This policy explains how Hot Wheels Collection Tracker collects, uses, and protects your personal data in compliance with the EU General Data Protection Regulation (GDPR) 2016/679.
This Privacy Policy describes how Hot Wheels Collection Tracker (referred to as "the App" or "the Service") collects, uses, and safeguards the personal data of users who access the mobile application and the associated website.
By using the App, you agree to the practices described in this Privacy Policy. Please read it carefully before creating an account or using the Service.
The data controller is the independent developer responsible for the Hot Wheels Collection Tracker app, reachable through the website hotwheelstrackercollection.it.
For any privacy-related inquiries, you may contact us at [email protected].
The App collects different categories of data depending on how you use it (guest or registered user):
| Category | Specific Data | When Collected |
|---|---|---|
| Account Data | Username, email address, password (stored as SHA-256 hash — never in plain text) | Only when the user registers |
| Session Data | JWT access & refresh tokens (stored in encrypted secure storage) | Upon login |
| Collection Data | Hot Wheels model IDs, price paid (optional), wishlist items | When the user adds cars |
| Usage Data | Screens visited, searches performed, in-app events (e.g. car added, currency changed) | During app use (PostHog) |
| Error & Crash Data | Stack traces, App version, device model, OS version, anonymous session identifier | On crash or error (PostHog) |
| Password Recovery Data | Email address the reset is sent to, plus the IP address and timestamp of the request | Only when you request a password reset |
| Technical Logs | IP address, request path, query string, HTTP status code, response time, user agent, and username (for authenticated requests). Passwords, tokens and credentials are stripped before writing | On every request to the Service |
| Advertising Data | Advertising ID, ad interaction data, device information | After UMP consent (AdMob) |
| Profile Avatar | Profile picture chosen from gallery or camera | Optional — stored locally on device only |
bcrypt hash on the server. JWT tokens are stored in encrypted native secure storage (Android Encrypted Shared Preferences / iOS Keychain).
We process data for the following purposes:
Creating and authenticating user accounts, managing sessions, and credential recovery.
Managing personal collection, wishlist, statistics, and publicly shareable profile.
Improving user experience through aggregated analysis of in-app behavior.
Rapid identification and resolution of bugs and crashes to ensure service stability.
Serving relevant ads to economically support the free service.
Fulfilling applicable regulatory and legal obligations of the data controller.
The legal bases for processing are:
The App integrates the following third-party services, each of which processes data independently under their own privacy policies:
We use Resend to deliver transactional emails — currently the password reset message. To do so, your email address and the message content are transmitted to Resend, which acts as a data processor on our behalf. These emails are service messages: they are not marketing, and no newsletter or promotional content is sent.
Resend Privacy Policy →
We use PostHog (EU instance: eu.i.posthog.com) to collect analytics data on App usage. When a user is authenticated, PostHog associates events with their username and email address via the identify feature. For anonymous users, PostHog automatically assigns an anonymous distinct_id.
Tracked events include: screen views, searches, adding/removing cars from the collection and wishlist, currency change, login, and logout.
PostHog also receives error and crash reports. When an unhandled exception occurs, or when the App catches an error it cannot recover from, a report is sent with the exception and its stack trace, plus the App version, device model and operating system. As with the other events above, a report is linked to your account when you are logged in; the payload never contains your password.
PostHog Privacy Policy →We use Google AdMob to display advertisements inside the App. On first launch, users are shown the UMP (User Messaging Platform) consent form required by Google. Ads are loaded only after the user provides consent.
AdMob may collect the device's Advertising ID, hardware information, and ad interaction data to serve personalised ads. The maximum ad content rating is set to G (suitable for all audiences). The App is not tagged for child-directed treatment or users under the age of consent.
The App may include affiliate links to external marketplaces (e.g. AliExpress) for Hot Wheels models. Clicks on these links are tracked by the respective affiliate programs on their own platforms. We do not share users' personal data with these services.
Data is retained according to the following criteria:
| Data Type | Retention Period |
|---|---|
| Account data (username, email) | Until the user deletes their account |
| Collection & wishlist data | Until manually removed or account deletion |
| Session tokens (JWT) | Access token: up to 12 months from login. Refresh token: 12 months, or until logout |
| Password reset requests | Reset link: 60 minutes and single use. Record of the request (IP address, timestamp): 7 days |
| Error & crash data | Per the controller's PostHog account configuration |
| API technical logs | 30 days, then automatically rotated out |
| PostHog analytics data | Per the controller's PostHog account configuration |
| Profile avatar | Local only — deleted upon App uninstall |
As a data subject under the GDPR, you have the right to:
Request confirmation of processing and obtain a copy of your personal data.
Request correction of inaccurate or incomplete data concerning you.
Request deletion of your personal data ("right to be forgotten").
Obtain restriction of processing under certain circumstances.
Receive your data in a structured, machine-readable format.
Object to processing based on legitimate interest, including profiling.
To exercise your rights, contact us at [email protected]. We will respond within 30 days of receiving your request. You also have the right to lodge a complaint with your national data protection authority — in Italy: www.garanteprivacy.it.
The Service is intended for a general audience and is not specifically directed at children under the age of 13. We do not knowingly collect personal data from children below that age without verifiable parental consent.
Advertising served via AdMob is configured with tagForChildDirectedTreatment: No and tagForUnderAgeOfConsent: No, ensuring that child-directed ad content is not served.
If you are a parent or guardian and believe your child has provided personal data without your consent, please contact us immediately so we can arrange for deletion.
We reserve the right to update this Privacy Policy at any time. Material changes will be communicated via an in-app notification or by updating the "Last updated" date at the top of this document.
Continued use of the App after changes are published constitutes acceptance of the updated Policy. We encourage you to review this page periodically.
For questions, data requests, or any privacy-related reports, send us an email and we'll get back to you within 30 days.
[email protected]