Privacy Policy & Data Protection

Official Application Name: sextoysus.com
Application Website: https://sextoysus.com
Effective Date: January 1, 2026 • Last Updated: October 22, 2026

🛡️ Our Zero-Compromise Privacy, Security & Discretion Pledge

At sextoysus.com (accessible at https://sextoysus.com), we honor your absolute right to confidential, discreet, and secure shopping. We do NOT sell, rent, trade, lease, or monetize your personal information, shopping behavior, or Google account credentials to third-party data brokers, advertising networks, or marketing firms. All personal data collected is utilized solely to authenticate your identity, process and ship your customer orders, provide dedicated customer support, and comply with legal requirements.

Table of Contents

Introduction & Scope
Information We Collect
Google User Data & OAuth 2.0 Compliance
How We Use Your Information
100% Discreet Packaging & Billing
Disclosure & Sharing of Information
Cookies & Tracking Technologies
Data Retention & Deletion Policy
Your Statutory Privacy Rights (CCPA / GDPR)
Strict Adult Age Verification (18+ / 21+)
Data Security Measures
Contact Information & Data Deletion

1. Introduction & Scope

This Privacy Policy applies to the web application SextoyUSA (also operating under the domain https://sextoysus.com, hereafter referred to as "we", "us", "our", or the "Platform").

This policy governs all personal data collected when you access our website, create or manage an account, use third-party authentication services (specifically Google Sign-In or Google One Tap), browse catalog products, contact customer support, or complete an online purchase.

By accessing or using SextoyUSA, you acknowledge that you have read, understood, and agreed to the practices outlined in this Privacy Policy. If you do not agree with our policies, please do not use our services.

2. Information We Collect

We collect only the minimum personal information necessary to deliver our e-commerce products, process payments securely, verify customer age, and fulfill orders:

A. Information You Voluntarily Provide

Account Profile: Full name, email address, password hash (if registering via traditional email/password), telephone number, and order preferences.
Delivery & Shipping Information: Recipient full name, physical delivery address, apartment/suite number, city, state, ZIP/postal code, and optional delivery notes.
Transaction & Order History: Records of items purchased, dates, amounts paid, payment confirmation IDs, invoices, tracking numbers, and refund/exchange history.
Customer Support Records: Messages, emails, dispute records, and support tickets submitted through our help center or customer service channels.

B. Information Automatically Collected (Technical Telemetry)

Device & Browser Telemetry: IP address (anonymized for analytics), browser type, browser version, device category (desktop, mobile, tablet), and operating system.
Usage Activity: Referring URL, pages viewed, time spent per page, click paths, search terms queried on our site, and session timestamps.
Shopping Session State: Technical identifiers used to maintain shopping cart contents, session continuity, and currency selection across page loads.

3. Google User Data & OAuth 2.0 Compliance

The web application sextoysus.com provides users with the convenience of authenticating via Google Sign-In and Google One Tap (powered by Google Identity Services and OAuth 2.0). We take our stewardship of Google user data very seriously and maintain strict compliance with Google's API policies.

🔒 Google API Services User Data Policy — Limited Use Disclosure

sextoysus.com's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

A. Google OAuth Scopes Requested

When you sign in using Google, our application requests access solely to the following non-sensitive authentication scopes:

openid: Used to verify your identity using OpenID Connect authentication standards.
https://www.googleapis.com/auth/userinfo.email: Used to obtain your primary Google Account email address to create and manage your customer account and send transactional order receipts.
https://www.googleapis.com/auth/userinfo.profile: Used to obtain your full name and public avatar image URL to personalize your user profile dashboard.

B. What Google Data We Access and Store

When you authorize Google Sign-In, we receive and store only:

Google Subject Identifier (User ID): A unique numeric string assigned by Google to identify your account across authentication sessions.
Email Address: Your primary Google email address, along with Google's verification flag confirming the email is valid.
Full Name: Your first and last name as set in your public Google profile.
Profile Photo URL: The URL of your public Google profile picture (displayed in your account header).

Data We NEVER Access: We do NOT request, collect, view, or store your Google Account password, Gmail messages, contacts, Google Drive files, calendar events, search history, browsing history, or any other data from your Google Account.

C. How We Use Google User Data

Identity Verification: Allowing you to sign in safely with one click without creating or remembering a separate password.
Account Creation: Pre-populating your customer profile on SextoyUSA so you can easily manage past orders, saved shipping addresses, and wishlists.
Transactional Communications: Sending essential purchase receipts, shipping tracking updates, order dispatch notices, and customer support responses to your verified Google email address.

