Legal
Privacy Policy
In effect from
This page explains, in plain language, exactly what we hold, why, who else sees it, and what you can ask us to do about it.
About this policy
Bricks2Sets is a small, independent product. We are not an advertising company and we do not have a data business. We collect what we need to run a shared brick-sorting workspace for your family, and nothing else. There are no trackers on this site, no analytics, and no advertising pixels.
Who is responsible for your data
The data controller — the company legally responsible for the personal data described here — is:
- Nordic Mythos Oy
- Business ID (Y-tunnus): 3640959-6
- Vienankatu 1 i 159
- 00920 Helsinki
- Finland
Email:
We have not appointed a Data Protection Officer, because the law does not require one for a company of our size and the kind of data we handle. Write to the address above and it reaches a person.
What we collect, and why
When you create an account
| What | Why we need it |
|---|---|
| Your name | So the rest of your group knows who found which brick |
| Your email address | To sign you in, to send password resets, and to reach you about your subscription |
| Your password, stored as a one-way hash | So we can check it without ever knowing what it is |
| If you sign in with Google or GitHub: the link to that account | So the button works |
| If you use a passkey: the public part of that credential | So the passkey works |
Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)). Without a name and an email address we cannot give you an account.
While you are signed in
We store a session record containing a session token, your IP address, your browser's user-agent string, and an expiry time.
Why: the token keeps you signed in. The IP address and user-agent let us show you your active sessions and spot someone signing in who should not be.
Legal basis: contract for the session itself; our legitimate interest in keeping accounts secure (Art. 6(1)(f)) for keeping the IP address and user-agent alongside it.
When you use the app
| What | Why we need it |
|---|---|
| Your group, and your role in it | To show you the right workspace |
| The sets you are tracking and how many of each part you have found | It is the product |
| A record of who counted which part, and when | This is the shared activity feed |
About the activity feed — please read this one. Bricks2Sets keeps a running log of every count made in your group: which account, which part, how many, and at what time. Everyone in the group can see it. That is the whole point of a shared workspace, but it does mean the app records a small picture of when each account in your household was sorting. If that is not something you want, do not add that person to the group.
Note that the feed records the account, not the person holding the device. If several people share one signed-in account, everything they do appears under that account. See Children and family groups, below.
Legal basis: performance of our contract with you (Art. 6(1)(b)).
When you invite someone
If you invite someone by email, we store that email address so we can deliver the invitation and so you can see who has been invited. If you use a share link instead, we store the link's code, who created it, when it expires, and how many times it has been used.
Legal basis: our legitimate interest, and yours, in letting you build your group (Art. 6(1)(f)). If you were invited and never joined, you can ask us to delete your address at any time — see Your rights, below.
When you subscribe
Your subscription is sold and processed by Polar as merchant of record (see Who else sees your data, below) — Polar is the seller for the payment, issues your receipt and handles VAT. We never see or store your card details. What we keep on our side is a billing record for your group: the plan, the subscription status, the dates your access runs to, and the customer identifier Polar gives us so the two systems stay in sync.
We also record that your account has started its free trial, so that one person cannot start an unlimited series of them. We keep that record even if you later delete your account — otherwise deleting and re-registering would simply start the trial again. It is stored as a keyed one-way code derived from your email address, never the address itself, and it is all we keep: no name, no account, nothing that links it back to you without that key.
Legal basis: performance of our contract with you (Art. 6(1)(b)), for the billing record and for giving you access; and our legitimate interest in preventing abuse of the free trial (Art. 6(1)(f)).
About accounting records. Because Polar is the seller, the invoice for your subscription is Polar's record rather than ours. What we file for accounting purposes is Polar's payment statements to us, which are about totals rather than about you individually. Where a record we are required to keep under the Finnish Accounting Act does contain personal data, we keep it for as long as that law requires — six years for vouchers, ten years for the accounting books — and we use it for nothing else. That retention rests on our legal obligation (Art. 6(1)(c)).
If we have to step in
If an account has to be suspended, we record when and why. We also keep an internal log of administrative actions our operators take — what was done, to which account, and when — so that those actions are accountable.
Legal basis: our legitimate interest in protecting the service and in being able to show what we did and why (Art. 6(1)(f), and GDPR Art. 5(2)).
What we do not collect
- No analytics of any kind. We do not know how many people visited this page.
- No advertising or marketing trackers.
- No location data.
- No profiling, and no automated decision-making that has any legal or similarly significant effect on you.
- No special categories of data — nothing about health, beliefs, ethnicity or anything similar.
- No card numbers.
