Privacy Policy

Bik Brik helps collectors find building sets and minifigures, maintain a collection and watchlist, view reference values, and read editorial news. This policy explains what leaves your device, why we use it, and the choices available to you.

1. Data we collect

• Account and profile: email address, optional display name, Bik Brik user ID, authentication identifiers, and session or refresh-token records. Sign in with Apple may provide a name and relay or personal email according to your Apple choice.
• Collection and watchlist: set or minifigure identifiers, quantity, sealed or opened condition, target price, purchase or sale price and date, seller, source, box code, promotion, sales channel, and notes you choose to enter.
• Recognition photos (only once the photo recognition feature is enabled, see section 3): only after you have given consent and actively capture or choose a photo, the image is downscaled and compressed on your device, then sent to the Bik Brik server, which forwards it to Brickognize for identification. Bik Brik does not store the photo. See section 3.
• Recognition records (same condition as above): recognition mode, Brickognize result reference, number of candidates, the top candidate’s identifier, type, and confidence, how many candidates matched our catalog, a capture ID generated by the app, whether the request was a retry, and the request time. These records are linked to your account to operate and troubleshoot the feature and contain no image.

We do not request your precise location, contacts, health data, payment-card details, or bank details.

2. How we use data

• Authenticate and protect your account.
• Sync and restore your collection.
• Calculate portfolio views and buy scores.
• Return recognition results and diagnose failed matches.
• Answer support, correction, export, and deletion requests.
• Prevent abuse and maintain service reliability.

We do not sell or rent personal data. Bik Brik has no advertising SDK, does not use data for cross-app tracking, and does not build advertising profiles. Recognition interaction records are first-party service telemetry, not third-party advertising analytics.

3. Photo recognition and Brickognize

Photo recognition is not available in the current iOS version. This section describes how it works and applies only once the feature is enabled in a later update. It is provided by Brickognize, a third-party service that identifies LEGO products with machine-learning (AI) models. Before you use it for the first time, the app shows a consent screen that names Brickognize and explains how your photo is handled. No photo is sent until you agree.

• How a photo travels: from your device to the Bik Brik server, which forwards it to Brickognize. The app never sends photos directly from your device to Brickognize.
• Result thumbnails are loaded by the app directly from Brickognize’s image storage (storage.googleapis.com), so that service may see your device’s IP address when results are shown; no photo of yours is sent this way.
• Brickognize receives only the image and the search type (set, minifigure, part, or automatic). We do not send your email, name, account ID, or IP address with it.
• Brickognize’s terms allow it to store uploaded images and use them to train machine-learning models. Bik Brik does not control how Brickognize retains or deletes images, so do not photograph faces, documents, or other private information.
• Bik Brik does not save photos to a database or file storage. Our server holds the image in memory only while handling the request. Technical logs record file size, file format, and the top result, not the image content.
• You can withdraw your consent at any time in Account in the app. Withdrawing stops future uploads but cannot recall photos already sent to Brickognize.
• Saying no is fine: barcode scanning on the box and manual search keep working. Barcodes are read on your device and only the number is sent, never an image.

Learn more about Brickognize at brickognize.com.

4. Service providers and sources

Railway hosts the application servers. Supabase hosts the database and file storage; the current production database is in Singapore. Apple processes Sign in with Apple. Brickognize receives recognition photos through our server only once photo recognition is enabled and you consent (see section 3).

Rebrickable, Brickset, BrickLink, and BrickEconomy provide catalog or reference-market data, and ExchangeRate-API provides currency exchange rates. Our server calls these services with set or minifigure numbers or the search terms you enter, never your name, email, or account ID. News articles are drafted with help from AI models provided through Kie.ai (an API provider for models such as OpenAI GPT) using public news sources; none of your personal data is sent to Kie.ai or OpenAI.

Catalog and news images in the app and on the website may load directly from third-party image servers (such as Rebrickable, Brickset, BrickLink, the news sites we cite, or our storage provider), and the website loads its visit-counting script from Cloudflare (see section 7), so those servers can see your device’s IP address, as with any content loaded on the web.

We share personal data only with providers that are required to protect it at least to the standard described in this policy, and only as needed to run the service. These providers have their own legal terms and privacy practices. Data may be processed outside your country when needed to deliver the service.

5. Retention and deletion

Account, collection, watchlist, and recognition records are retained while your account is active and are deleted together with your account. Authentication records are retained until expiry or revocation. Server technical logs and provider backups age out on the hosting provider’s own cycle.

Your rights: you can ask to access, correct, delete, or export your data by emailing info@bikbrik.com. You can also start full account deletion from Account in the app. After verification, we delete or irreversibly anonymize active data unless a limited record must be retained for security, fraud prevention, or a legal obligation.

6. Security and your choices

We use authenticated requests, access controls, and encrypted network transport. No service is perfectly secure. Once photo recognition is enabled, you can withdraw consent in Account. You can also disable camera access in iOS Settings and continue to use manual search.

7. Cookies

The website sets only the cookies needed to keep you signed in and protect sign-in, and to remember your language choice. We use no advertising or analytics cookies.

To count visits, the website uses Cloudflare Web Analytics, which measures aggregate page views without cookies and without identifying you.

8. Children

Bik Brik is not directed to children under 13, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, email info@bikbrik.com and we will delete it.

9. Comments on news articles

You can comment on news articles on the website without an account.

• What we collect: the display name, email address and comment text you submit, the time you agreed and posted, and a hashed (one-way, salted) form of your IP address. We do not store your raw IP address.
• Why: to moderate comments, prevent spam and abuse, and contact you about your comment if needed. Comments appear only after review.
• Your email is never published or shown to other readers. Once a comment is approved, only your display name, the comment text and its date appear.
• Legal basis: your consent, given with the checkbox on the comment form. You can withdraw it at any time by asking us to delete your comments.
• Retention: approved comments stay until the comment or the article is deleted. Comments waiting for review, rejected, marked as spam or removed, and the hashed IP address of every comment, are deleted 90 days after submission. If others replied to a removed comment, it is replaced by a placeholder without your name, email, text or IP hash so their replies stay readable.
• Deletion: email info@bikbrik.com from the address you used, and we delete every comment posted with it (answered comments become the placeholder described above, and mentions of your name in replies become @[deleted]).

10. Contact

For a privacy or data request, email info@bikbrik.com or visit Bik Brik Support. Do not email a password or Apple verification code.