Privacy Policy

Account Information

When you create an account, we collect your email address, display name, and authentication provider identifier. If you sign up with Google, we receive your email address and display name via Google OAuth (using the openid, profile, and email scopes). If you sign in with Apple in our iOS app, we receive your email address, which may be an Apple private relay address; we do not store your name.

Payment Information

For paid subscriptions, our payment processor Stripe collects payment information. We do not store full credit card details on our servers. We keep your subscription tier and status, and a history of your invoices and refunds: amounts, dates, and Stripe reference ids.

Referral Information

Once, when you sign up, we record how you found us: the page you landed on, the site that referred you, any campaign tags in the link, an ad click identifier if you arrived from an ad, a promo code if you redeem one, and whether you signed up on the web or in an app. If you sign up by email, this is held for up to 24 hours against a hashed copy of your email address; if you check out before your account exists, it is held for up to 24 hours under a random reference. Either way it is then attached to your account.

Inventory Data

We store LEGO set numbers, part quantities, and collection preferences.

Connected Accounts (Rebrickable and Brickset)

If you connect your Rebrickable or Brickset account, you enter that account's username and password once. We send them to Rebrickable or Brickset to obtain a user token (for Brickset, a user hash) and do not store your password. We store the token, encrypted with AES-256-GCM, and your username for that service on our servers. We use the token only when you ask us to, to read and add sets in your account there and, for Rebrickable, to create part lists and add parts to them. Disconnecting the account in account settings deletes the token and username.

Identify Feature (Images)

When you use the "Identify" feature, we transmit the image you provide to Brickognize for processing. We do not permanently store these images on our servers.

Usage Information

We collect information about search queries and feature usage counts to enforce tier quotas and improve the application.

When you are signed in, we keep a record of your account activity: when you created your account and last signed in, when you last changed your collection, the sets you recently viewed, the parts you recently identified, the Search Parties you hosted, and your progress on the sets you track. Our staff can view this record alongside your email address, username, and subscription to provide support, prevent abuse, manage complimentary access, and understand how the Service is used. We also combine these records into overall statistics, such as how many people are active each day.

We use PostHog for anonymous, cookieless product analytics. This collects page views, feature usage events, and basic device information (browser type, screen size). No persistent identifiers or cookies are used for analytics purposes.

Feedback

When you send feedback through the Service, we store your name, email address, message, and the category you chose so we can review and respond to it.

Request Information

Our hosting provider, Vercel, processes technical details of each request to the Service, such as your IP address and browser user agent. We review this only as combined traffic totals, such as request counts by page or by user agent, to detect automated traffic and manage costs. It is not linked to your account.

GDPR Rights (EU Users)

You have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data (right to be forgotten)
• Restrict processing of your data
• Data portability
• Object to processing
• Withdraw consent at any time
• Lodge a complaint with your local supervisory authority

CCPA Rights (California Residents)

You have the right to:

• Know what personal information is collected
• Delete personal information
• Opt-out of sale of personal information (note: we do not sell personal information)
• Non-discrimination for exercising privacy rights

All Users

You can:

• Delete your account and all associated data via account settings. Referral and invoice records are anonymized rather than deleted, keeping only the channel and campaign tags, dates, and amounts, with nothing that identifies you, so our revenue totals stay correct. If we granted you complimentary access, the record of that grant (your email address, the tier, its expiry, and our note on why) is kept until you ask us to remove it.
• Download a Backup file through account settings. It holds your tracked sets (with their status and whether you have the instructions and box), owned piece counts, loose parts, lists and the items in them, minifigures, and your theme and pricing preferences. It does not include your account details, profile, MOCs, or billing history.
• Contact us for any other data rights request