BrickPal Privacy Policy
Last updated: 2 August 2026
BrickPal is an iPhone app for tracking a LEGO® collection. This policy explains what data the app collects, why, who it is shared with, and how to get it deleted.
Contact for any privacy question or request: lee.gower17@gmail.com
The short version
- We collect the minimum needed to run your account and store your collection.
- There is no analytics, tracking, advertising, or third-party SDK of any kind in the app. We do not profile you, and we never sell or rent your data.
- Photos you scan are sent to a third-party recognition service to identify the set, and are not stored by us.
- You can delete your account and everything in it from inside the app at any time.
What we collect
Account information
| Data | Why | Required? |
|---|---|---|
| Email address | To create your account, sign you in, and send password resets | Yes |
| Password | To sign you in. Stored only as a salted hash — we never see it | Yes, unless you use Apple or Google sign-in |
| Username | To identify you to friends who follow you | Yes |
| Display name, short bio, profile picture | To personalise your profile | No — all optional |
If you sign in with Apple or Google, we receive an email address from them and nothing else. If you use Apple's "Hide My Email", we only ever see the relay address Apple generates.
Your collection
The sets and minifigures you mark as owned, built, wishlisted or previously owned, plus quantities, build start/finish dates, and your 1–5 star ratings.
Social
Who you follow and who follows you.
Profile visibility. Accounts created from this version onwards are public by default, meaning your username, profile picture, bio, collection and statistics can be viewed by other BrickPal users. You can turn this off at any time in Settings → Public profile. Your email address is never shown to other users.
Newsletter
If you opt in, we store your email address to send occasional BrickPal news. You can unsubscribe at any time in Settings → Newsletter, or via the link in any email.
Photos you scan
When you scan a set or minifigure, the photo is sent to Brickognize to be identified. We do not store your photos on our servers. A short history of matches (the identified item's name and picture, not your photo) is kept locally on your device and never leaves it.
The app asks for camera access to scan, and photo library access if you choose an existing picture instead. Both are optional — you can decline and still use the rest of the app.
What we do not collect
We do not collect your location, contacts, device identifiers for advertising, or any usage analytics. The app contains no advertising or tracking technology.
Who your data is shared with
| Service | What it receives | Why |
|---|---|---|
| Supabase | Your account and collection data | Hosts our database and authentication. Data is stored in the EU (AWS, Frankfurt) |
| Brickognize | Photos you choose to scan | Identifies which LEGO set or minifigure is in the picture |
| Brickset | Set numbers only — never anything about you | Looks up recommended retail prices |
| Apple / Google | Only if you choose their sign-in | Authenticates you |
Set and minifigure catalog information comes from Rebrickable, imported in bulk. No personal data is ever sent to Rebrickable.
The app also links out to retailer websites (LEGO.com, Amazon, Argos, John Lewis, Smyths, Target, Walmart, BrickLink) so you can buy a set. Tapping one opens your browser as a normal web link; we do not share any of your information with them.
We do not sell your personal data, and we do not share it for advertising.
How long we keep it
Your data is kept for as long as your account exists. When you delete your account it is removed immediately and permanently, including your profile, collection, wishlist, ratings, build history, follows, profile picture and newsletter subscription. Deletion cannot be undone.
Backups may retain copies for a short period before being overwritten.
Your rights
Under UK and EU data protection law you have the right to access, correct, export, restrict or object to our use of your data, and to have it erased.
The easiest routes are built into the app:
- Delete everything: Settings → Delete account
- Stop newsletter emails: Settings → Newsletter
- Make your collection private: Settings → Public profile
- Correct your details: edit your username, bio or picture on your profile
For anything else, including a copy of your data, email lee.gower17@gmail.com and we will respond within 30 days.
Our lawful basis for processing is contract (running the account you asked for) and consent (the newsletter, and camera/photo access, each of which you can withdraw).
If you are unhappy with how we have handled your data, you can complain to the UK Information Commissioner's Office at ico.org.uk.
Children
BrickPal is not directed at children under 13, and children under 13 should not create an account. If you believe a child has given us personal information, email lee.gower17@gmail.com and we will delete it.
Changes
If this policy changes materially we will update the date at the top and, where the change is significant, notify you in the app.
Trademark notice
LEGO® is a trademark of the LEGO Group, which does not sponsor, authorise or endorse BrickPal. Set and minifigure data is used for cataloguing purposes only.