Privacy Policy
Last updated: 9 September 2026
Brickonomics helps you find the best prices for LEGO sets, parts and minifigures. To do that we need to process some personal data. This page explains what we collect, why, who we share it with, how long we keep it, and the rights you have. We have tried to keep it readable; if anything is unclear, ask us through the contact form.
In short
- You can use most of the site without an account. Without one we only process your IP address (for security and to guess your country and currency), your preference cookies, and anonymous usage statistics.
- With an account we store your email address, username, hashed password, country, currency and the lists, collections and price alerts you create.
- We do not sell your data. We share it only with the service providers we need to run the site, listed below, and with retailers you choose to visit.
- You can delete your account, and everything attached to it, yourself at any time from your account settings.
Who is responsible
The data controller is Brickonomics, established in Ede, the Netherlands, Chamber of Commerce (KvK) number 90494946. You can reach us through the contact form.
What we collect and why
Visiting the website
When you load a page, our servers receive your IP address, browser type and the page requested. We use this to:
- deliver the site and keep it secure, including detecting bots, scrapers and abuse;
- estimate your country from your IP address so we can show prices in the right shops and currency by default. This lookup happens on our own server using a local database; your IP address is not sent to a third party for it. You can change the country and currency at any time in the menu;
- write standard server logs.
If our systems think a visit may be automated, we show a short verification challenge provided by Cloudflare (see "Third parties"). Passing it sets a cookie so you are not asked again for a while.
Usage statistics
We run our own analytics instance (Umami, hosted by us at analytics.brickonomics.net) to understand which pages and features are used. It records page views, the referring site, screen size, browser type, the country and currency you have selected, and whether you are logged in. It does not use cookies, does not store your IP address, and does not identify you personally.
Advertising attribution
We occasionally advertise on Facebook and Instagram. If you arrive from one of those ads, the link contains a click identifier. We keep that identifier in your browser's local storage together with the campaign parameters, and when you interact with the site or create an account we report that back to Meta so we can measure whether the ad worked. That report contains the click identifier, your IP address and browser type, and, on sign-up, a hashed (unrecoverable) version of your email address, your user ID and your country. Nothing is reported to Meta if you did not arrive from a Meta ad. You can object to this at any time (see "Your rights").
Your account
When you register we store your email address, a username, a hashed version of your password (we never store the password itself), your country and currency, whether your email address has been verified, your notification settings, and, if you arrived via a campaign link, the campaign source. We use this to provide your account, send you the emails described below and secure your login.
Lists, collections and alerts
Everything you save on the site, such as part lists, collections, purchase records including the prices you paid, price watches and marketplace alerts, is stored with your account so we can show it back to you and send the alerts you asked for.
Linked accounts
You can optionally connect your Rebrickable, Brick Owl or Brickset account to import or export lists. To do that we store the credential you give us (an API key, or for Brickset your username and password) encrypted at rest, and use it only to call that service on your behalf when you ask us to. You can disconnect a linked account at any time from your account settings, which deletes the credential.
Emails we send
We send service emails to account holders: email verification, password reset, a welcome message, and the price and marketplace alerts you set up. Every alert email contains a link to mute that alert or unsubscribe.
Separately, if you opt in to the monthly newsletter, we store your email address on our newsletter list and send you one email a month. You can unsubscribe with the link in any newsletter.
Contact form
If you use the contact form we store your name, email address, the reason, subject and message, and email it to ourselves so we can reply.
Clicking through to shops
When you click a link to a retailer or marketplace, we record which shop and item was clicked, the country and currency you had selected, and the price shown. This record contains no IP address and is not linked to your account. We use it to see which shops our visitors find useful. Many of these links are affiliate links: if you buy something, the shop may pay us a commission at no extra cost to you. Once you leave our site, the shop's or affiliate network's own privacy policy applies, and they may set their own cookies.
Error reporting
If something breaks in your browser or on our server, a report of the error is sent to our own error tracking instance (GlitchTip, hosted by us at errors.brickonomics.net). Reports contain the error, the page you were on and your browser type. They are configured not to include your IP address or other identifying details.
Apps and services you connect to your account
Other apps and services can ask for permission to access parts of your Brickonomics account, such as your lists and price watches, through "Sign in with Brickonomics". Before anything is shared you see exactly which permissions are requested, and nothing is shared until you approve. The app or service then processes that data under its own privacy notice, and you can revoke its access at any time from your account settings.