D. Strict Limited Use & Non-Disclosure Commitments

No Sale of Google Data: We NEVER sell, rent, lease, or monetize Google user data to data brokers, third-party marketing companies, or advertisers.
No Advertising Use: We NEVER use Google user data to serve advertisements, personalized marketing, retargeting ads, or behavioral profiling.
No AI/ML Training: We NEVER use Google user data to train, fine-tune, or develop artificial intelligence (AI), machine learning (ML), or large language models (LLMs).
No Unauthorized Transfer: We do NOT transfer Google user data to third parties, except as strictly necessary to fulfill physical delivery of your order (e.g. providing your name and shipping address to postal carriers like USPS/UPS), to comply with applicable law, or as part of a corporate merger.
No Human Inspection: No human employees or contractors read or inspect your Google user data unless you provide explicit affirmative consent for customer support, or where required for system security, fraud investigation, or legal compliance.

E. How Users Can Revoke Access via Google Account

You retain full control over your Google Account permissions. You can immediately disconnect and revoke SextoyUSA's access at any time by following these steps:

Visit your Google Account Security Settings page at: https://myaccount.google.com/connections (or https://myaccount.google.com/permissions).
Locate and click on SextoyUSA (or sextoysus.com).
Click the button labeled "Delete all connections you have with SextoyUSA" (or "Remove Access").
Confirm the prompt. Google will immediately invalidate all tokens granted to our application.

F. How Users Can Request Permanent Deletion of Google Data

If you wish to delete your account and expunge all Google profile data stored on our servers, you may submit a request at any time:

Direct Deletion Request: Send an email to our Data Protection Officer at privacy@sextoysus.com or support@sextoysus.com with the subject line "Google User Data Deletion Request".

Please send the request from the email address linked to your Google Account. Upon verification, we will permanently purge your Google identifier, profile record, stored addresses, and personal account data from our active databases within thirty (30) calendar days, and provide you with written confirmation.

4. How We Use Your Information

We process all collected information strictly for legitimate commercial and operational purposes:

Order Fulfillment & Logistics: Processing payments, packaging products, generating commercial shipping labels, and completing parcel deliveries via USPS, UPS, or FedEx.
Transactional Notifications: Transmitting order confirmation receipts, tracking links, delivery confirmations, and customer care responses.
Account Administration: Managing your shopping cart, wishlists, address books, and authentication sessions.
Fraud Mitigation & Platform Security: Detecting bot activity, preventing unauthorized account takeovers, screening for fraudulent chargebacks, and mitigating DDoS attacks.
Statutory Compliance: Upholding commercial accounting, state sales tax computation, customs compliance, and lawful government record-keeping requirements.

5. 100% Discreet Packaging & Billing Guarantee

Personal wellness, novelty toys, and intimate accessories demand total confidentiality. We implement comprehensive discretion protocols:

Plain Stealth Exterior: All parcels are dispatched in completely neutral, plain brown cardboard boxes, poly mailers, or standard USPS/UPS packaging. There is no mention of "sex toys", adult novelties, intimate products, or the website name on the outer box or shipping label.
Discreet Return Address: The return label displays a neutral fulfillment identifier (such as Fulfillment Logistics) to ensure complete confidentiality from mail carriers, neighbors, or household members.
Anonymous Billing Descriptor: Your credit card or bank statement will display a neutral commercial descriptor (such as SUS COMMERCE LLC or SECURE ONLINE STORE). Words related to adult novelty or sex toys will NEVER appear on your financial statements.

We do not sell, rent, or trade your personal data. Information is disclosed only to verified third-party service providers bound by strict contractual confidentiality agreements, solely to perform necessary services on our behalf:

Service Category	Data Transferred	Purpose & Safeguards
Shipping Carriers (USPS, FedEx, UPS)	Recipient name, physical delivery address, contact phone number	Physical transport and package delivery. Carriers are prohibited from using recipient data for marketing.
Payment Gateways (Stripe, PayPal, Authorize.Net)	Encrypted payment token, billing ZIP code, transaction total	PCI-DSS Level 1 certified payment processing. We never store complete credit card numbers or CVV codes on our servers.
Cloud & Hosting Infrastructure (Secure United States Datacenters)	Encrypted database records, session data, access logs	Platform availability, automated backups, 256-bit TLS encryption, and firewall security.
Analytics Providers (Google Analytics 4)	Masked IP address, device type, pages viewed	Website performance measurement. Evaluated on an aggregated basis with IP anonymization enabled.
Legal & Law Enforcement (When mandated by law)	Specific transaction documentation	Disclosed only in response to valid court orders, subpoenas, or statutory tax audits.

