Privacy
Version 1.0 · last updated 25 October 2026. Plain words: we collect as little as we can, and never sell it.
The short version
- 🧱 Your builds stay on your computer. The builder works without an account, and we can't see what you make.
- ✉️ To join the beta we need an email address. We use it to send your invite. We only send news if you tick the box, and you can stop any time.
- 🧒 Under 13? Ask a grown-up to sign up with their email. We don't keep yours. 13 to 17? Ask a parent or guardian first.
- 🚫 We never sell your information, never show ads, and don't follow you around the internet.
- 🗑️ You're in charge. Ask us to show, fix or delete what we have about you: [email protected].
There's a one-page version for younger builders too: Kids' privacy.
What's on this page
- Who we are
- What we collect, and why
- What we never do
- Storage on your device (and why there's no cookie banner)
- Children and teens
- Companies that help us
- Sending information to other countries
- How long we keep it
- Keeping it safe
- Your rights
- Complaints
- Changes to this page
1. Who we are
Clickety Bricks is an independent app made in South Africa by Clickety Bricks (Pty) Ltd (registration with CIPC in progress). In privacy law that makes us the "responsible party" (South Africa) and the "controller" (EU and UK): the one who decides what happens to your information.
Our Information Officer (the person in charge of privacy) is the company's director. Contact them at [email protected].
- Email: [email protected]
- Post: address available on request by email, South Africa
- Website: clicketybricks.com
We don't have an office or a representative in the EU or the UK yet. Wherever you live, you can contact us directly at the email address above.
2. What we collect, and why
Here's everything, grouped by what it's for. "Lawful basis" is the legal reason that allows us to use it. Items marked soon start when that feature goes live; we'll update this page first.
Joining the beta waitlist
| What | Why | Lawful basis |
|---|---|---|
| Your email address | To keep your place on the list and send your beta invite. | Taking the steps you asked for (GDPR Art. 6(1)(b); POPIA s11(1)(b)). For 13 to 17 year olds, also your parent's or guardian's consent (POPIA s35(1)(a)). |
| Your age group (13 to 17, or 18 and over) and, for 13 to 17, that a parent or guardian agreed | To protect younger builders and treat them the way the law asks. | Legal obligation and legitimate interests (keeping children safe) (GDPR Art. 6(1)(c) and (f); POPIA s11(1)(c) and (f)). |
| Your invite code, and the code of the friend who invited you, if any | To show your place on the list and count how many friends joined with your link. Your friend never sees your email, only a number. | Legitimate interests (running a fair waitlist) (GDPR Art. 6(1)(f); POPIA s11(1)(f)). |
| Where you came from (for example "youtube", from the link you clicked or the website that sent you) | To learn which videos and posts bring people, counted as totals. | Legitimate interests (knowing what works, without tracking you) (GDPR Art. 6(1)(f); POPIA s11(1)(f)). |
| The date and time you joined | To order the list fairly. | As for your email address. |
Giving your email is up to you. Without it we can't put you on the list, but you can still use the builder when it's public, with no account. We don't ask for your name, birthday, address, phone number or payment details.
Update emails (only if you tick the box)
| What | Why | Lawful basis |
|---|---|---|
| Your email address, and a record of your choice: whether you ticked the box, the exact words you agreed to (their version number), the date and time, and the page you were on | To send occasional news about Clickety Bricks and the beta, and to be able to show that you agreed. | Your consent (GDPR Art. 6(1)(a); POPIA s11(1)(a) and s69). For 13 to 17 year olds, your parent's or guardian's consent too. |
The box is never ticked for you. Every update email has a one-click unsubscribe link, and we stop straight away (always within 10 working days). Unsubscribing from news doesn't take you off the waitlist. Your invite is a service email, so you'll still get it unless you ask us to remove you completely.
