Privacy policy
Last updated: 2 September 2026.
Who is responsible for your data
Stud Stacks is run by Frederick Blake, a sole trader based in the United Kingdom, who is the data controller for the information described here. Registered with the Information Commissioner's Office, registration number ZC233764.
Contact for anything on this page, including requests about your own data: privacy@studstacks.app.
What we collect
Your account email address. Your portfolio entries — the sets and minifigures you record, with purchase prices, dates, conditions and any notes you add. The photographs you take when you scan, and the results those scans produce. Any feedback you send from inside the app, together with which build of the app you were running. Basic analytics about how scans perform, so recognition accuracy can be measured and improved.
Your scan photographs
When you scan, your photograph is sent to Google Cloud (Vertex AI and Gemini), processed in Google's europe-west4 region in the Netherlands, so the minifigures in it can be identified. Google acts as a processor on our behalf and does not use your photographs to train its models.
Cropped images of individual figures, and the answer given for each, are kept so that recognition accuracy can be measured and mistakes investigated. They are stored on equipment we operate, in the United Kingdom or Germany, and are not published or shared. Deleting your account deletes them; you can also ask for them to be deleted on their own at any time.
Where your data is stored
Your account and portfolio are held in a PostgreSQL database on equipment we operate, in the United Kingdom or on a server we rent in Germany (Hetzner, Falkenstein). Scan processing takes place in the European Union as described above. Account email — verification and password reset messages — is sent using Resend. Payments, if you subscribe, are handled by Apple or Google and by RevenueCat; we never see or store your card details.
A few other services handle limited data on our behalf: crash reports go to Sentry (without personal details), product analytics events go to PostHog, and app updates and push notifications are delivered through Expo. While the service runs from our own equipment, traffic to it passes through ngrok, which terminates the encrypted connection on our behalf. Feedback you send from the app is emailed to us so we can act on it.
Your data is never sold. It is never shared with The LEGO Group, with BrickLink, or with any third-party marketer.
Why we are allowed to hold it
We hold your account and portfolio because we need them to provide the service you have asked for — that is contractual necessity. We keep scan images and accuracy measurements under legitimate interests, specifically making recognition work properly; you can object to this and we will delete them.
How long we keep it
Your account and portfolio are kept until you delete your account, after which they are removed. Scan images and their results are kept for up to twelve months for accuracy measurement, or until you ask for them to be deleted, whichever comes first.
Your rights
Under UK GDPR you can ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, object to processing based on legitimate interests, and ask for your data in a portable form. You can delete your account at any time in Settings. Write to privacy@studstacks.app and we will respond within one month.
Complaints
If you are unhappy with how your data has been handled, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, by telephone on 0303 123 1113, or by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Changes to this policy
If this policy changes, the date at the top of the page changes with it. Material changes will be notified in the app.