Privacy policy
Last updated: 18 October 2026.
Who is responsible for your data
Stud Stacks is run by Frederick Blake, a sole trader based in the United Kingdom, who is the data controller for the information described here. Registered with the Information Commissioner's Office, registration number ZC233764.
Contact for anything on this page, including requests about your own data: privacy@studstacks.app.
What we collect
Your account email address. Your portfolio entries — the sets and minifigures you record, with purchase prices, dates, conditions and any notes you add. The photographs you take when you scan, and the results those scans produce. Any feedback you send from inside the app, together with which build of the app you were running. Basic analytics about how scans perform, so recognition accuracy can be measured and improved.
If you join the beta waitlist on this website: your email address, which phone you use, and anything you choose to tell us about what you collect or would like the app to do, along with where you came to the page from (for example, Instagram). We use it only to invite you to the beta and to tell you about the launch. Every email has a one-click unsubscribe link.
Your scan photographs
When you scan, your photograph is sent to Google Cloud (Vertex AI and Gemini), processed in Google's europe-west4 region in the Netherlands, so the minifigures in it can be identified. Google acts as a processor on our behalf and does not use your photographs to train its models.
Cropped images of individual figures, and the answer given for each, are kept so that recognition accuracy can be measured and mistakes investigated. They are stored on equipment we operate, in the United Kingdom or Germany, and are not published or shared. Deleting your account deletes them; you can also ask for them to be deleted on their own at any time.
Where your data is stored
Your account and portfolio are held in a PostgreSQL database on equipment we operate, in the United Kingdom or on a server we rent in Germany (Hetzner, Nuremberg). Backups of that database are stored with Cloudflare R2, in a bucket restricted to the European Union. Scan processing takes place in the European Union as described above. Account email, meaning verification and password reset messages, is sent using Resend. Payments, if you subscribe, are handled by Apple or Google and by RevenueCat; we never see or store your card details.
A few other services handle limited data on our behalf: crash reports go to Sentry (without personal details), product analytics events go to PostHog, and app updates and push notifications are delivered through Expo. This website is hosted by Cloudflare Pages. The app connects directly to our own server, which holds its own certificate and terminates the encrypted connection itself; no third party sits in front of it. Feedback you send from the app is emailed to us so we can act on it. Waitlist sign-ups are stored in the same database, and waitlist emails are sent using Resend.
Your data is never sold. It is never shared with The LEGO Group, with BrickLink, or with any third-party marketer.
Why we are allowed to hold it
We hold your account and portfolio because we need them to provide the service you have asked for — that is contractual necessity. We keep scan images and accuracy measurements under legitimate interests, specifically making recognition work properly; you can object to this and we will delete them. We hold waitlist details because you asked us to contact you about the beta, which is consent; unsubscribing withdraws it.
How long we keep it
Your account and portfolio are kept until you delete your account, after which they are removed. Scan images and their results are kept for up to twelve months for accuracy measurement, or until you ask for them to be deleted, whichever comes first. Waitlist details are kept until the app launches publicly or you unsubscribe, after which the email address is kept only as a flag so that it is never emailed again.
Your rights
Under UK GDPR you can ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, object to processing based on legitimate interests, and ask for your data in a portable form. You can delete your account at any time in Settings. Write to privacy@studstacks.app and we will respond within one month.
Complaints
If you are unhappy with how your data has been handled, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, by telephone on 0303 123 1113, or by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Changes to this policy
If this policy changes, the date at the top of the page changes with it. Material changes will be notified in the app.