Privacy Policy

Last Updated: October 13, 2026

1. Introduction

myBrickStack ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our application.

2. Information We Collect

2.1 Authentication Information

When you sign in with Google OAuth, we collect:

• Email address
• Name (if provided)
• Profile picture (if provided)

2.2 Application Data

We store data you create in the application:

• LEGO wanted lists and items
• Inventory data
• Orders and part orders, which may include counterparty contact information you enter (such as a name, and optionally an email address or postal address)
• MOCs (My Own Creations)
• Sets and minifigures collections
• AI assistant conversation history if you use that beta feature
• Search history
• User preferences and settings

2.3 Provider Credentials

Provider credentials are optional. If you configure provider-backed features, current versions encrypt credentials before application storage for:

• BrickLink API access
• Rebrickable API access
• BrickSet API access
• BrickEconomy market data access

Credentials saved by earlier application versions may originally have been stored without application-level encryption. A required deployment migration encrypts any such legacy values before the current release serves traffic; the deployment fails if that migration cannot be completed. Credentials are only used to access the respective APIs on your behalf.

3. How We Use Your Information

We use the information we collect to:

• Provide and maintain the application
• Authenticate your identity
• Sync your data across devices
• Access third-party APIs (BrickLink, Rebrickable, BrickSet, BrickEconomy) on your behalf when configured by you
• Enforce limited public-preview quotas for storage, imports, provider calls, and AI assistant usage
• Improve the application experience
• Respond to your requests and support needs

4. Data Storage and Security

4.1 Data Storage

Your data is stored in:

• MongoDB Atlas - Cloud database for user settings, protected provider credentials, and synced data
• Browser LocalStorage - Local browser storage for preferences and session data
• Browser IndexedDB - Local browser database for application data

4.2 Security Measures

We implement security measures to protect your data:

• Current provider-credential writes and migrated legacy credential values are protected using AES-GCM encryption
• Data transmission uses HTTPS encryption
• User authentication via Google OAuth and server-managed session cookies
• User-scoped data access (users can only access their own data)

4.3 Data Retention

We retain your information only as long as needed to provide the application:

• Security and audit logs (including IP address, user agent, request metadata, and public-preview quota administration records) are retained for up to 90 days.
• Public-preview quota and provider-usage events are retained for up to 60 days.
• Permanent deletion is a two-phase process: we first disable access, revoke sessions, and purge associated cloud application data (including audit records linked to current or prior identifiers). We retain a limited deletion tombstone through a quiet period, then a later clean verification removes that tombstone and completes deletion.
• If a permanent purge cannot be verified, access remains disabled and we retain the limited tombstone only so remaining data can be located and the purge safely retried.
• Administrative soft deletion disables account access but retains the existing account identity and profile record, together with associated cloud application data, until the account is restored or permanent deletion completes. This recovery state does not expire automatically and is not a completed deletion request.
• Data stored locally in your browser remains on that device until you clear the site's browser storage.

5. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

• Third-Party APIs: We use your provider credentials to access BrickLink, Rebrickable, BrickSet, and BrickEconomy APIs on your behalf, as authorized by you
• Service Providers (Subprocessors): We use MongoDB Atlas for data storage and Render for application hosting; these providers process data on our behalf according to their respective privacy policies
• AI Provider (Subprocessor): When you use the AI assistant feature, your assistant messages and the results of the collection queries run to answer them are sent to Google (Gemini API / Google AI) to generate responses, processed according to Google's privacy terms
• Optional Analytics (Subprocessor): If you allow analytics, Google Analytics receives fixed application screen names and technical information from your browser and network, which may include your IP address, device and browser details, and analytics cookies. See Google's Privacy Policy.
• Legal Requirements: We may disclose information if required by law or to protect our rights

6. Your Rights and Choices

You have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your account and data (currently handled by request; contact support and we will delete your account and associated data)
• Export your data (currently handled by request; contact support to receive a copy of your data)
• Decline or withdraw optional Google Analytics through Analytics preferences in the application

Self-service tools for account access, correction, deletion, and export requests are not yet available. To exercise those rights, please contact us using the information provided below and we will action your request.

7. Cookies and Tracking

We use server-managed session cookies, browser localStorage, sessionStorage, and IndexedDB to maintain your session, preferences, and application data. Google Analytics is optional and starts only after you select Allow analytics. Your choice is saved in this browser. Allowing analytics sets a first-party consent cookie containing only your choice; it expires one year after that choice unless you choose again. If localStorage cannot save a decline, a first-party consent cookie stores that choice instead. You can change your choice at any time using Analytics preferences. If you decline or withdraw, the application stops further analytics events and removes accessible Google Analytics cookies. When enabled, Google Analytics measures visits and application screen usage using fixed screen names and a fixed site URL; we do not send account details, record IDs, search terms, or your actual URL, query, fragment, or referrer. Google may process analytics data according to its own privacy terms.

8. Children's Privacy

Our application is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.

9. International Data Transfers

Your data may be stored and processed in servers located outside your country of residence. By using our application, you consent to the transfer of your data to these locations.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.

11. Contact Us