Cookies and things stored on your device
We do not show a cookie banner, because we do not use any cookie or storage that would need your consent. Here is the complete list of what Bricks2Sets puts on your device.
| Name | Type | How long | What it does |
|---|---|---|---|
| bricks2sets…session_token | Cookie | Until the session expires or you sign out | Keeps you signed in. HttpOnly, Secure, SameSite=Lax |
| bricks2sets.activeGroup | Local storage | Until you sign out or clear it | Remembers which group you were last looking at |
| bricks2sets.signedIn | Local storage | Until you sign out | A hint that takes you straight to the app instead of the marketing page |
| bricks2sets.theme | Local storage | Until you change it | Your light/dark choice |
| bricks2sets.prefs.celebrate | Local storage | Until you change it | Whether you want confetti when a set is completed |
| bricks2sets.trialBannerDismissed.… | Session storage | Until you close the tab | Remembers that you dismissed the trial banner |
All of these are set by us, on our own domain. None of them is used to track you, build a profile, or follow you to other websites. You can clear them at any time in your browser settings — the app will still work, it will just forget your preferences.
Who else sees your data
We keep the number of companies involved deliberately small.
| Who | Where | What they get | Why |
|---|---|---|---|
| UpCloud | Helsinki, Finland | Everything — they host the servers and the database | This is where Bricks2Sets runs |
| Polar (Polar Software Inc.) | United States | Your email address and your group's identifier | They sell and process the subscription as merchant of record |
| Resend | United States | Your email address and the reset link, when you ask for a password reset | Sending that one email |
| Rebrickable (Rebrickable Pty Ltd) | Australia | Nothing that identifies you — but see Data leaving the EU about the pictures | LEGO® set and part data, which we fetch from our own server, not your browser |
| bunny.net (BunnyWay d.o.o.) | Ljubljana, Slovenia | Your device's IP address and browser type, each time your browser loads a picture | It is the image service that delivers Rebrickable's set and part pictures |
We do not sell your data. We do not share it with anyone else. If a court or a competent authority lawfully requires us to hand something over, we will — and we will tell you unless we are legally forbidden from doing so.
Data leaving the EU
Bricks2Sets itself runs entirely in Finland. Your account, your groups, your sets and your counting history live on servers in Helsinki and stay there.
The United States. Polar and Resend process data in the US. For those transfers we rely on the European Commission's Standard Contractual Clauses — the standard legal mechanism for sending personal data outside the EU — which both companies have entered into. Resend is additionally certified under the EU-US Data Privacy Framework. Email bricks2sets@nordicmythos.com if you would like a copy of the clauses.
The pictures, and where they actually come from. Set and part pictures are loaded by your browser from Rebrickable's image address, cdn.rebrickable.com, rather than from us. We checked where that resolves to: it is a content delivery network operated by bunny.net (BunnyWay d.o.o., Ljubljana, Slovenia), which serves European visitors from servers inside the EU — our own tests from Finland were answered in Helsinki. So the request for a picture normally does not leave Europe at all.
What that image service sees is your device's IP address and which browser you are using. Nothing about your account, your group or your counting goes with it. It sets no cookies — we checked the responses it sends. And because we send no referrer, it cannot see which page or which set you were looking at.
The part we cannot promise. That image service is Rebrickable's, not ours, and Rebrickable Pty Ltd is an Australian company. We cannot rule out that it can read connection logs, including IP addresses, from Australia. There is no European Commission adequacy decision for Australia and no Standard Contractual Clauses in place covering that. We would rather tell you that plainly than point at a legal mechanism that does not really fit.
Why it works this way. The pictures are Rebrickable's, and we show them under their terms. Linking to them is not the same as copying them onto our own servers, and we would rather not re-publish someone else's images to tidy up a paragraph in our own policy. If you would rather your browser did not fetch them, blocking cdn.rebrickable.com leaves the rest of Bricks2Sets working normally.
How long we keep things
| What | How long |
|---|---|
| Your account | For as long as you have one. Deleting it takes effect immediately — there is no waiting period and we keep nothing back, apart from backups that age out (below) |
| Sessions (including IP address and user-agent) | Up to 7 days after you last used the app — the session renews as you go, and expired ones are deleted in routine cleanup |
| Password reset links | Until they expire, which is one hour after you ask for one |
| Your group, sets and progress | For as long as the group exists |
| The activity feed | For as long as the group exists. Your own entries are deleted outright when you delete your account — we do not leave them behind under "a former member" |
| Invitations that were never accepted | The invitation itself stops working after 48 hours, and we delete the expired record in routine cleanup |
| Subscription and billing records | Six to ten years — Finnish accounting law requires vouchers to be kept for six years and the accounting books for ten. Because Polar sells the subscription, most of this sits with them rather than with us |
| Suspension records | For as long as the account exists |
| Our internal administrative log | For as long as the account exists. When you delete your account we strip your name and email out of those entries, keeping only the record that an action happened |
| Backups | 14 days — deleted data disappears from backups as those backups age out |
Your rights
Under the GDPR you can ask us to:
- See what we hold about you (Art. 15)
- Correct anything that is wrong (Art. 16)
- Delete your account and your data (Art. 17)
- Restrict what we do with it while a question is being sorted out (Art. 18)
- Export it in a machine-readable format (Art. 20)
- Object to anything we do on the basis of legitimate interest (Art. 21)
Other requests. For anything else — a copy of your data, a correction, an objection — email bricks2sets@nordicmythos.com. We will reply within one month. If a request is unusually complex we may take up to two further months, and we will tell you within the first month if that happens.