Cookies and local storage
We use only cookies that are needed to run the site or remember your choices. We do not use advertising or cross-site tracking cookies. By category:
| Category | What it does | Lifetime |
|---|---|---|
| Preferences | Remember the country, currency and display settings you chose, and banners you dismissed | 1 year |
| Security | Remember that you passed the bot verification challenge | 30 days |
| Login session | Keep you logged in to your account | 30 days, or until you log out |
| Advertising attribution (local storage) | Remember the campaign link and Meta click identifier you arrived with, so we can measure our ads | Until cleared by your browser |
Our analytics and error reporting set no cookies. You can delete cookies and local storage at any time through your browser settings.
Third parties
We do not sell or rent your personal data. We share it only with the following service providers, and only as far as needed for the purpose stated. Where a provider is outside the European Economic Area, transfers are covered by the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
| Provider | What for | Data involved | Location |
|---|---|---|---|
| OVH SAS | Hosting our servers, databases, analytics and error tracking | All data described above | European Union |
| Brevo (Sendinblue SAS) | Delivering the emails we send, and hosting the newsletter list | Email address, name, email contents | France (EU) |
| Cloudflare, Inc. | Bot verification challenge (Turnstile) | IP address, browser signals, challenge result | United States (EU-US DPF) |
| Meta Platforms Ireland Ltd. | Measuring our Facebook and Instagram ads (only if you arrived from one) | Click identifier, IP address, browser type, hashed email, hashed user ID, country | Ireland / United States (EU-US DPF) |
| Rebrickable, Brick Owl, Brickset | Importing and exporting your lists, only when you link that account | Your credential for that service and the list contents you transfer | Various |
Retailers and affiliate networks you click through to are independent of us and process your data under their own policies. We also disclose personal data if the law requires it or to protect the site against abuse.
How long we keep your data
| Data | Retention |
|---|---|
| Account and everything saved in it | Until you delete your account. Deleting it removes your profile, lists, collections, alerts, linked-account credentials and login sessions immediately. |
| Newsletter subscription | Until you unsubscribe |
| Contact form submissions | 6 months |
| Server logs (containing IP addresses) | 30 days |
| Error reports | 90 days |
| Usage statistics and click records | Kept in aggregate, without personal identifiers |
| Advertising attribution reports to Meta | Not stored by us after sending; Meta's retention applies |
Legal bases
The GDPR requires us to say which legal ground we rely on for each use of your data:
- Performance of our contract with you: your account, the lists, collections and alerts you save, and the service emails that go with them.
- Your consent: the newsletter, linked accounts, and permissions you grant to companion apps. You can withdraw consent at any time.
- Our legitimate interests: keeping the site secure and available, server logs and error reports, usage statistics, measuring our advertising, recording which shops are clicked, and answering your enquiries. You can object to any of these (see "Your rights").
- Legal obligations: keeping records where tax or other law requires it, and responding to lawful requests from authorities.
Your rights
Under the General Data Protection Regulation (GDPR) you have the right to:
- access the personal data we hold about you and receive a copy of it;
- correct data that is inaccurate. Your email address, username, country, currency and notification settings can be changed in your account settings;
- delete your data. You can delete your account yourself from your account settings, which removes everything attached to it;
- export your lists and collections in portable formats from the collections pages, and ask us for a copy of any other data;
- object to processing based on our legitimate interests, including advertising attribution and usage statistics;
- withdraw consent at any time where we rely on it, for example by unsubscribing from the newsletter or disconnecting a linked account.
To exercise any of these rights, use the contact form and fill in the email address on your account, so we can check the request comes from you. We respond within one month. If you are unhappy with how we handle your data you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the authority in your own country.
How we protect your data
All traffic to the site is encrypted with TLS. Passwords are stored as bcrypt hashes. Credentials for linked accounts are encrypted at rest, and API tokens are stored only as hashes. Access to production systems is limited to the people who run the site.
Children
Everyone is welcome to browse Brickonomics, and browsing needs no account. If you are under 16, please ask a parent or guardian for permission before creating an account, subscribing to the newsletter or linking another service, because Dutch law requires their consent for that. If a parent or guardian would rather we did not hold a child's account, they can ask us through the contact form and we will delete it.
Changes to this policy
We will update this page when our practices change and revise the date at the top. For significant changes we will notify account holders by email.