LPS Checklist Privacy Policy

The short version

You can use a lot of the app without an account. If you do, your collection stays on your phone.
If you make an account, your profile and collection are stored with our service providers, so they follow you to a new phone and other collectors can see the things you choose to share.
We don't sell your personal information.
Free accounts see adverts from Google AdMob. Adverts are only personalised for people who agree to it, and never for anyone under 18.
Accounts for under-13s can browse, collect and vote, but can't post, comment, message, sell or trade.
Messages aren't end-to-end encrypted. If a message is reported, or our word filter flags it, a moderator can read it and some of the messages around it. Every time that happens, it's recorded.
You can delete your account, and what's in it, from Settings at any time.

Who we are

LPS Checklist is made by Hammerhead Studios, an independent developer. Under data protection law Hammerhead Studios is the "data controller", which means it is responsible for your information. You can contact us at lpschecklistapp@gmail.com.

Using the app without an account

You can browse the pet catalogue, keep track of your collection, build a wishlist and use the Blind Box Decoder without signing in. Your collection is then stored only on your phone, and we don't receive it.

A few things still happen without an account:

You'll see adverts, so Google AdMob receives the information described under Adverts.
If the app crashes, an anonymous crash report is sent (see Crash reports).
The app downloads updates to the pet catalogue from our web host, which, like any web server, sees your IP address.

Your account

You need an account to post, comment, message, sell, trade, or keep your collection safe when you change phones. Accounts are run by Google Firebase Authentication. You can sign in with Apple, with Google, or with an email address and password.

We never see your password: Firebase checks it for us. If you sign in with Apple and choose "Hide My Email", Apple gives us a private relay address instead of your real one.

What we store if you have an account

What	Why
Your email address, and how you sign in	To run your account, let you sign back in, and contact you about your account if we need to.
Your date of birth	To work out your age group, so we can apply the limits for under-13s and under-18s (see Children and Adverts). We keep the date so the limits lift by themselves on your birthday. We don't use it for anything else.
Profile details you choose to add: handle, display name, photo, banner, bio, pronouns, a country-level location, and your profile page design	So other collectors can recognise you. You decide what to fill in. If you add your real name, it stays private: only you can see it.
Your collection: pets you own (including dupes), wishlist, favourites, folders, tier lists, ISO lists, My Mascot, My Display, notes and settings	So they follow you between devices, and so you can share them if you want to. What you paid for a pet is never shown to anyone else.
Photos and pictures you upload	To show them where you put them: on your pets, profile, pages, posts, listings or messages.
Posts, comments, poll votes and contest entries	To run the Home feed.
Messages, including photos, stickers and reactions	To deliver them to the person you're talking to.
Marketplace activity: listings, orders (including any tracking number you add), trade offers and reviews	To run the marketplace and trades. The app doesn't handle payments between collectors, so we never receive payment details for those deals.
Follows, friends, blocks and mutes	To run the social features, and to keep you in control of who you deal with.
Reports you make, and any moderation of your account	To keep the community safe.
A record of each time a moderator opens a reported or flagged conversation: who opened it, when, which report, and why	So we can show that private messages are only read when a report or a flag calls for it.
Your notification choices, and a token for your device	To send you the notifications you've turned on.
Blind box codes you confirm	When you tell the app which pet was inside a box, we save the code, the pet and your account id, so the decoder gets better for everyone.

Who can see what

Some things are meant to be seen by other collectors. You're in control of most of it.

Your profile basics (handle, display name, photo and bio) can be seen by anyone using the app. Under-13 accounts aren't shown in search or suggestions.
Your collection, wishlist, favourites, tier lists and mascot can each be set to Public, Followers, Friends (your close friends) or Private (only you). They start as Public. You can change them when you edit your profile, under Privacy Defaults.
Posts can be shared with everyone, your followers, or your close friends.
Marketplace listings and reviews are public.
Messages are shown only to the people in the conversation. They're stored on our servers so they can be delivered, and they aren't end-to-end encrypted. If a message is reported, or our automatic word filter flags it, a moderator can read that message and some of the messages before and after it. See Reports and moderation.
Share my collection activity is off unless you turn it on. When it's on, new pets and lists you add appear in your followers' feeds.
PawMatch is off unless you turn it on. When it's on, collectors looking for a pet can see that you have a spare dupe of it, and your wishlist is matched against other people's dupes.
What you paid for a pet, and your real name, are never shown to anyone else.

Reports and moderation

Members can report posts, comments, messages, profiles, art, stories, listings, trades and contest entries. We also run an automatic word filter on messages, which flags a message that contains certain offensive words. A report, or a flag from the filter, is what lets a moderator look at something.

