Privacy policy

Last updated: 2 November 2026 · The German version is the binding one.

This policy covers the Brickhaven app (iOS, Android and web) and the website brickhaven.app. In short: we only process what your collection needs. There are no ads, no tracking, no analytics tools, and we never sell data.

1. Who is responsible

We are not required to appoint a data protection officer; please send any question to the address above.

2. Your account

For an account we store your email address and your password (only as a secure hash, never readable), and when you signed up and last signed in. When you sign in, your IP address and technical details (such as the browser) are kept in security logs for a short time to detect abuse. Legal basis: performing our contract with you (Art. 6(1)(b) GDPR) and, for the logs, our legitimate interest in a secure service (Art. 6(1)(f) GDPR).

3. Your collection

We store what you enter in the app: your sets and copies (condition, build progress, price paid, purchase date, shop, storage location, notes, missing parts), your wishlist, loose bricks, sets you added yourself and mistake reports about sets. Only your account can see this data; we also see mistake reports in order to check them. Legal basis: Art. 6(1)(b) GDPR.

• Photos: photos of your copies and of your own sets are kept in private storage. They are shown only to you, through links that expire after one hour.
• Catalogue suggestions: if you suggest one of your own sets for the catalogue, we (as administrators) see its details and photo. If we accept it, the details and photo become part of the public catalogue – without your name or email address.
• Gift link: if you create a gift link for your wishlist, anyone with the link can see your wishlist and mark sets as “I'm buying this”. We store those marks together with a random key that stays in the browser of the person who made them; you never see them. You can delete or renew the link at any time.
• Camera: barcodes are read on your device. No camera images are sent anywhere unless you take a photo yourself for one of the purposes above.

4. Service providers who process data for us

• Supabase (Supabase Pte. Ltd., Singapore) runs our database, sign-in and photo storage. The data is stored in a data centre in Frankfurt am Main, Germany. We have a data processing agreement with Supabase (Art. 28 GDPR); the EU standard contractual clauses cover any access from outside the EU.
• Brevo (Sendinblue SAS, Paris, France) sends the app's emails, such as confirming your address or resetting your password, and delivers contact form messages to us. Brevo receives the recipient address and the content of the email. Data processing agreement under Art. 28 GDPR.
• mailbox.org (Heinlein Hosting GmbH, Berlin, Germany) runs our mailbox. When you write to us, your message is stored there. Data processing agreement under Art. 28 GDPR.
• Cloudflare (Cloudflare, Inc., USA) delivers the website brickhaven.app. To send the pages and protect them against attacks, Cloudflare processes your IP address and technical details of your request. Cloudflare is certified under the EU-U.S. Data Privacy Framework, and we have a data processing agreement. Legal basis: Art. 6(1)(f) GDPR.

5. Content from other servers

Pictures of sets and parts are loaded directly from the servers they are stored on: Rebrickable, Brickset, the shops of BlueBrixx, CaDA and Mould King, and – for recognised bricks – the pictures Brickognize points to. As with any picture, your device sends your IP address and technical details (such as the browser) to these servers. They receive no other information about you. Legal basis: our legitimate interest in showing you pictures of the sets (Art. 6(1)(f) GDPR).

Recognising bricks (Brickognize): when you take a photo of a brick under “Loose bricks”, only that photo is sent from your device directly to the free service Brickognize (api.brickognize.com), which recognises the brick. Brickognize also receives your IP address, but nothing about your account. Brickognize is an independent service and we have no influence on what happens to the photo there, so please photograph only the brick. This happens only when you use the feature (Art. 6(1)(b) GDPR).

Market prices: eBay prices are fetched by our server; nothing about you is sent to eBay. Links to eBay, shops or building instructions open that site only when you tap them – its own privacy policy applies there.

6. Contact form and email

When you write to us through the contact form or by email, we process your name (optional), email address, topic and message in order to reply. Contact form messages are stored in our database (Supabase) and delivered to our mailbox by Brevo. Legal basis: Art. 6(1)(b) GDPR when it concerns your account, otherwise Art. 6(1)(f) (answering your request). We delete messages once the matter is settled, at the latest after three years.

7. Storage on your device

The app stores only what it needs on your device or in your browser's storage: your sign-in, the chosen language and settings, and recently viewed sets. No consent is needed for this (§ 25(2) no. 2 TDDDG). We use no cookies for advertising or analytics.

8. How long we keep data

Your data is kept until you delete it or your account. You can delete your account at any time in the app (Account → Delete account) or request it here. This deletes your collection, wishlist, photos and gift link completely. Sets we took into the catalogue from your suggestions stay in the catalogue, with no link to you. Backup copies at our service provider are overwritten after a short time.

9. Your rights

You have the right to

• access the data stored about you (Art. 15 GDPR),
• rectification (Art. 16) and erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20) – you can export your collection as a file in the app at any time,
• object to processing based on our legitimate interest, on grounds relating to your particular situation (Art. 21).

To use these rights, write to [email protected]. You can also complain to a data protection authority, for example the one responsible for us: the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (www.ldi.nrw.de).

10. Other points

An account only needs your email address and a password; everything else is optional. There is no automated decision-making or profiling. Brickhaven is meant for people aged 16 and over. When the app's features change, we update this policy; the date at the top shows the current version.