MYMINI164 · last updated 30 September 2026
MYMINI164 is a personal project for cataloguing diecast model cars at any scale. This notice describes what it stores, where, who can see it and what you can do about it. It describes the application as it is actually built, not as a template.
The short version. To use MYMINI164 you need an account, which means an email address and a password. Everything else it holds is what you choose to record about your own collection. A new collection is private and shows nobody anything. There is a community here, so other collectors can find your profile and follow you, and you decide whether any of them can see what is on your shelf. What you paid is never shown to anybody, whatever else you open up. There is no advertising, no analytics, no tracking and nothing is sold or shared with anyone.
MYMINI164 is run by an individual, not a company, and is the data controller for everything described here. For anything in this notice, write to help@mybatsurvey.co.uk.
| What | Why | Lawful basis |
|---|---|---|
| Your email address and a hash of your password | So you can sign in and so a password can be reset. The password itself is never stored and cannot be read by anyone, including the person running the site. | Contract: without an account there is no application. |
| A display name, if you set one | What the application calls you, and what another collector sees when they find you in the community. | Contract. |
| A profile picture, if you set one | Shown to you. It is kept on the device you set it on and in your own settings row, and it is not sent to other collectors: they see your initials. | Consent: you set it, and removing it removes it. |
| Your collection: which releases you own, want or have on order, how many copies, their condition, what you paid, where you bought them, the order reference and any notes you write | This is the application. It is what you came to record. | Contract. |
| Your settings: currency, colourway, light or dark, how the grid is laid out, which catalogues you pin, which badges you show, and whether financial values are hidden | So the application looks the same on your next device as on this one. | Contract. |
| Your privacy settings: whether your collection, wishlist and activity are private, friends-only or open to the community, whether you appear on the community rankings, and whether you have opted in to the collection-value ranking | So the application can enforce what you decided. | Legal obligation and contract: these are the record of your choices. |
| Your community relationships: who you follow, who follows you, friendships, pending friend requests and anyone you have blocked | So following, friendship and blocking work. | Contract, once you use those features. |
| Notifications addressed to you, and activity entries recording things you did (added a car, earned a badge, completed a range) | So a friend request reaches you, and so an activity feed has something in it. Activity follows your own activity setting, which starts private. | Contract. |
| Badges you have earned, and the date each was first reached | So a milestone keeps its date instead of being recalculated every time your shelf changes. | Contract. |
| Ranking totals worked out from your collection: how many releases, how many pieces, how many catalogues, how many badges, an average rarity and a score | So the community rankings can be worked out once on the server instead of by downloading everybody's collection into everybody's browser. | Legitimate interests: a leaderboard is a core part of a collectors' community, the figures are totals rather than contents, and you can leave the rankings at any time in Privacy settings. |
| Anything you send in through "a missing car" or "report a problem" | So it can be checked and the catalogue corrected. | Legitimate interests: keeping a shared catalogue correct. |
Two companies are needed to run this, and both are American with British and European operations. Naming the region a database sits in is not the whole answer, so here is the whole answer.
| Who | What they do | Where |
|---|---|---|
| Supabase | The database and the sign-in system. Your account and everything in the table above is here. | The database is in the eu-west-2 (London) region. Supabase Inc. is incorporated in the United States, and support and administration may be carried out from outside the United Kingdom. |
| GitHub (Microsoft) | Serves the website itself as static files. It never sees your collection: the page is the same file for everybody, and your data is fetched from Supabase by your own browser. | GitHub Pages is served from a global network; GitHub, Inc. is in the United States. |
| Serves the typeface, if your browser does not already have it cached. | United States. | |
| The shops and makers whose photographs the catalogue links to | Serve a picture of a model car. They are told nothing about you beyond what any request for an image tells a web server. | Various, worldwide. |
So personal data is transferred outside the United Kingdom, at least in the sense that these providers are American companies whose staff and systems may reach it. Each has its own published terms and transfer arrangements; MYMINI164 relies on those and has not negotiated anything additional, which is stated here rather than dressed up. If that is not acceptable to you, please do not create an account.
