Privacy Policy

1. Data Controller

The data controller responsible for processing your personal data is Ondřej Pták, operator of BrickMatch, a personal project. If you have any questions about how your data is handled, please contact us at: ondrej@ondrejptak.dev.

2. Personal Data We Collect

When you use BrickMatch, we collect the following personal data:

• Email address — used to identify your account and allow you to log in.
• Password — stored exclusively as a cryptographic hash using the Argon2 algorithm. Your password is never stored in readable (plaintext) form and cannot be recovered by us.
• LEGO collection data — the list of LEGO parts and quantities you add to your collection ("My Parts"). This data is tied to your account and constitutes personal data under the GDPR.
• IP address — recorded as a byproduct of server logs and rate-limiting mechanisms. This data is used solely for security and service protection purposes.
• Authentication cookie (JWT token) — a persistent httpOnly cookie named access_token containing an authentication token is set when you log in. It expires after 24 hours by default, is not accessible to JavaScript, and is used solely to maintain your login session.

3. Legal Basis for Processing (GDPR)

We process your personal data on the following legal grounds under Article 6 of the GDPR:

• Performance of contract (Art. 6(1)(b)) — your account information and collection data are processed because they are necessary to provide the service you registered for.
• Legitimate interest (Art. 6(1)(f)) — server logs and IP addresses are retained briefly for rate-limiting, abuse prevention, and security purposes. Our interest in operating a secure service does not override your rights and freedoms.

4. How We Use Your Data

Your data is used for the following purposes:

• Authentication — verifying your identity when you log in.
• Set matching — calculating which LEGO sets from the catalog you can build from your owned parts.
• Security — protecting the service against abuse through rate limiting and server-side logging.

Your data is not used for: advertising, profiling, analytics beyond basic security needs, or sale/transfer to any third party for commercial purposes. We do not run any advertising campaigns and do not share your personal data with advertisers.

5. Third-Party Service Providers

We use the following third-party infrastructure providers who may process your personal data on our behalf:

• Neon (database hosting) — your account and collection data is stored in a PostgreSQL database hosted by Neon, Inc. The database is located in the AWS Europe (Frankfurt) region within the EU/EEA. The physical storage location of your data is within the EU.
• Vercel (application hosting) — the BrickMatch application is hosted on Vercel’s infrastructure. The primary serverless function region is US East (Washington D.C., iad1), which is located outside the EU/EEA. Network requests, including your IP address, are processed by Vercel’s servers in the United States. This transfer is governed by Standard Contractual Clauses (SCCs) concluded with Vercel, Inc., in accordance with GDPR Art. 46(2)(c). For more information, see Vercel’s Privacy Policy.

LEGO catalog data (set and part information) is sourced from Rebrickable. Rebrickable does not receive or process any of your personal data — it is solely a source of publicly available catalog data imported locally into our database.

6. Data Retention

Your account data (email, password hash, and LEGO collection) is retained for as long as your account exists. When you delete your account through the in-app account deletion feature, your active account record and all associated owned-parts data are deleted immediately from the application database.

Provider-managed database history, snapshots, and recovery copies maintained by Neon may retain this data for a period determined by their applicable retention settings, over which we have no individual-record control. Server logs containing IP addresses are subject to Vercel’s logging retention policies.

7. Your Rights Under GDPR (Art. 15–22)

As a data subject, you have the following rights:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate data.
• Right to erasure— delete your account and all associated data directly through the app’s account deletion feature, or contact us to request deletion.
• Right to data portability — request your data in a structured, machine-readable format.
• Right to object / restrict processing — object to processing based on legitimate interest.

Account deletion can be performed directly within the app. For all other rights requests, please contact us at ondrej@ondrejptak.dev. We will respond without undue delay and, in any event, within one month of receiving your request. Where permitted, this period may be extended by up to two further months; we will notify you within the first month if an extension is necessary.

8. Cookies

BrickMatch uses a single cookie:

This cookie is classified as a strictly necessary/functional cookie under the ePrivacy Directive — it is required for the service to function and is not used for tracking or analytics. It is set as httpOnly, meaning it cannot be accessed by JavaScript, which protects it from cross-site scripting attacks. No marketing, tracking, or advertising cookies are used.

9. Security

We take reasonable technical measures to protect your personal data. Passwords are hashed using the Argon2 algorithm before storage — this means your actual password is never stored and cannot be recovered even in the event of a data breach. Authentication tokens are stored in httpOnly cookies, reducing the risk of theft via client-side scripts.

10. Age Restriction

BrickMatch is not intended for use by children below the age of digital consent. In the Czech Republic, the minimum age for independent consent to online data processing is 15 years under Act No. 110/2019 Coll. (§ 7 GDPR implementation). If you are under this age, you must obtain parental or guardian consent before registering. We do not knowingly collect personal data from children below the age of digital consent.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. For material changes that affect your rights, we will notify you via the email address associated with your account at least 14 days before the changes take effect. Continued use of the service after the effective date constitutes your acceptance of the updated policy.

12. Contact and Supervisory Authority

For any questions, requests, or complaints regarding this Privacy Policy or the processing of your personal data, please contact us at: ondrej@ondrejptak.dev.

You also have the right to lodge a complaint with the supervisory authority in the Czech Republic: Office for Personal Data Protection (ÚOOÚ) — Pplk. Sochora 27, 170 00 Praha 7, Czech Republic.