Last updated: 4 November 2026.
Klyaser helps you keep track of personal collections. The Android app identifier is com.my.collecto. This policy covers the mobile clients, cloud account features, the local web client and the information website klyaser.com. Features depend on the platform and version; Google sign-in and cloud sync are currently being tested ahead of public release.
Developer and party responsible for processing: Koval Ivan. Contact for support, privacy and deletion requests: [email protected].
1. Data you control
You can use the core collection tracking features without a cloud account. Your device stores your nickname, chosen avatar, added collections, item statuses and markers, favourites, notes, display preferences, downloaded catalogue and local technical records. The local web client keeps its own copy in browser storage; available features may differ from the mobile apps.
Before Google sign-in, personal progress is not sent for cloud sync. Catalogue downloads and support messages are separate network features described below.
2. Google sign-in and account creation
A cloud account is created when you sign in with Google. Sign-in uses Google and Supabase Auth. They process your Google account identifier, email address, permitted basic profile details such as your name and profile photo URL, session information and technical connection data. We use these for account identification, maintaining sign-in, associating cloud progress and handling account requests.
Klyaser requests the basic openid, email and profile permissions. Sign-in does not give the app access to your Gmail messages, Google Drive, contacts or Google Photos library. We do not receive your Google password. The nickname and avatar you choose in Klyaser are separate from your Google profile.
Session information is needed to maintain sign-in. Mobile clients use protected device storage. The local web client holds sign-in information in the local server's memory and uses a session cookie; restarting that server may require signing in again. The information website does not perform Google sign-in.
3. Cloud sync
After sign-in, Klyaser uses Supabase to store and sync:
- your nickname and the avatar chosen in the app;
- the list and order of added collections;
- item statuses and markers, using their identifiers;
- item notes in clients supporting the new sync format;
- favourite collections;
- your account identifier, cloud copy revision and technical operation records that prevent duplicate writes and conflicts.
Display and sorting preferences, collection and subcollection checkboxes and the local status-cycle phase are not synced. In older versions without note sync, notes remain local until the client is updated. Catalogue images, caches, complete local logs, the guest copy, local account archives and sign-in credentials are not included in the progress snapshot either. Avatars are stored separately in private storage.
The complete cloud progress copy is private: authorisation and access rules restrict access to the account copy. Authorised providers and the developer may process data to provide, support and protect the service and fulfil data requests.
In versions supporting leaderboards, synced accounts automatically participate in shared rankings. Your chosen Klyaser nickname, collection count, collected main-sticker count, rank and verification status, when granted, are visible to other users and visitors without signing in. A public profile also allows visitors to browse collection titles with manufacturer names and catalogue covers. This view does not show item progress or collection completion. Turning Public profile off prevents this view from loading on subsequent requests. Results use the last synced copy. A separate public participant identifier is used for display; leaderboards do not expose your email, Google profile, avatar, notes, item list or complete cloud copy. Local guests without a synced account do not participate. Signing out does not remove an existing account from the rankings; in versions with the option, turn off Public profile from the Profile menu to hide your account. Once confirmed by the server, your account is excluded from newly loaded results on all leaderboards; lists already open on other devices update when next loaded. Visibility is an account setting separate from progress and requires sign-in and connectivity to change. Turning it back on restores participation. You may also contact us using this policy's details to request hiding or deleting data. Account deletion also removes its leaderboard profile and results.
After sign-in, progress changes and opening Profile, the app may automatically check and transfer updates. A clean sign-in may download an existing cloud copy; an empty cloud may receive the local copy. When different copies exist, the app asks you to choose a complete copy and confirm replacement. Individual conflicting values are not automatically merged. Without connectivity, recent changes may remain local until sync succeeds.
Signing out of Klyaser stops sync for that session, retains a separate local account archive and returns to the guest copy. Signing out does not delete the account or cloud data. Signing into the same account again may restore its local archive.
4. Catalogue and connection data
The app contacts Cloudflare infrastructure for the catalogue, covers and item images. Some downloads may continue in the background when connectivity is available. Downloading the catalogue does not send your entire personal progress to Cloudflare.
Network requests may cause Cloudflare, Supabase and Google to process your IP address, request time, requested resource and ordinary technical headers. These support delivery, authorisation, security and service operation. The support service uses a protected identifier derived from the IP address to limit abuse; it is not used for advertising tracking.
From version1.2.4, the app also retrieves public interface settings from Supabase, such as whether the Community section is visible, and stores the last valid copy on your device. This request includes the client platform, does not include your progress or payment data, and does not require sign-in.
5. Support messages and attachments
When you explicitly send a support message, collection request or photo suggestion, we receive its text and type, an optional reply email, chosen attachments and, for item photos, the item title, number and collection/subcollection identifiers. Technical data is also processed for delivery and duplicate-send protection.
We use this information to reply, provide support and review catalogue material. Opening a form or choosing a photo does not itself send a message. Your entire profile, progress, avatar and local logs are not automatically attached. Information you include in text or images becomes part of the message.
