Toysh is a private, invite-only network for one chapter, team or club at a time: active members, alumni and advisors. This policy explains what we collect, who can see it, how long we keep it, and the choices you have. It covers the Toysh iPhone app and the website at toysh.app.
The short version
- Your group sees your profile; nobody outside it does. Other groups can't see you or anything your group posts.
- Your email and phone stay private until you share them with a specific person.
- No ads, no tracking, no selling or renting your data. The app has no analytics or advertising code in it.
- Deleting your account removes your profile, posts and conversations. You can do it any time from the app.
- Questions or requests: privacy@toysh.app.
1. Who we are
Toysh is operated by Jack Teuschl, 10902 Berryland Ct, Oakton, VA 22124, United States ("we", "us"). We decide how your information is used and are responsible for it. Contact us at privacy@toysh.app about anything in this policy.
2. What we collect
Information you give us
Account. Your name, email address and password. If you use Sign in with Apple, Apple gives us your name (the first time only) and either your email or an Apple relay address. We never see your password in readable form: it's held by Amazon Cognito, our sign-in provider.
Your profile. Everything here is optional except your name and role. You choose what to add:
- Group details: your role, class year, office or position, and when you joined.
- Background: major, hometown, current city and state, company, job title, industry, headline, bio, LinkedIn link and a profile photo.
- Career history: work experience, education, skills, certifications, honors, topics people can ask you about, goals, and whether you're open to mentoring, networking or new roles.
- Military service, if you choose to add it: branch, status, specialty, rank, units and dates.
Private records. These are kept separately from your profile and are not shown to your group:
- Contact card: your email and phone number. Only people you share it with can see it.
- Academics: GPA and test scores, if you add them. Only you can see them.
- References: up to five people who can vouch for you, with their name, relationship, title, company, email and phone. Only you can see them. If you add someone as a reference, please make sure they're comfortable with it.
What you post and send. Posts, comments and likes; direct messages; job posts; requests for an intro, advice or a referral; new-job announcements; event RSVPs; questions and replies to your group; reports you file; people you block; saved people, job alerts and the job-search tracker.
Admin uploads. A group's admins can create the group (name, school, colors, logo and cover photo) and upload a member list to invite people.
Information about people who haven't joined yet
When an admin uploads a member list, it can include each person's name, class year, position, email and phone number. We use this only so the group can invite them and recognize them when they join. Members of the group can see this list. Invite links you send may include the invitee's name, class year and position so the join screen can fill them in. If you're on a list and don't want to be, ask your group's admin to remove you, or contact us.
Information collected automatically
- Push notification token, if you allow notifications, so we can send them to your phone.
- Activity dates, such as when you joined and the last day you opened the app, which your group's admins see on their dashboard.
- A scrambled (hashed) form of your email, used to match you to your group's member list.
- Technical information our servers receive with each request, such as your IP address, app version and device type. We don't use it to identify or track you.
- On the website: if you email us, we receive your email address and what you write. The website doesn't use cookies, analytics or advertising, and it loads no third-party fonts or scripts. The join page reads the code in your link in your browser and doesn't store it.
Information from others
- Other members may connect to you: saying you helped them get a job, reporting content, or adding you to a saved list.
- Apple, if you use Sign in with Apple.
What we don't collect
We don't read your device's location (cities are what you type in), your contacts or address book, your photo library (you pick specific photos to upload), advertising identifiers, or health or biometric data. The app reads your phone's tilt only to animate cards on screen; that data never leaves your phone.
3. How we use your information
- To run Toysh: create your account, show your profile to your group, deliver messages and notifications, and power search, the directory, jobs and requests.
- To connect people: suggest alumni who can help, and show you openings and people relevant to your interests and location.
- To keep the community safe: review reports, enforce our Terms and group rules, block abuse and spam, and limit how often accounts can sign in, post or send requests.
- To answer you when you contact us.
- To meet legal obligations and protect our rights and the rights of our users.
We don't use your information for advertising, we don't build profiles of you for anyone else, and we don't use automated decision-making that has legal or similarly significant effects on you.
4. Who can see your information
Your group. Members of your own group can see your profile and what you post. You can hide yourself from the group directory in Edit profile. Members of other groups can't see you, your profile or anything your group posts.