The bot check
| What | Why | Lawful basis |
|---|---|---|
| Technical signals from your browser and your IP address, checked by Cloudflare Turnstile when you send a form | To stop robots filling the list with fake sign-ups. We don't keep the result; Cloudflare uses the signals only for the check. | Legitimate interests (keeping the service safe) (GDPR Art. 6(1)(f); POPIA s11(1)(f)). |
Beta sign-in soon
| What | Why | Lawful basis |
|---|---|---|
| Your email address, an account ID, and when and from which IP address you signed in | To send you a one-time sign-in link (no password), let you into the beta and keep accounts secure. | Providing the service you signed up for (GDPR Art. 6(1)(b); POPIA s11(1)(b)). For under-18s, see Children and teens. |
Bug reports soon
| What | Why | Lawful basis |
|---|---|---|
| What you write, a screenshot of the app (you'll see it first and can leave it out), the model you were building, your browser and computer type, and your email only if you choose to add it | To find and fix the problem you reported. | Legitimate interests (fixing the app) (GDPR Art. 6(1)(f); POPIA s11(1)(f)). |
Before you send a screenshot, check it doesn't show your name or anything private. Under-13s can send bug reports without an email address.
Crash reports soon
| What | Why | Lawful basis |
|---|---|---|
| When the app crashes: the error message, what the app was doing, your browser and computer type, and a random ID for your browser. No recording of your screen, and your IP address isn't stored. | To spot and fix crashes, even ones nobody reports. | Legitimate interests (keeping the app working) (GDPR Art. 6(1)(f); POPIA s11(1)(f)). |
Visitor counts soon
| What | Why | Lawful basis |
|---|---|---|
| Page views counted by Cloudflare Web Analytics, which uses no cookies and doesn't identify you or follow you to other sites | To see how many people visit and which pages work. | Legitimate interests (improving the site) (GDPR Art. 6(1)(f); POPIA s11(1)(f)). |
When you email us
| What | Why | Lawful basis |
|---|---|---|
| Your email address and whatever you write | To answer you, and to keep a record of privacy requests. | Legitimate interests (answering you); legal obligation for privacy requests (GDPR Art. 6(1)(c) and (f); POPIA s11(1)(c) and (f)). |
When we rely on legitimate interests, we've checked that our reason is fair and doesn't override your rights, especially if you're young. You can object to any of these uses (see Your rights).
3. What we never do
- We never sell, rent or trade your information.
- We don't show ads, and we don't use your information for advertising or to build a profile of you.
- We don't use tracking pixels or follow you across other websites.
- We don't track your location.
- We don't make automatic decisions about you that have legal or similarly serious effects.
- We don't show your email or any other details to other users.
4. Storage on your device (and why there's no cookie banner)
Some things are kept in your own browser, not on our computers:
- Your invite code and the invite code you arrived with, so the page can show your place when you come back.
- Your answer to the age question for this visit, so the form works properly.
- In the builder: your builds and settings, so your work is there next time. Your builds don't leave your computer unless you save a file, or send a bug report and choose to include the model.
- The bot check may store a small security cookie from Cloudflare.
All of this is strictly needed for things you asked for, or for security, so the law doesn't require a cookie banner. Our visitor counts use no cookies. We don't use advertising or tracking cookies. You can clear this storage any time in your browser settings; you'll just lose your saved place and any builds you haven't saved to a file.
5. Children and teens
LEGO® fans come in all ages, and we expect children to visit. So we built Clickety Bricks to be private by default for everyone:
- Under 13: we don't collect personal information from you. If you tell us you're under 13, the form asks a grown-up to sign up for you with their own email, and we don't store yours. You don't need an account to use the builder.
- 13 to 17: you can join only if a parent or guardian agrees. South African law (POPIA) treats everyone under 18 as a child and asks for a parent's or guardian's consent. In some countries the age is different; we use the stricter rule.
- Parents and guardians: you can ask to see or delete your child's information at any time by emailing [email protected]. We'll check that you're the parent or guardian first. If you think your child under 13 gave us their email, tell us and we'll delete it.
For everyone, the settings start at the most private option: no public profile, no sharing with other users, no location, no ads and no profiling. We don't use tricks to get you to share more information.
6. Companies that help us
A few companies store or process information for us. They may only use it to do that job, under written data processing agreements that require them to keep it confidential and secure.
| Company | What they do for us | Where |
|---|---|---|
| Supabase | Stores the waitlist and, later, beta accounts and bug reports. | Database in Frankfurt, Germany (EU). Supabase is a US company and its support staff may access data from other countries. |
| Cloudflare | Runs the website and our email address, does the bot check (Turnstile) and, later, counts visitors. | A worldwide network, including the US and the country nearest you. |
| Resend soon | Sends our emails (invites, sign-in links, updates). | United States, sending from its EU region where available. |
| Sentry soon | Collects crash reports. | EU data region (Germany). Sentry is a US company. |
| Our email inbox provider | Holds the inbox that emails to [email protected] are forwarded to. | Ask us and we'll tell you |
We'd only share information with anyone else if the law requires it (for example, a court order), to protect someone's safety, or if Clickety Bricks is ever passed to a new owner, who would have to keep these promises. We'd tell you first where we can.
