Privacy Policy

Last updated: 11 October 2026

This Privacy Policy explains how Genesis Labs ("we", "us") collects, uses and shares information when you use the BrickSurge mobile application (the "App").

Who we are

Genesis Labs
Honnörsgatan 22, 17069 Solna, Sweden
Contact: bricksurge.app@gmail.com
Website: https://bricksurge.web.app

Information we collect

Account information. Your email address and a password, handled by Firebase Authentication. We never see your password.
Photos and content you upload. Photos of LEGO pieces you take or select, and the piece data derived from them (detected bounding boxes, identified part, colour and confidence, and any corrections you make).
Inventory and store data. Your inventory, bins, imported BrickLink lots, pricing settings and, if you connect a store, the BrickLink configuration. BrickLink API credentials are stored server side in Google Secret Manager and are never readable by the App.
Usage analytics. Product interactions (for example imports started, bins confirmed, corrections made) collected through Firebase Analytics.
Subscription and purchase data. If you subscribe to a paid plan, the store (Apple or Google) and our subscription provider, RevenueCat, process a purchase identifier, the product, and your subscription status and expiry, so we can unlock and manage your plan. We never receive your full payment card details.
Diagnostics. Crash reports and performance data through Firebase Crashlytics.
Support requests and feedback. If you use "Report a problem", we receive your message, the optional screenshot you attach, the contact email you choose to provide, and technical details about your app and device (version, platform, language, the screen you reported from, plan and whether BrickLink is connected). Reports are stored in Google Cloud and filed as a GitHub issue so we can track and respond to them.
Device and log data. IP address, device type and timestamps in server logs, needed to operate and secure the service.

How we use information

To provide the App: detect pieces, identify them, build your inventory, and sync with your BrickLink store when you connect it.
To improve accuracy and the product: understand how features are used and fix crashes.
To secure the service and prevent abuse.
To respond to support requests.

Third-party services

We share data with the following processors to run the App:

Google Firebase (Authentication, Firestore, Cloud Storage, Cloud Run, Analytics, Crashlytics): hosting, storage and analytics. Data is stored in Google Cloud.
Google Sign-In / Sign in with Apple (optional sign-in methods): if you choose one, the provider shares your name and email address with us so we can create and secure your account. We never receive your password. If you delete your account, we revoke the Apple token.
Brickognize (api.brickognize.com): piece identification. We send the cropped images of individual pieces to Brickognize. Images sent to Brickognize may be stored and used to improve their recognition model. Brickognize is operated by a third party under its own terms (https://brickognize.com/terms-of-service/). There is currently no option to opt out of image storage; we plan to support an opt out when Brickognize offers it.
BrickLink (via the BrickLink Store API): only if you connect a store, to reconcile your inventory and prices. Your BrickLink credentials are stored in Google Secret Manager and used only to call BrickLink on your behalf.
Rebrickable: catalog lookups (which sets contain a piece). Requests are made server side with our own API key; we do not send your personal data.
RevenueCat (revenuecat.com): subscription management. If you subscribe, RevenueCat receives your app user ID, purchase identifiers and subscription status to validate and manage your entitlement. Operated under its own terms (https://www.revenuecat.com/terms/) and privacy policy.
GitHub (github.com): a "Report a problem" submission is filed as an issue on our private repository — the report text, the email you provide if you allow contact, the attached diagnostics and a reference to any screenshot — so we can track and respond to it. Operated by GitHub under its own terms.

Legal bases (EEA and UK)

Where the GDPR applies, we process your data on these bases: performance of a contract (providing the App and your subscription), legitimate interests (security, product improvement and analytics), and consent where required (for example, marketing, if introduced).

Data retention

Account and inventory data is kept while your account exists.
Raw uploaded photos are automatically deleted after 30 days and processed crops and results after 37 days, via Google Cloud Storage lifecycle rules.
Support feedback is kept while the report is open; an attached screenshot is automatically deleted after 180 days.
When you delete your account, we delete your account, inventory, bins, photos and stored BrickLink credentials. This does not remove items already synced to your BrickLink store — those lots stay in your store and can only be removed directly in BrickLink.

Your rights

Depending on where you live, you may have the right to access, correct, delete or port your data, to object to or restrict certain processing, and to withdraw consent. You can delete your account and all associated data from within the App (Settings → Account → Delete account). For other requests, contact bricksurge.app@gmail.com.

Children

The App is not directed to children under 16 and we do not knowingly collect their data.

International transfers

Data may be processed in countries outside your own, including the United States, by Google, RevenueCat and Brickognize. We rely on appropriate safeguards where required.

Trademarks

LEGO is a trademark of the LEGO Group, which does not sponsor, authorise or endorse this App. BrickLink, Rebrickable and Brickognize are trademarks of their respective owners. The App is not affiliated with, endorsed by or certified by any of them.

Changes

We may update this policy. Material changes will be announced in the App or by email.

Contact

bricksurge.app@gmail.com