance.
• Alert delivery and notification-deduplication records may be retained as necessary to operate alerts, diagnose delivery, and prevent repeated messages.
• Analytics and diagnostic information is retained under our configured settings and the applicable provider's retention and deletion processes, and may remain in aggregated, de-identified, or pseudonymous form.
• Support correspondence is retained as reasonably necessary to respond, document the issue, prevent abuse, and meet legal obligations.
• We may retain suggestion details to evaluate product coverage and avoid duplicate work. Optional contact emails and related correspondence are retained only as reasonably necessary to handle or follow up on the request, resolve issues, and meet applicable legal obligations, and are removed when no longer needed.
• Backups may retain information for a limited period until they are overwritten or expire under normal backup procedures.

Deleting your account

You can initiate account deletion in the Application's settings. The process requires recent authentication and deletes your Firebase Authentication account and core user collection records, alert watchlists, notification-token records, alert preferences, and Application preferences associated with your account.

This includes saved price-alert targets and delivery destinations, as well as account-linked collector-email subscriber and unsubscribe-link records. Shared price histories about marketplace listings are not your account records and follow their separate retention and source-deletion rules.

Account deletion does not automatically remove the limited records described above when continued retention is reasonably necessary or permitted by law. Account deletion does not automatically remove suggestions, including any optional contact email you supplied, because suggestion records are not linked to your account identifier. Contact the Privacy Officer to request removal of a suggestion or its contact details. Account deletion does not cancel an app-store subscription.

9. Your Choices and Privacy Rights

Depending on where you live and subject to applicable exceptions, you may have the right to request access to personal information, obtain a copy, correct inaccurate information, request deletion, restrict or object to processing, withdraw consent, or request portability. You may also have the right to complain to a privacy or data-protection regulator.

You can exercise common choices directly:

• Profile: update your display name in the Application.
• Notifications: change alert choices in the Application or disable notification permission in device settings.
• Marketing email: turn off Collector emails in Settings, use the unsubscribe link in a marketing email, visit the Marketing Email Opt-Out page, or contact us. You keep an Endless Puzzles bonus you have already earned after unsubscribing.
• Price alerts and delivery destination: edit or remove an alert in the Application. Choose an item-price-only alert to avoid providing a delivery postal code.
• Subscriptions: manage or cancel your subscription through the Apple or Google Play account used to purchase it.
• Suggestion contact details: leave the email field blank to submit without a contact email, or contact the Privacy Officer to request removal of an email or suggestion you already submitted.
• Account deletion: use the in-app deletion feature or contact the Privacy Officer.

To make another privacy request, email eggheadlabs.dev@gmail.com with the subject "Privacy Request." Describe the request and the account email or sign-in method involved. For a suggestion request, provide enough detail to identify the suggestion and any optional contact email you supplied; it may differ from your account email. We may need to verify your identity before responding. We will respond within the period required by applicable law and will explain if an exception prevents us from fulfilling all or part of a request.

Canadian users

You may request access to and correction of personal information under applicable Canadian privacy law and challenge our compliance by contacting the Privacy Officer. If we do not resolve a concern, you may have the right to contact the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Privacy Commissioner of Canada, as applicable.

EEA and UK users

Where applicable, you may have rights of access, correction, erasure, restriction, portability, objection, and withdrawal of consent. You may lodge a complaint with the data-protection authority where you live, work, or believe an infringement occurred.

California and other U.S. state residents

Where applicable law grants these rights, you may request access to categories or specific pieces of personal information, correction, deletion, or information about disclosures. You may also have a right to opt out of sale, sharing, or targeted advertising and to receive equal service when exercising a privacy right. We do not sell personal information, share it for cross-context behavioural advertising, or process it for targeted advertising.

10. International Processing

Egghead Labs and its service providers may process information in Canada, the United States, and other countries where they operate. Those countries may have privacy laws different from the laws where you live, and information may be accessible to courts, law enforcement, or regulators under applicable law. Where required, we use contractual or other recognized safeguards for international transfers.

11. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information, including authenticated access, access controls, and encrypted network transmission provided by the Application and service providers. No method of transmission, storage, or security is completely reliable, and we cannot guarantee absolute security.

You are responsible for maintaining the security of your Apple or Google account and your device. Contact us promptly if you believe your Blind Box Tracker account or information has been compromised.

12. Children's Privacy

Blind Box Tracker is a general-audience service and is not directed to children under 13. Children under 13 must not create an account or submit personal information through the Application. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13 without legally valid authorization, we will take reasonable steps to delete it. A parent or guardian who believes a child has provided personal information should contact the Privacy Officer.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes to the Application, our practices, service providers, or legal requirements. We will post the updated policy and effective date on this page and may provide additional in-app, email, or other notice when required by law or appropriate for a material change. If consent is required for a new purpose, we will request it before using information for that purpose.

Previous versions are available in the Legal Archive.

14. Contact the Privacy Officer

Questions, complaints, and requests concerning this policy or Egghead Labs' handling of personal information may be directed to:

Privacy Officer
Egghead Labs
Email: eggheadlabs.dev@gmail.com

Please use the subject "Privacy Request" or "Privacy Complaint" so we can route your message appropriately.