Posts, comments and other shared content. Moderators can see what was reported, in full, so they can decide whether it breaks the community guidelines.
Private messages. We don't read conversations that nobody has reported or flagged. When a message is reported or flagged, a moderator can read that message and up to 20 messages sent before it and 20 after it, so they can understand what happened. They have to give a reason before the conversation opens.
Every look is recorded. Each time a moderator opens a reported or flagged conversation, we record who opened it, when, which report it was about, and the reason they gave. If that record can't be saved, the conversation doesn't open.
Serious cases. Only in a serious case, such as a risk to someone's safety or a legal requirement, might we need to look at more than that. We'd only do it when it's necessary, and we'd keep a record of why.
Who we may pass it to. If something reported shows a child at risk, a threat to someone's safety, or another crime, we may pass it and the account details linked to it to the police or emergency services, to child protection organisations such as the National Center for Missing & Exploited Children (NCMEC) or the relevant national agency, or to anyone with a valid legal order.
Reports can include sensitive information. A report, and the messages around it, can contain personal or sensitive details, or evidence of a crime. We use them only to deal with the report and keep people safe.
How long we keep them. Reports, and the record of who looked at them, are kept for as long as we need them to deal with the report, to handle an appeal, or to meet a legal duty.

If we take action on your account, we'll tell you why. If you think we got it wrong, email lpschecklistapp@gmail.com and a person will look at it again. The community guidelines explain what can happen when the rules are broken.

Photos and the camera

When you add a photo, the app asks to open your photo library or your camera. Only the photos you pick or take are uploaded. We don't look through your library.
Photos are stored with our storage provider, Supabase. Before a photo is uploaded, the app removes its location data (where the photo was taken).
Pictures that other people can see, such as profile photos, posts, stories, listings and page decorations, are checked automatically by Google Cloud Vision SafeSearch for adult or violent content. A picture that fails the check isn't published. The checks run up to a monthly limit; if that limit is reached, a picture can be published before it has been checked, and it can still be reported and removed. Google processes the picture only to run this check. Photos in private messages aren't sent for checking.
Cutting the background out of a picture happens on your phone.

The Blind Box Decoder and your camera. The decoder uses your camera to read the code printed on a box. The camera picture is processed on your phone and is never uploaded, stored, or sent to us or anyone else. The app asks for camera permission the first time you open the decoder or take a photo for a story, and you can type the code in instead.

Adverts

The app shows adverts to free accounts, supplied by Google AdMob. They help pay for the app's running costs.

You can turn them off. Collector Pro, or the one-off Remove ads purchase, switches adverts off on your account.
You decide about personalised adverts. Where the law requires it, such as in Europe, Google's consent form appears before any adverts are shown, so you can accept or refuse personalised adverts. You can change your answer at any time in the app: Settings, Privacy, Ad privacy choices.
Your advertising identifier stays private unless you agree. The app only uses your iPhone's advertising identifier if Apple's tracking prompt has asked you and you said yes.
Never personalised for under-18s. Personalised adverts are only shown to people who have agreed to them, and never to accounts under 18. Everyone else gets non-personalised adverts, which are chosen using things like the app itself and your general location (such as your town or country), not a profile of you.
Extra care for under-13s. For under-13 accounts, every advert request is marked as directed to a child, so Google only shows adverts that are suitable for children and never personalises them.
Rated by age. Adverts shown to accounts aged 13 and over are limited to content rated suitable for teens; under-13 accounts only see adverts rated for general audiences.
Watching an advert is always your choice. Sometimes you can watch an advert to unlock something, such as an extra ISO list.

AdMob receives information such as your device type, IP address and how you interact with adverts. We never give AdMob your email address, your collection, your messages, or anything else you put into the app. Google explains how it uses this information in Google's privacy policy.

Purchases

Collector Pro (a subscription with a free trial) and Remove ads (a one-off purchase) are sold through Apple's App Store. RevenueCat keeps track of what you've bought, so it works on all your devices.

We never see your card details: payment happens entirely with Apple. RevenueCat receives a random id for your account and your purchase history in the app. You manage and cancel subscriptions in your Apple ID settings. Deleting the app, or your account, doesn't cancel a subscription.

Crash reports

If the app crashes or something goes wrong, it sends a crash report to Sentry so we can fix the problem. A report contains technical details, such as your phone model, iOS version, app version and what the app was doing when the error happened. It also carries an anonymous account id, so we can tell when several reports come from the same person. Reports never include your name or email address. Sentry stores them in the United States and deletes them automatically after a limited time.

Helping improve the beta

While the app is in beta, it asks once whether you'll help improve it. Usage counts and screen recordings only happen if you say yes, and you can change your mind at any time in Settings, Privacy.

Usage counts: if you say yes, the app sends PostHog a note of which screens you open and which features you use, such as adding a pet or finishing a scan, with technical details such as your phone model, system version, app version, language and time zone. It never sends what you write, your messages, your photos, your searches, your name or your email address. Each note carries an anonymous account id, so we can see how people come back to the app.
Screen recordings (18 and over only): if you also switch on "Also record my screen", PostHog records the app's screens as pictures, with where you tap, so we can see which screens are confusing and fix bugs. A small "Recording" sign shows on screen the whole time. Everything you type, your messages, your notifications, other people's posts, names and photos, and the sign-in screens are always hidden in the recording, on your phone, before anything is sent. What can show is the app's own buttons and menus, the catalogue pages, and your own collection. Recordings are never needed for any feature, and turning them off is one switch.
Questionnaires: during the beta you may be asked two short questionnaires, after your first day and after your first week. Every question can be skipped. Your answers are stored with your account id in our Firebase database, and only we can read them.
Age: nothing is counted or recorded for anyone under 13, and they aren't asked any questionnaires. Under-18s are never recorded.