If you are not happy with how we handled it, you can complain to the Finnish supervisory authority:
Deleting your account
You can delete your account yourself, from Settings. It is the fastest route and it does not need us to be at our desks. You will be asked to confirm who you are first, because deletion cannot be undone.
If you would rather ask a person — or if the button will not let you through for some reason — email bricks2sets@nordicmythos.com and we will do it for you. Either way it is free, and we will finish within one month.
What deleting actually does:
- Your account, your sign-in details, your passkeys and your active sessions are removed.
- Your entries in the activity feed are deleted — not just hidden, and not relabelled "a former member". In a small family group that relabelling would fool nobody, so we remove the entries.
- If you are the last person in a group, the group and everything in it goes with you.
- If other people are still in the group, the group survives. Their sets and their counts stay, because that data is theirs too. If you were the owner, ownership passes to another member and we tell them so.
- Any active subscription is cancelled, so nothing keeps being charged after you have gone.
What we keep, and why. A small amount of information survives deletion, because the law requires it or because deleting it would let us be taken advantage of:
- Accounting records of what was paid. Finnish accounting law requires this — six years for vouchers, ten for the accounting books. Your subscription is sold by Polar, so most of this sits with them rather than with us, and what we keep is kept to a minimum.
- A record that a deletion happened — the date and an internal identifier, not your email address. We need to be able to show that we honoured your request.
- The fact that a free trial has been used. It is a keyed one-way code made from your email address, never the address itself — enough for us to recognise that this address has already had its trial, and nothing else. Without it, deleting an account and signing up again would start a fresh trial every time.
- Backups already taken will still contain your data until they age out (14 days). We never restore a backup to bring a deleted account back.
Your record at Polar. We do not leave this for you to chase. When you delete your account we instruct Polar to delete your customer record — which also ends any subscription attached to it — and to anonymise the personal details on your past orders, hashing your email address and name and clearing your billing address.
Polar keeps the orders themselves, because it was the seller and has its own accounting and tax obligations for the sales it has made. What remains is a record of what was bought, with the personal details scrambled — not an active customer profile. If you want to ask Polar directly about their copy, contact privacy@polar.sh; their privacy policy is at polar.sh/legal/privacy.
Children and family groups
You must be 18 or over to create a Bricks2Sets account and to buy a subscription.
Bricks2Sets is built for families, and we absolutely expect children to use it — that is the point. But the account belongs to an adult, and children take part through a group that an adult owns, on that adult's signed-in device. We do not offer accounts to under-18s, so we do not ask anyone for their date of birth: collecting everyone's age to enforce the rule would mean holding more personal data than the rule protects.
What that means in practice, honestly. Because everyone in a household shares one signed-in account, the activity feed records what an account did — not who was holding the phone. If your child counts fifty bricks on your device, the feed shows you counted fifty bricks. We have no way of knowing otherwise, and we do not try to find out. So please read the feed as a record of account activity rather than as proof of who did what; it is a tool for keeping counts in sync, not a witness.
The upside of working this way is that we hold no personal data about your children at all — no name, no age, no separate identifier, nothing that would let us or anyone else pick a child out of the record. The trade-off is the one above: the feed is attributed to the account holder.
If you own a group, please tell the people in it — children included — what the app records before you add them, and in particular that everyone in the group can see everyone else's counting history. You know your household; we do not, and this is the one part of getting it right that only you can do.
If you believe someone under 18 has created an account of their own, email bricks2sets@nordicmythos.com and we will remove it.
Keeping your data safe
- Everything travels over HTTPS.
- Passwords are hashed with Argon2. We cannot read them, and neither can anyone who steals the database.
- Session cookies are HttpOnly and Secure, so scripts on the page cannot read them.
- The database is not reachable from the internet.
- Administrative actions are logged, and administrative access is role-restricted.
No system is perfect. If there is ever a breach that puts your rights at risk, we will tell the Finnish Data Protection Ombudsman within 72 hours and, where the law requires it, we will tell you directly.
Changes to this policy
If we change anything material, we will update the date at the top and tell account holders by email before it takes effect. Minor corrections — a typo, a clearer sentence — we will just make.
Getting in touch
Nordic Mythos Oy, Vienankatu 1 i 159, 00920 Helsinki, Finland
We are a small team and we read everything.
Trademarks
LEGO® is a trademark of the LEGO Group of companies, which does not sponsor, authorize or endorse this site. Set and part data and images from Rebrickable.