Effective date: November 8, 2026

Brick88 is a marketplace for buying and selling LEGO® parts, sets and minifigures, run by ShipRobot LLC, a company in the United States ("Brick88", "we"). This policy explains what personal information we collect, why, who we share it with, how long we keep it, and the choices you have.

LEGO® is a trademark of the LEGO Group, which does not sponsor or endorse Brick88.

Contact us about privacy at support@brick88.com, or write to ShipRobot LLC, 527 78th St, North Bergen, NJ 07047, USA.

1. What we collect

When you create an account

• Your email address. We use it to sign you in with a one-time code. If you sign in with Apple, Apple gives us an email address, which may be a private relay address.
• Your name, if Apple shares it, and your profile: username, display name, profile photo, country, preferred currency and language.

When you buy

• Delivery details: the recipient's name, phone number and address, or for Taiwan convenience-store pickup, just the name and phone number.
• Your address book, if you save addresses: for each one, an optional label (like "Home"), the recipient's name, phone number, address, city, postal code and country, and which one is your default. You can save up to 20, in any country. At checkout, the address you choose is copied onto the order.
• Your orders: the items, prices, shipping method, notes to the seller, order status, tracking numbers and feedback.
• Taiwan e-invoice details, if you ask the seller for an invoice: a mobile barcode, a donation code, or a company's business number (統一編號) and name.
• Your cart and wishlist.

When you sell

• Your store: its name, country, currency, description, terms, shipping methods, listings and listing photos, and for Taiwan stores that issue e-invoices, your business number.
• How buyers pay you (Taiwan stores): the payment methods you add, such as your bank's name and code and your account number, LINE Pay or JKOPay ID, or PayPal link.
• Fee credit (Taiwan, Singapore, Thailand and Mexico stores):
• We keep the Stripe customer reference for the card you add to top up your fee credit, and the card's brand, last four digits and expiry date.
• Stripe holds the full card number; we never see it.
• We also keep your fee credit history: top-ups, the fees taken from it and refunds.
• Payouts (Singapore, Thailand, Japan and Hong Kong stores):
• Stripe verifies your identity and bank account through its own form.
• We receive your Stripe account reference and whether Stripe has enabled payments and payouts.
• We don't receive your ID documents or full bank details.

When you pay by card in the app (stores outside Taiwan)

• Stripe processes your payment. We don't receive or store your full card number.
• We keep the payment's reference and status, and any refund or dispute.

When you use messages

• The messages you send and receive, and any listing you ask about.
• Automatic contact-detail screening.
• Until a buyer and a seller have an order together, our systems automatically look for phone numbers, email addresses, links and chat-app IDs in their messages, and replace them with "[contact details hidden]".
• We record when this happens.
• If an account keeps doing it, we may review that account (see our Marketplace rules).

Safety

• Reports you file, and accounts you block.

From your device

• A push notification token, if you allow notifications, so we can tell you about messages and orders.
• Your sign-in session, kept securely on your device.
• Server logs. When the app talks to our servers, they record technical information such as IP addresses and request times, to keep the service running and secure.

What we don't collect

• No advertising, tracking or analytics. We don't use advertising identifiers, tracking or analytics tools.
• No precise location.
• We don't sell your personal information, or share it for advertising.

2. Why we use it

We process your information because it's needed to provide the service you asked for, to meet legal obligations, and for our legitimate interest in running a safe marketplace. Where the law requires your consent, we ask for it first. Notifications are an example.

3. Who can see what

• Everyone:
• your username, display name and profile photo;
• your store, its listings and its ratings;
• feedback left on completed orders;
• prices from completed sales, shown only as totals and averages (never who bought or sold).
• The other side of your order:
• a seller sees the buyer's delivery details and invoice choice for orders with them;
• a buyer sees the seller's payment details for their order once the seller confirms it (Taiwan stores).
• People you message see your messages and your username or display name.
• Only you see your address book. Sellers never see it: they see only the delivery details copied onto an order you placed with them.

4. Who we share it with

We share personal information only with service providers that help run Brick88, and only what each needs:

• Supabase: database, sign-in and server functions. Our production data is stored in Singapore.
• Cloudflare: storage and delivery of listing photos and catalog images.
• Stripe:
• payments, refunds and payouts for escrow stores;
• identity and bank verification for sellers;
• fee credit top-ups for sellers who pay their fees that way.

Stripe is responsible for the information it collects directly, under its own privacy policy (stripe.com/privacy).

• Apple: Sign in with Apple and push notifications.
• Our email provider, Cloudflare, for sign-in codes.

We may also share information:

• when the law requires it, or to respond to valid legal requests;
• to protect the rights and safety of our users or others, or to investigate fraud;
• with a buyer of our business, under this policy, if Brick88 is sold or merged.

Catalog information comes from Rebrickable. We don't send them any personal information.

5. Where it's stored

ShipRobot LLC is based in the United States. Our main database is in Singapore, and our service providers may process information in other countries, including the United States. When information leaves your country, we rely on our providers' contractual and security commitments to protect it as this policy describes.

6. How long we keep it

• Your account, profile, cart, wishlist, address book, store, listings and messages: until you delete your account. You can edit or delete a saved address at any time in Account → Buying → Addresses; orders already placed keep their own copy.
• Order records: kept after you delete your account, because tax and consumer laws require them. They keep their details (items, prices, the delivery details and the store's name), but we remove the link to your account. We keep them for 7 years after the order, then delete them.
• Fee credit history: while your store exists. The commission stays on the order records, and Stripe keeps its records of top-ups and refunds.
• Server logs: 30 days.
• Reports: as long as needed to handle them and keep the marketplace safe, then up to 2 years.

7. Deleting your account

You can delete your account in the app: Account → Privacy and safety → Delete account.

• What's deleted: your profile, cart, wishlist, saved addresses, messages, store, listings and photos.
• Before you can delete it:
• you need to finish or cancel any orders in progress;
• payouts we owe you need to reach your bank;
• a store paused for unpaid fees needs a successful top-up. Fees you owe are then charged to your card, and unused fee credit is refunded to it.

This protects the people you're trading with.

• Taiwan sellers: any commission not yet billed is charged to your card when you delete your account.
• What's kept: order records, as described above.

8. Your choices and rights

Depending on where you live, you can ask us to:

• access the personal information we hold about you;
• correct it (you can edit most of it in the app);
• delete it (see above);
• object to or limit some uses;
• withdraw consent, such as turning off notifications in your device settings.

To ask, email support@brick88.com. We'll reply within the time your local law requires, and may need to confirm your identity first. You can also complain to your local data protection authority.

9. Security

• Encryption: we encrypt information in transit.
• Access controls: we limit access to it with database rules, so users can only reach their own data.
• Payment cards: Stripe, a PCI DSS Level 1 certified provider, handles card details.

No system is perfectly secure. If a breach affects your information, we'll tell you and the authorities as the law requires.

10. Children

Brick88 is not for children under 13. You must be 18, or the age of majority where you live, to sell or to pay, or have a parent or guardian's permission to buy. If you believe a child has given us personal information, contact us and we'll delete it.

11. Changes

We'll post any changes here and update the effective date. If a change is significant, we'll tell you in the app before it takes effect.