Clients that prepare attachments create a copy of the selected image without the original personal EXIF/GPS metadata and use a standard filename. The original in your gallery is unchanged. Metadata removal does not hide faces, addresses, documents or text visible in an image. Please avoid unnecessary personal information.
6. Catalogue photos and collages
Submitting an item photo does not publish it automatically. The material is reviewed first. If separately accepted on an appropriate legal basis, the image may become available to other catalogue users. Your email and private correspondence are not added to the public item entry.
Accepted images may be kept without a predetermined deletion date while used in the catalogue, subject to rights holders' rights and applicable law. Permission to use a photo is arranged separately: this policy does not transfer copyright or replace a licence. Identify the collection and item when raising a photo privacy or rights request.
You select avatars and attachments through the system interface; the app does not scan your entire photo library for upload. Collages are created on your device and are not automatically uploaded to our server. Share passes the generated collage to the system sharing menu, where you choose the application and recipient. A temporary cached copy may be created. Processing and retention after transfer to another application depend on that application and your actions. Files exported to your gallery or another chosen location may remain after uninstalling Klyaser; you control those files.
7. Information website and local web client
The information website klyaser.com presents the app, this policy and a way to make data requests. It does not collect passwords, create accounts, read app progress or contain advertising trackers or third-party behavioural analytics scripts. Cloudflare processes ordinary web request technical data when you visit. Email buttons open your email application; a message is sent only after your action there.
The local web client is a separate program on your computer. It stores progress for a particular browser and localhost address. Its session cookie supports sign-in rather than advertising. Using a different browser or clearing site data may affect the local copy.
8. Providers and data use
We use Supabase for authentication, the cloud progress database and private avatars; Google for sign-in and Gmail for support correspondence; and Cloudflare for the website, catalogue, support service, delivery and infrastructure protection.
Data may be processed outside Ukraine, depending on the providers' locations and terms. See Supabase, Google and Cloudflare. Google Play and the operating system also process their own installation and distribution data under their respective rules.
We do not sell personal data, use Google user data for advertising or training general-purpose artificial intelligence models, or include advertising SDKs, third-party behavioural analytics or automatic crash reporting to the developer. Data may be disclosed where legally required. Access, use, storage and sharing of Google data are limited to the sign-in, sync and support purposes described here.
9. Retention
Local state, guest copies and account archives remain in device or browser storage until removed by you or the system. Signing out does not clear the local account archive. Android system backup of private app data is disabled; this does not promise an independent backup of your progress.
Cloud accounts and associated progress remain while the account exists, until an account deletion request is completed. Changing an avatar does not immediately remove the previous file: older avatars and sync operation records may remain until the account's data is fully deleted. Clearing local progress, signing out or uninstalling the app does not automatically delete cloud data.
Support messages, correspondence, reply email and attachments are kept while a request is handled and removed from the managed mailbox no later than 30 days after the request is closed, or earlier on request unless further retention is legally required. This period does not cover photos separately accepted for the catalogue.
Support anti-abuse and duplicate-protection records expire 24 hours after creation; periodic cleanup is scheduled hourly. This technical store does not retain the message text, photos or original IP address.
Providers' own technical, security and backup retention follows their terms and applicable requirements. Deleting an active copy does not guarantee the immediate erasure of every provider backup. Legally required retained data is limited to the relevant purpose and period.
10. Deleting your account and data
Email [email protected] with the subject “Delete Klyaser account”, preferably from the address used for Google sign-in. State that you want your account and associated cloud data deleted. We may request minimal confirmation of account ownership. Do not send passwords, sign-in codes, identity documents or access keys.
After verification, deletion covers the Klyaser account in Supabase Auth, associated cloud progress, nickname, stored avatars and that account's operation records, except information whose retention is legally required. We communicate the handling and outcome by email within the time limits required by applicable law. Deleting a Klyaser account does not delete your Google account.
Sign out of Klyaser on your devices before the request is carried out. After deletion, a new Google sign-in may create a new account and upload an existing local copy again. To remove private local copies, clear app data or uninstall the app; for the local web client, clear the relevant site data in your browser. These actions may permanently delete unsynced progress. Developer-side deletion does not erase device files or previously exported collages.
You can separately request deletion of support information, identifying the email, date and a brief description. For public catalogue photos, identify the collection and item; the request is considered in light of privacy, rights and applicable law. Instructions are also on the account deletion page.
11. Your rights, security and policy changes
You can manage your local profile, choose not to sign in, sign out, avoid sending support messages, or contact us about access, correction, deletion, restriction, objection and withdrawal of consent where consent is the basis for processing. Rights apply to the extent provided by applicable law. You can also contact a competent data protection authority.
Catalogue, cloud and support connections use HTTPS. Private device storage and service access rules protect data, but absolute security cannot be guaranteed. Contact us if you suspect unauthorised access.
When features or data practices change, we update the policy and its date. A separate notice or consent will be provided where required by the change. For all enquiries: Koval Ivan — [email protected].