Privacy policy
Last updated: 2026-08-01
This document explains what data MyBrickGarage collects, why, and what you can do about it. We tried to write it plainly, without legal padding.
1. Who is responsible for your data
The data controller is [UZUPEŁNIJ: imię i nazwisko lub nazwa firmy], [UZUPEŁNIJ: adres do korespondencji]. For anything concerning personal data, write to kontakt@mybrickgarage.com.
MyBrickGarage is an unofficial site, not affiliated with the LEGO Group.
2. What we collect
Only what the service cannot work without.
- Email address - needed to create an account and sign in with a one-time link.
- Name and profile picture - only if you sign in with Google, and only what Google passes to us.
- Your collection - which sets you marked as owned or wanted, with an optional note, price and purchase date.
- Your preferred interface language.
- The content of any message sent through the contact form, along with the email address you provide there.
3. Why, and on what legal basis
- Running your account and storing your collection - performance of a contract, Article 6(1)(b) GDPR.
- Replying to your message - our legitimate interest in handling correspondence, Article 6(1)(f) GDPR.
- Keeping the service secure, including rate limiting - our legitimate interest, Article 6(1)(f) GDPR.
4. How long we keep it
- Account and collection data - for as long as you have an account. Deleting the account deletes them.
- Contact form messages - up to one year after we reply.
- Sign-in sessions - thirty days from the last sign-in.
5. Who processes it for us
We do not sell your data and we do not share it for marketing. We do use providers that process it on our behalf:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | hosting bazy danych | Unia Europejska (Irlandia) |
| Hetzner Online | hosting aplikacji | Unia Europejska (Niemcy) |
| Cloudflare | DNS, ochrona przed atakami, przekierowanie poczty | USA, standardowe klauzule umowne |
| Resend | wysyłka wiadomości e-mail | USA, standardowe klauzule umowne |
| logowanie kontem Google (opcjonalne) | USA, standardowe klauzule umowne |
6. Cookies
We only use cookies that are strictly necessary for the service to work. We run no analytics, we do not profile you and we embed no tracking scripts, which is why we do not ask for cookie consent - the law does not require it for this category.
If analytics are ever added, you will see a banner with a genuine option to refuse, and this document will be updated.
| Name | Purpose | Retention |
|---|---|---|
| authjs.session-token | utrzymanie zalogowanej sesji | 30 dni |
| authjs.csrf-token | ochrona przed atakami CSRF | do zamknięcia przeglądarki |
| authjs.callback-url | powrót na właściwą stronę po zalogowaniu | do zamknięcia przeglądarki |
| NEXT_LOCALE | zapamiętanie wybranego języka | rok |
7. Affiliate links
Sets may carry links to shops. If you buy through one, we may earn a commission and you pay no more because of it. Such links are marked.
Once you click, you are on the shop's site, which runs by its own rules and may set its own cookies. From that point their privacy policy applies, not ours.
8. Your rights
You have the right to access your data, correct it, delete it, restrict its processing, port it elsewhere, and object to processing based on legitimate interest.
To exercise any of these, write to kontakt@mybrickgarage.com. You may also lodge a complaint with your national data protection authority.
9. Security
The connection to the service is encrypted. We store no passwords, because sign-in uses a one-time link or a Google account. Database access is restricted and queries are parameterised.
No service is completely immune to incidents. If a breach occurs that threatens your rights, we will tell you.
10. Changes
When we change how we process data, we update this document and the date at the top. For significant changes we will notify signed-in users by email.