ToySwap Privacy Policy

ToySwap is a local toy-trading app for families, operated by Yosef Rodin, based in Montreal, Quebec. Parents own every account. Kids use the app only through a profile inside their parent's account.

From parents:

• Email address and password (passwords are stored encrypted/hashed; your email is verified at signup)
• A parent PIN used to protect Parent Mode (stored only in a hashed form)
• The first 3 characters of your postal code (your FSA — e.g., "H4A"). We never store your full postal code or address.
• The neighbourhood communities you choose to join (e.g., "NDG")
• Your search radius and app settings

About kids (entered by the parent):

• First name only
• A cartoon avatar chosen from our built-in picker
• An optional age range (e.g., 7–9) and toy interests the child selects

Toy listings:

• Photos of toys, and the toy's name, category, and condition

Trading activity (when you use it):

• Trade proposals, approvals, and history between your family and the other family involved
• Messages you exchange with the other parent inside a trade (text only — photos and files cannot be sent)
• The public meetup spot and time you select for an exchange
• Points earned by your kids for completed swaps

Automatically:

• Basic technical logs needed to run and secure the service (e.g., sign-in events)

• No photos of children — avatars only
• No full postal codes, street addresses, or GPS location
• No kids' last names, birthdates, emails, or phone numbers
• No contact information beyond the parent's verified email

• To show your family's toy listings to other nearby families
• To let two families propose, discuss, and arrange a toy swap — always with both parents' approval
• When you photograph a toy, the photo is analyzed by an artificial-intelligence service to suggest the toy's name, category, and condition. The parent or child reviews and confirms these suggestions. Toy photos are used only for this purpose and for displaying your listing.
• To operate, secure, and improve the app, and to review reports of inappropriate content or behaviour

We do not sell or rent your information. We do not show advertising. We do not use kids' information for marketing or profiling.

ToySwap is designed so that parents are in control. Only a parent can create an account, and by creating a kid profile the parent consents to the collection of that child's first name, avatar choice, age range, and toy interests, as required for children under 14 by Quebec law. Children cannot sign up, cannot share contact information, and cannot message anyone. All communication in ToySwap happens between parents, and every trade requires approval from the parents of both families.

Other ToySwap families in your shared communities or within your search radius can see, for each toy you list:

• The toy's photos, name, category, and condition
• Your child's first name and cartoon avatar
• Your community name or an approximate distance (e.g., "about 3 km away")

When you enter a trade with another family, that family's parent can additionally see the first names involved in the trade, the messages you send them, and the meetup details you agree on.

No other user can ever see your email, your FSA or postal code, your settings, or your family's activity.

Your information is stored with our hosting and database provider (Lovable Cloud, built on Supabase) and toy photos are processed by an AI service (Google Gemini, via Lovable's AI Gateway) solely to analyze toy photos as described above. These providers act on our behalf and are not permitted to use your information for their own purposes. Data may be stored on servers outside Quebec/Canada; we choose providers with strong security practices.

We keep your information only while your account is active.

• Delete a toy listing: its photos and details are permanently removed.
• Delete a kid profile: the profile, its listings, and all associated photos are permanently removed.
• Delete your account (Parent Mode → Settings → Delete Account): your entire family account — all kid profiles, listings, photos, trade history, messages, and account data — is permanently and irreversibly deleted, including from our storage systems.

You can also email yrsdhomestore@gmail.com to request deletion or a copy of your information, and we will respond within 30 days.

We protect your information with encryption in transit, hashed passwords and PINs, verified email addresses, and database access rules that strictly isolate each family's data. Trades, messages, and meetup details are visible only to the two families involved. No system is perfectly secure, but we design for privacy first: we minimize what we collect so there is less to protect.

Under Quebec's privacy law (Law 25), you have the right to access your personal information, correct it, withdraw consent, and request deletion. To exercise any of these rights, contact our Privacy Officer at yrsdhomestore@gmail.com. If you are not satisfied with our response, you may file a complaint with the Commission d'accès à l'information du Québec (CAI).

If we make meaningful changes, we will update this page and notify account holders by email before the changes take effect.

Questions or requests: yrsdhomestore@gmail.com