7. Cookies & Tracking Technologies

We use cookies and similar browser storage mechanisms to ensure website functionality:

Strictly Necessary Cookies: Essential session cookies (e.g. PHPSESSID) required to maintain items in your shopping cart across pages and preserve logged-in sessions.
Security & Anti-CSRF Cookies: Cryptographic tokens used to prevent Cross-Site Request Forgery and secure form submissions.
Google Identity State Cookies: Cookies (such as g_state) managed by Google Identity Services to regulate Google One Tap prompt display frequency.
Performance & Analytics (Google Analytics): We utilize Google Analytics 4 (Measurement ID: G-Q9FWF683D7 via gtag.js) to understand aggregate traffic flows. Google Analytics processes data anonymously with IP anonymization enabled. You can opt out of Google Analytics across all websites by installing the Google Analytics Opt-out Browser Add-on.

You can configure your browser to block or alert you about cookies. Please note that blocking functional cookies will prevent shopping cart persistence and checkout functionality.

8. Data Retention & Deletion Policy

We retain personal information only for as long as necessary to fulfill the purposes outlined in this policy:

Active Customer Accounts: Profile data and delivery addresses are maintained as long as your account remains active.
Completed Transactions: Order invoices, payment confirmation records, and tax calculations are retained for seven (7) years to comply with United States federal and state tax laws and financial audit requirements.
Google OAuth Data: Google profile information is deleted within thirty (30) days of receiving a verified account deletion request.
Technical Access Logs: Server connection logs and IP records are automatically rotated and purged every ninety (90) days.

9. Your Statutory Privacy Rights (CCPA / CPRA & GDPR Compliance)

Depending on your state or jurisdiction of residence (including California, Virginia, Colorado, Connecticut, Utah, and the European Economic Area / UK), you enjoy the following privacy rights:

Right to Know & Access: You may request a detailed report of the categories and specific pieces of personal information we have collected about you over the preceding 12 months.
Right to Deletion: You have the right to request the permanent deletion of your personal data, subject to limited statutory exemptions (such as completing an in-transit order or tax compliance).
Right to Correction: You may request correction of inaccurate personal data directly in your account profile or by contacting us.
Right to Opt-Out of Data Sale & Sharing: We do NOT sell or share personal data for cross-context behavioral advertising. We also honor browser-based Global Privacy Control (GPC) signals.
Right to Non-Discrimination: We will never deny goods, charge different prices, or provide a different quality of service because you exercise your privacy rights.

To exercise any of these statutory rights, please submit a verified request by emailing privacy@sextoysus.com. We will verify your identity, acknowledge receipt within 48 business hours, and fulfill your request within 30 to 45 calendar days free of charge.

10. Strict Adult Age Verification Policy (18+ / 21+)

Our website, catalog, and services are exclusively intended for legal adults who are at least 18 years of age (or 21 years of age in jurisdictions where local statutes establish 21 as the age of majority for adult novelties).

We do not knowingly collect, solicit, or maintain personal information from individuals under the age of 18. If we learn that personal data of a minor has been collected, we will immediately delete that information from our servers and terminate any associated pending orders. If you believe a minor has submitted personal data to our platform, please alert us immediately at privacy@sextoysus.com.

11. Data Security Measures

We implement administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, alteration, or disclosure:

Encryption in Transit: All web traffic and API communications are encrypted using modern Transport Layer Security (TLS 1.3 / 256-bit SSL).
Encryption at Rest: Sensitive data stored in our databases is protected with AES-256 encryption.
Cryptographic Password Hashing: User account passwords are protected using high-work-factor irreversible hashing algorithms (Bcrypt / Argon2).
PCI-DSS Level 1 Compliance: Payment processing is handled exclusively through tokenized, PCI-certified payment gateways.
Access Controls: Access to customer records is restricted on a strict need-to-know basis and secured with multi-factor authentication (MFA).

12. Contact Information & Data Protection Officer

If you have questions, feedback, or concerns regarding this Privacy Policy, your personal information, or our Google OAuth data practices, please contact our dedicated Privacy & Data Protection Officer:

SextoyUSA
Application Website: https://sextoysus.com
Dedicated Privacy Inquiries: privacy@sextoysus.com
Customer Support: support@sextoysus.com
Google Data Deletion Requests: privacy@sextoysus.com (Subject: Google User Data Deletion Request)
Response Commitment: We respond to all privacy and data deletion inquiries within 24 to 48 business hours.