7. Sending information to other countries
We're in South Africa, our database is in Germany, and some of the companies above are in the United States or work worldwide. So your information may be sent to, and read from, countries other than your own. We protect it like this:
- Under South Africa's POPIA (section 72): we only send it to companies bound by a written agreement, or by laws such as the GDPR, that give protection substantially similar to POPIA.
- Under the EU and UK GDPR: for companies in the US that are certified under the EU-US Data Privacy Framework (and its UK extension), we rely on that. Otherwise we rely on the European Commission's standard contractual clauses (and the UK addendum) built into each company's data processing agreement.
- When we in South Africa look at information about people in the EU or UK, the GDPR applies to us directly, and we follow it.
Ask us at [email protected] if you'd like more detail about these safeguards.
8. How long we keep it
| Information | How long |
|---|---|
| Waitlist entry (email, age group, invite codes, where you came from, join date) | Until 12 months after Clickety Bricks launches publicly, or until you ask us to delete it, whichever comes first. |
| Record of your update-email choice | While you're on the list, then 2 years after you unsubscribe or leave, so we can show we had permission. After you unsubscribe we keep only your email on a "do not email" list so we never write to you again by mistake. |
| Under-13 email addresses | Never stored. |
| Bot-check signals | Not stored by us. Cloudflare keeps them only briefly for the check. |
| Beta account | While your account is open. Deleted within 30 days if you close it, and closed after 24 months without a sign-in (we'll email you first). |
| Bug reports (including screenshots and models) | 12 months, or sooner once the bug is fixed and nothing more is needed. |
| Crash reports | 90 days. |
| Email delivery logs at our email sender | Up to 30 days. |
| Emails you send us | 2 years after our last reply. Records of privacy requests: 3 years. |
| Visitor counts | Totals only, with nothing that identifies you. |
9. Keeping it safe
We use reasonable technical and organisational measures to protect your information, including:
- Encrypted connections (HTTPS) everywhere.
- The waitlist can't be read from the internet. The database only lets the website add an entry or look up your own place.
- Secret keys are kept out of our code and out of web pages.
- Two-step sign-in on every account we use to run Clickety Bricks.
- Collecting as little as possible, and deleting it on time.
No system is perfect. If something goes wrong and your information may have been seen by someone who shouldn't have it, we'll tell South Africa's Information Regulator and any other regulator the law requires, and we'll tell you as soon as we reasonably can, with advice on what to do.
10. Your rights
Wherever you live, you can ask us to:
- See what we hold about you, and get a copy;
- Fix anything that's wrong;
- Delete it;
- Stop or limit how we use it, or object to a use based on legitimate interests;
- Take it with you in a common file format;
- Withdraw your consent at any time (for example, by unsubscribing). This doesn't affect anything we did before.
Email [email protected] from the address you signed up with. We'll reply within one month. If a request is very complicated we may need up to two more months, and we'll tell you why within the first month. It's free. We may ask you to confirm it's really you, so nobody else can get your information. In South Africa you can also use the official forms described in our PAIA manual, but you don't have to.
11. Complaints
If you're unhappy, please tell us first at [email protected] and we'll try to put it right. You can also complain to a privacy regulator at any time:
- South Africa: the Information Regulator, inforegulator.org.za, email [email protected].
- United Kingdom: the Information Commissioner's Office (ICO), ico.org.uk/make-a-complaint, phone 0303 123 1113.
- European Union: the data protection authority in the country where you live or work. The list is at edpb.europa.eu.
- Anywhere else: your local privacy or consumer regulator.
12. Changes to this page
We'll update this page before we start collecting anything new (the items marked soon), and change the version number and date at the top. If a change matters to you, we'll email you before it takes effect. We'll never use information you already gave us in a new way that you haven't agreed to.
About LEGO®
LEGO® is a trademark of the LEGO Group of companies which does not sponsor, authorize or endorse this site. Clickety Bricks is an independent, unofficial fan project.