Privacy policy
Last updated: 2026-08-05
This document explains what data MyBrickGarage collects, why, and what you can do about it. We tried to write it plainly, without legal padding.
1. Who is responsible for your data
The data controller is Jakub Lipiec, Warszawa, Polska. For anything concerning personal data, write to rodo@mybrickgarage.com.
MyBrickGarage is an unofficial site, not affiliated with the LEGO Group.
2. What we collect
Only what the service cannot work without.
- Email address - needed to create an account and sign in with a one-time link.
- Name and profile picture - only if you sign in with Google, and only what Google passes to us.
- Your collection - which sets you marked as owned or wanted, with an optional note, price and purchase date.
- Your preferred interface language.
- The content of any message sent through the contact form, along with the email address you provide there.
- Your IP address and basic request metadata - they appear in the server logs and in the rate-limiting counter.
3. Why, and on what legal basis
- Running your account and storing your collection - performance of a contract, Article 6(1)(b) GDPR.
- Replying to your message - our legitimate interest in handling correspondence, Article 6(1)(f) GDPR.
- Keeping the service secure, including rate limiting - our legitimate interest, Article 6(1)(f) GDPR.
4. How long we keep it
- Account and collection data - for as long as you have an account. Deleting the account deletes them.
- Contact form messages - up to one year after we reply.
- Sign-in sessions - thirty days from the last sign-in.
- Technical server logs containing your IP address - thirty days, to keep the service secure.
5. Who processes it for us
We do not sell your data and we do not share it for marketing. We do use providers that process it on our behalf:
| Provider | Purpose | Location |
|---|---|---|
| webh.pl | server, application and database hosting | Poland (Łódź) |
| Cloudflare | DNS, attack protection, e-mail forwarding | USA, standard contractual clauses |
| Resend | sending e-mail messages | USA, standard contractual clauses |
| signing in with a Google account (optional) | USA, standard contractual clauses |
6. Cookies
We only use cookies that are strictly necessary for the service to work. We run no analytics, we do not profile you and we embed no tracking scripts, which is why we do not ask for cookie consent - the law does not require it for this category.
If analytics are ever added, you will see a banner with a genuine option to refuse, and this document will be updated.
| Name | Purpose | Retention |
|---|---|---|
| authjs.session-token | keeping you signed in | 30 days |
| authjs.csrf-token | protection against CSRF attacks | until you close the browser |
| authjs.callback-url | returning you to the right page after signing in | until you close the browser |
| NEXT_LOCALE | remembering the language you chose | one year |
| market | remembering the country you chose, so we can show offers from your market | one year |
7. Affiliate links
Sets may carry links to shops. If you buy through one, we may earn a commission and you pay no more because of it. Such links are marked before you click them.
Clicking takes you through an address on our site, then on to the affiliate network and the shop. We set no cookie of our own along the way - the network and the shop set theirs, on their own domains, outside our service. From that point their privacy policy applies, not ours.
Below are the networks we work with and how long the cookies they set live. The figures come from their own terms and can change without our involvement.
| Network | Shops | Cookie lifetime |
|---|---|---|
| Rakuten Advertising | LEGO.com | up to 30 days, depending on the store |
| eBay Partner Network | eBay | 24 hours |
8. Affiliate click log
We record the click on our side so we know which sets and which shops are actually useful to people, and so we can check a commission statement against the network's report.
- What we record: which set, which shop, the country you selected, the interface language, the path on our site the click came from, the moment of the click, and your account ID if you happen to be signed in.
- What we do not record: your IP address, a browser fingerprint, or the full address of the page you came from. A click by a signed-out visitor is not linked to any person.
- Legal basis: our legitimate interest in settling commissions and improving the service, Art. 6(1)(f) GDPR.
- How long: 24 months, roughly the settlement and correction cycle of affiliate networks. After that the entry is gone.
- Your right to object: you can object to this processing at any time by writing to rodo@mybrickgarage.com.
9. Click identifier (subid)
We append a random click identifier to the shop's address. The affiliate network returns it in the sales report, which tells us which sets a commission related to, without giving us any data about your order.
The identifier contains neither your e-mail address nor your account name. The shop learns nothing about who you are from it - to them it is a meaningless string.
10. Your rights
You have the right to access your data, correct it, delete it, restrict its processing, port it elsewhere, and object to processing based on legitimate interest.
To exercise any of these, write to rodo@mybrickgarage.com. You may also lodge a complaint with your national data protection authority.
11. Security
The connection to the service is encrypted. We store no passwords, because sign-in uses a one-time link or a Google account. Database access is restricted and queries are parameterised.
No service is completely immune to incidents. If a breach occurs that threatens your rights, we will tell you.
12. Changes
When we change how we process data, we update this document and the date at the top. For significant changes we will notify signed-in users by email.