PostHog stores this data in the United States. We've asked it not to keep your IP address or work out your location from it. Recordings are deleted automatically after 30 days, and usage counts after one year at most. Some ad blockers and VPNs block PostHog; that's fine, the app works the same.

Notifications

If you turn notifications on, we store a token for your device with your account, so we can send the notifications you've chosen. They're delivered through Expo's push service and Apple's notification service. You can choose which kinds you get in the app's Settings, or turn them off in your iPhone's settings.

Our service providers

We use a small number of companies to run the app:

Google Firebase (Authentication, Cloud Firestore and Cloud Functions): accounts, your synced data, notifications and account deletion.
Supabase: storing the photos you upload.
Google Cloud Vision: checking pictures that other people can see.
Google AdMob: adverts for free accounts.
RevenueCat: keeping track of purchases.
Sentry: crash reports.
PostHog: usage counts and screen recordings during the beta, only if you agree (see Helping improve the beta).
Expo: delivering push notifications.
GIPHY: when you search for a GIF, your search words are sent to GIPHY to find matching GIFs.
Netlify: hosting the pet catalogue updates the app downloads, and this website.
Apple and Google: signing in with your Apple or Google account, and (Apple) in-app purchases and push notifications.

They process data on our instructions, or under their own terms for the service they provide. Some of them are based in other countries, including the United States. Where the law requires it, the transfer is protected by the safeguards the provider offers, such as standard contractual clauses or the Data Privacy Framework.

Children

LPS Checklist is used by collectors of all ages, so accounts for under-13s have extra limits:

They can browse the catalogue, keep a collection, and vote in polls and contests.
They can't post, comment, send messages, enter contests, sell or trade.
They aren't shown in search or suggestions.
Their adverts are marked as directed to a child, so they're non-personalised and suitable for children.

We ask for a date of birth when an account is made, and use it only to apply these limits and the advert settings above. If you're a parent or carer and think your child has given us information without your knowledge, email us and we'll delete it.

Why we're allowed to use your data

Data protection law asks us to explain the reasons we rely on:

To provide the app you asked for: your account, collection, posts, messages, listings and purchases.
Our legitimate interests: keeping the community safe (reports, moderation, reading reported or flagged messages, and picture checks), enforcing our Terms of Use and community guidelines, protecting children, preventing crime, fixing crashes, and preventing abuse.
Your consent: personalised adverts, notifications, access to your camera and photos, and beta usage counts and screen recordings. You can change your mind at any time.
Legal obligations: for example, online safety laws that require us to deal with reports of illegal content, reporting child sexual abuse material to the authorities, and answering lawful requests from the authorities.

How long we keep things

Your account data is kept until you delete your account.
Crash reports are deleted automatically by Sentry, within 90 days at most.
Reports, and the record of each time a moderator opened a reported or flagged conversation, are kept for as long as we need them to deal with the report, handle an appeal, or meet a legal duty.
Beta screen recordings are deleted automatically by PostHog after 30 days, and beta usage counts after one year at most.
If you delete your account, we keep a record of your purchases (dates, product and the store's transaction number, with no name or email) for two years, in case of a refund or payment dispute, then delete it.
Blind box code reports are kept after you delete your account, because the decoder depends on them. Once your account is gone, the account id stored with them no longer points to anyone.

Deleting your account

Deleting is built into the app. Go to Settings, then Account, then Delete Account. This removes your account and your profile, collection, posts, comments and uploaded photos. It can't be undone. If the app asks you to sign in again first, that's a security check: sign in, then tap Delete Account once more.

Messages you sent stay in the other person's copy of the conversation, but your profile is no longer shown with them.
Completed trades and orders stay in the other person's history. Open trade offers are cancelled.
Deleting your account doesn't cancel a subscription. Cancel it in your Apple ID settings.

You can also email us from the address on your account, and we'll delete it for you.

Your rights

Under the data protection law where you live (such as the GDPR), you can ask us to:

give you a copy of your data;
correct it;
delete it;
limit, or object to, how we use it;
give you your data in a format you can take somewhere else.

Email lpschecklistapp@gmail.com and we'll reply within one month. We may need to check it's really you first. If you're unhappy with how we've handled your information, you can complain to the data protection authority where you live.

This website

We don't use cookies, analytics or tracking on this website. It's hosted by Netlify and delivered through Cloudflare, which keep standard server logs (such as IP addresses and the pages requested) to run and protect the site. The fonts come from Google Fonts, so your browser fetches them from Google.

If you send us an advertising enquiry, in the app or on this website, we receive what you type into the form (your name, email address, business, what you'd like to advertise, your budget and its currency, any link, and anything else you add), through our website host Netlify, and use it only to reply to you.

Changes to this policy

If this policy changes in a way that matters, we'll change the date at the top and let you know in the app.

Contact us

Email lpschecklistapp@gmail.com. We aim to reply within a few days.