People you message. Direct messages are visible only to the people in the conversation.
Group admins. Admins, usually officers, captains or alumni leaders, can manage the group, approve and remove members, change roles, see the member list and activity dashboard, and review reports filed in the group. They can't see your private contact card, academics or references.
Service providers. We use a small number of companies to run Toysh. They process data only on our instructions:
- Amazon Web Services (United States): our servers, database, sign-in (Amazon Cognito), file storage and email.
- Apple: push notifications (Apple Push Notification service), Sign in with Apple and the maps in the app. Notification previews can include the sender's name and the start of a message.
- Logo.dev: when you type a company name, we look up its logo. Only the company name or website is sent, never who you are.
- Stripe: processes payments for group plans, which an admin buys on our website. We never see or store card numbers, and members never pay.
Legal and safety. We may share information if the law requires it, to respond to valid legal process, or to protect someone's safety, prevent fraud or abuse, or enforce our Terms.
Business changes. If Toysh is involved in a merger, acquisition or sale of assets, your information may transfer as part of it. We'll tell you before your information becomes subject to a different privacy policy.
We don't sell or rent your personal information, and we don't share it for targeted advertising.
5. Your choices
- Edit or remove anything on your profile at any time.
- Hide from the directory in Edit profile.
- Contact sharing: your email and phone go only to people you accept.
- Notifications: choose which ones you get in You, then Settings, or turn them off in iOS Settings.
- Block anyone from their profile or message. They aren't told.
- Delete your account at any time (section 7).
6. How long we keep information
- Your account and profile: for as long as you have an account.
- When you delete your account: see section 7. Deleted data can remain in our encrypted backups for up to 35 days before it's overwritten.
- Reports: we keep reports, and the content they quote, after the accounts involved are deleted, so we can deal with repeated abuse. We delete them after 2 years.
- Emails to us: up to 24 months.
- Server logs: 90 days.
- Group billing records: as long as tax and accounting law requires.
7. Deleting your account
Delete your account any time in the app: You, then Delete account. If you signed up with Apple, Apple will ask you to confirm. This also revokes Toysh's access to your Apple ID.
When you delete your account, we remove:
- your login, profile, photo and private records (contact card, academics, references);
- your posts and comments, and any comments on your posts; your job posts, new-job announcements and requests; your questions and replies to your group;
- your direct-message conversations, including the other person's side of them;
- your saved people, job alerts, tracker, notification settings and push tokens.
Most of this happens right away; the rest within a few hours. A few things remain: reports involving you (see section 6), a record that the account was deleted, groups you created, and entries other members made, such as a member list that includes your name. Ask your admin or contact us to remove those.
You can also email us to delete your account or specific information.
8. Your rights
Wherever you live, you can ask us to:
- access the personal information we hold about you, or get a copy in a portable format;
- correct it;
- delete it;
- object to or limit how we use it.
Email privacy@toysh.app from the address on your account. We'll confirm it's you, and reply within 30 days (45 where the law allows). We won't treat you differently for using these rights. If we decline a request, you can ask us to reconsider by replying to our decision. Depending on where you live (for example California, Colorado, Connecticut, Virginia or another US state with a privacy law), you may have additional rights, and you can appoint an authorized agent to make a request for you.
Toysh is intended for users in the United States and is only offered in the US App Store.
9. Security
We protect your information with encryption in transit (HTTPS) and at rest, access controls that check every request against who you are and what your group allows, rate limits, and a content filter on posts and messages. Only a small number of people who run Toysh can access production data, and only to operate, support or secure the service. No system is perfectly secure. If a breach affects your information, we'll notify you as the law requires.
10. Age requirement
Toysh is for people 18 and older. We don't knowingly collect information from anyone younger. If you believe someone under that age has an account, contact us and we'll delete it.
11. Where your information is stored
Your information is stored in the United States (AWS, us-east-1). Service providers listed in section 4 may process it in other countries, with protections required by law.
12. Changes to this policy
If we make significant changes, we'll tell you in the app before they take effect, and update the date at the top. Smaller changes are posted here.
13. Contact us
Jack Teuschl
10902 Berryland Ct, Oakton, VA 22124, United States
Privacy: privacy@toysh.app · Support: support@toysh.app