Privacy Policy

This Privacy Policy explains how ToyAlive (“we”, “us”) collects, uses, shares, and protects information when you use the ToyAlive website, app, and related services (the “Service”).

ToyAlive is a parent-managed creative studio: an adult creates and manages the account, uploads toy photos, and chooses what to make. This policy works alongside our Terms of Service and Content rules. By using the Service, you agree to the practices described here.

We collect only what the Service needs to work:

• Account details — your email address, optional display name, authentication and session state, and account role.
• Toy uploads — the toy photos you upload, the toy names and descriptions you provide, and related metadata used to awaken the toy.
• Creation inputs and outputs — the prompts, scene ideas, themes, names, and settings you enter, plus the images, videos, captions, and stories ToyAlive generates, kept in your Toybox.
• Billing records — Spark Pack purchases, wallet balances, invoice details, and Stripe checkout and customer identifiers. We do not store full payment card numbers.
• Support messages — the email address and any details you include when you contact us.
• Usage and device data — product and error events, along with standard technical data such as browser type, device, and approximate region, collected through analytics and cookies.

• Awaken toys and create Magic Photos, storybooks, comics, short videos, and birthday messages you request.
• Run safety checks on uploads and generation requests so creations stay kid-safe and within our content rules.
• Operate accounts, process Spark Pack purchases, issue invoices, and provide support.
• Maintain, secure, and debug the Service, and prevent abuse and fraud.
• Understand and improve the product through aggregate analytics and error tracking.
• Comply with legal obligations and enforce our Terms of Service.

Where data protection laws such as the GDPR apply, we rely on these legal bases:

• Contract — to provide the Service you sign up for, including creating toys and adventures and processing purchases.
• Legitimate interests — to keep the Service safe and reliable, prevent abuse, and improve the product, balanced against your rights.
• Legal obligation — to meet tax, accounting, and other legal requirements.
• Consent — where required, for example for certain analytics or cookies. You can withdraw consent at any time.

To bring toys to life and make creations, ToyAlive sends the toy photo, descriptions, prompts, and generation inputs to third-party AI model providers only as needed to produce or safety-check the requested result.

We instruct these providers to process the data to deliver the Service. Their own handling of data may be governed by their terms. We do not use toy photos to build a public gallery, and ToyAlive is not designed around a public feed of children’s creations.

Spark Pack purchases are processed by Stripe. Stripe collects and handles your payment card details directly under its own privacy policy; ToyAlive receives confirmation, amounts, invoice data, and Stripe identifiers, but never your full card number. Purchases are one-time and we do not run subscriptions.

We use cookies and similar technologies that are necessary to sign you in and keep the Service secure, and product analytics (via PostHog and Google Analytics) to understand usage, measure reliability, and fix errors. Analytics data is used in aggregate to improve the product, not to build advertising profiles, and we do not sell it.

You can control cookies through your browser settings; blocking strictly necessary cookies may stop parts of the Service from working.

We do not sell your personal information. We share it only with service providers that help us run ToyAlive, and only as needed:

• Stripe (Payments) — Processes checkout, card payments, and invoicing for Spark Pack purchases.
• AI model providers (Creation & safety) — Receive toy photos, descriptions, and prompts only as needed to awaken toys, generate creations, and run safety checks.
• Cloudflare R2 (Asset storage) — Stores uploaded toy photos and the images and videos ToyAlive generates.
• PostHog (Analytics & errors) — Collects product usage and error events to diagnose issues and improve the product.
• Google Analytics (Analytics) — Measures aggregate site traffic and feature usage to understand and improve the product. Configured without advertising or cross-device (Google Signals) tracking.
• Cloud hosting & database (Infrastructure) — Runs the application and the database that holds account, toy, creation, and billing records.

We may also disclose information to comply with the law, enforce our terms, protect rights and safety, or as part of a merger, acquisition, or sale of assets, in which case we will notify affected users.

We keep account, toy, creation, and billing data for as long as your account is active or as needed to provide the Service. You can delete individual toys and creations at any time, and parents can request deletion of an account and its contents (see below). We retain limited billing and transaction records where required for legal, tax, and accounting purposes, and may keep backups for a limited period before they are overwritten.

Account, toy, creation, and billing records are stored in a PostgreSQL database, and uploaded photos and generated media are stored using Cloudflare R2 object storage. Data is encrypted in transit. We use reasonable technical and organizational measures to protect information, but no method of transmission or storage is completely secure.

ToyAlive and our service providers may process information in countries other than yours, including the United States. Where required, we use appropriate safeguards (such as standard contractual clauses) for international transfers.

ToyAlive is made for family use under adult control. Accounts are for adults (18+), who manage uploads, purchases, sharing, and privacy requests. Children do not create or control accounts, and we ask that the subject of uploads be toys — not children.

We do not knowingly collect personal information directly from children. Please do not upload photos that show a child’s face, or include last names, addresses, school names, or other sensitive details in prompts. First names or ages may be used only when a parent provides them for a greeting, dedication, or birthday message. If you believe a child has provided us personal information, contact [email protected] and we will delete it.

Depending on where you live, you may have rights to access, correct, delete, export, or restrict the use of your personal information, and to object to certain processing. These include rights under the GDPR and the CCPA/CPRA. We do not sell personal information or share it for cross-context behavioral advertising.

To exercise any right, email [email protected] from the address tied to the account. We will verify your request and respond within the time required by law. You may also lodge a complaint with your local data protection authority.

You can delete individual toys and creations from your Toybox at any time. For account or bulk deletion, email [email protected] or [email protected] from the account email and describe whether the request covers a toy, creation, account, or billing-support record. Do not include passwords, full card numbers, or sensitive child details in your message.

We may update this Privacy Policy as the product and legal requirements evolve. When we do, we will revise the “Last updated” date above and, for material changes, take additional steps to notify you where appropriate.

Questions or privacy requests? Email [email protected] for privacy and deletion matters, or [email protected] for general support.

ToyAlive
Governing law: the State of California