All of this is enforced in the database itself, by row level security policies and by functions that check who is asking, rather than by what the page chooses to show. A request for something you are not entitled to is refused by the database whoever makes it, including from outside the application.
Your collection has one setting, which starts at Private.
| Setting | Who can see what is on your shelf |
|---|---|
| Private (the default) | You, and nobody else at all. |
| Friends only | You, and collectors whose friend request you accepted or who accepted yours. Following somebody does not make them a friend and does not open this. |
| Public | You, and any signed-in member of the community. Never anyone who is not signed in, and never a search engine. |
Your wishlist and your activity feed have their own settings, which work the same way and also start private.
What you paid, where you bought it, the order reference and your notes are never sent to another collector under any setting. They are not part of what a friend sees when they look at your shelf, and no ranking or aggregate is built from them.
Every active collector can be found by other signed-in collectors: your display name, your username if you set one, anything you write in your bio and the catalogues you list as favourites. This is how anybody follows anybody, and it does not depend on your collection setting. A private collection stays private while its owner is perfectly findable. Anyone can follow you without your permission; you can block them, which stops them seeing or reaching you in either direction.
The ordinary rankings - most releases, most catalogues, most badges, rarest shelf and so on - include every active collector by default, and you can leave them at any time in Privacy settings. They publish a total and never a contents: a collector with a private collection can stand in the table with a number beside their name, and nothing in their collection can be read by anyone. Because a ranking already publishes those totals, a collector taking part will also show the same totals on their profile card; leaving the rankings stops both.
Most Valuable Collections is different. It is off unless you deliberately turn it on, it uses the catalogue's market valuation rather than anything you paid, and it never shows a purchase price or a profit.
An administrator can see the list of accounts and display names, which is needed to run the site, and can award the four honorary badges. An administrator cannot read your collection, your prices, your settings or your private messages of any kind. That is not a policy, it is what the database does: the check was tested from an administrator's own account and refused.
MYMINI164 shows how uncommon a release is among its members, and how many collectors follow a given catalogue. Those figures are counts of distinct accounts and never carry anybody's identity. Where a count is small enough that it could point at a person, the count is not sent to the browser at all: the suppression happens in the database, not on the screen.
These requests reveal your IP address to the companies concerned, as any web request does. None of them receives anything about you or your collection.
MYMINI164 uses your browser's local storage rather than cookies. It holds your sign-in token, your settings, a marker naming which account those settings belong to, your profile picture if you set one, and any barcodes you have taught it. Signing out clears all of it. Nothing there is sent anywhere except your own settings, to your own account.
For as long as you have an account. Delete your account and your profile, collection, settings, badges, privacy settings, follows, friendships, blocks, notifications, activity and ranking totals are deleted with it, immediately and for good. There is no archive copy and no undo.
Two things deliberately survive, with your name taken off them: a correction or a missing car you sent in stays in the catalogue queue with no account attached to it, since the point of it was to fix a shared catalogue; and a notification somebody else already received that mentions you keeps the notification, without you as its sender. Neither carries anything about your collection.
Under UK GDPR you can ask for a copy of your data, ask for it to be corrected, ask for it to be deleted, object to processing carried out under legitimate interests, or ask for your data in a portable form. The application does several of these itself: "Download my data" in Your Account exports everything you have recorded in a machine-readable file, "Delete my account" removes it, and the rankings - the one thing here that rests on legitimate interests - can be left with a single switch in Privacy settings. Anything you cannot do from inside the application, ask for at the address above. You may also complain to the Information Commissioner's Office at ico.org.uk.
MYMINI164 is not aimed at children and asks for no age. It should not be used by anyone under 13.
If this notice changes in a way that matters, the date at the top changes with it.