BrickiumBrickium Privacy Policy
Effective date: 12 November 2026
Brickium (the "App") is operated by Zhang Liu, an individual developer ("we", "us"). Contact for anything in this policy: zhang3917@gmail.com.
1. Summary
- You can open the App, look at the example and browse the creation packs without an account. An account is needed to keep an inventory, create models and buy creation packs.
- Photographs of your bricks that you take in the App, or choose from your photo library for scanning, pass through our server to Google's Gemini API, which recognises the parts. Our server does not store the photograph: it exists in its memory only while that one request is answered. See section 4 for provider retention. Our server keeps a scan record of the parts each scan suggested and, from App 1.6, the parts you confirmed, without the photo; see section 2.
- If you ask for an AI background for your selected cover image (your photo or the set’s catalogue picture), the image and the set’s public catalogue name pass through our server to Google's Gemini API. The original and up to three background options are kept only on your device, not on our server. Each new background is generated from the original image.
- If you build from a photo, the App first checks the photo on your device and cuts out its subject; when it cannot, you frame the part to build yourself, or choose the whole photo. Nothing is sent when the photo, or the part you framed, is too dark, or when what would be sent shows a person; with a cut-out, the background, and anyone in it, is left out. The cut-out subject, or the part or whole photo you chose, passes through our server to Google's Gemini API, which checks what it shows and describes it in one sentence. In App versions before 1.6, and in App 1.6 when our service does not offer photo design jobs (next item), that sentence and a list of the parts you have available are sent to OpenAI's API, which proposes the design; when you ask for another design of the same photo, the previous design’s geometry goes with them, under the same agreement. On that path, two rendered views of each proposed model are sent to Google's Gemini API, which, without seeing your photo, says whether people would recognise the model and as what; a model is shown to you only when that matches what your photo shows. Our server does not store the photo or the cut-out.
- From App 1.6, when our service offers it, a design from a photo is made as a photo design job: a background job on our server that takes several minutes. The photo is checked on your device and sent to Google as described in the item above. Google's Gemini API says what it shows and writes a sentence with a few names, features and colours. That description, with the sentence as you leave it, and a list of the parts you have available are sent to OpenAI's API. OpenAI designs the model, and looks at pictures our server draws of its own designs to improve them. OpenAI never receives your photo, and pictures of the designs are not sent to Google for checking. Our server does not store the photo or the cut-out. Neither provider receives your account identifier. Requests to OpenAI are made with storage off; see section 4.
- When you scan a set's box, its barcode or set number is read on your device. Only the digits are sent to our server: set numbers are checked against our catalogue; a new barcode is looked up in a product database (UPCitemdb). The number-scanning photo stays on your device.
- The text of a design request and a list of the parts you have available are sent to OpenAI's API, which proposes the design. When you ask for another version of a saved design, and agree separately in the App, the previous design’s geometry (part numbers, positions, rotations and wheel mounts) is also sent so that the proposal can use a different structure. Its saved name and design identifier are not sent. If you allow parts you do not have, a fixed list of common parts goes with it. With your consent to the updated design sharing, two rendered views of a proposed model and your request are also sent to OpenAI to check whether the model is recognisable before it is delivered and a creation credit is committed.
- OpenAI states that API content is not used to train its models unless the customer opts in. Google’s treatment depends on the applicable Gemini API service terms: its standard paid-service terms do not use prompts or responses to improve its products; unpaid services and optional data-sharing programs may use them and may involve human review. See the provider terms in section 4. We do not promise zero provider retention.
- The App sends user content to Google or OpenAI for the AI features above only after you agree, separately for photographs, cover tidy-ups, design requests, another version of a saved design and building from a photo (which covers another design of the same photo). A photo design job in App 1.6 uses the same building-from-a-photo consent: if you agreed to it in an earlier version and have not withdrawn it, the App does not ask again. What a photo design job sends is described in this policy. The updated App asks for fresh design consent covering the rendered views; an earlier design consent does not authorise this additional sharing, and older App versions do not send the views. Your answers are kept on your device separately for each Brickium account and each of these five features. Earlier device-wide answers are not carried over. You can review or withdraw a choice at Me → AI sharing. Withdrawal stops future sharing for that feature; it cannot recall content already sent. Deleting the account clears that account’s choices on the device used to delete it.
- We do not sell your personal information, we do not use it for advertising, and we do not track you across apps or websites. The App contains no advertising SDK and no third-party analytics SDK.
- You can delete your account, and what is stored with it, inside the App at any time.
2. What we process, and why
| Information | What it is | Why | Kept |
|---|---|---|---|
| Account | When you sign in with Apple or with Google: the account identifier that provider issues for you, and the name and email address it shares with us. With Apple you may hide your email, and we then receive only Apple's relay address. We never receive your Apple or Google password. | To create your account and recognise you when you return. | Until you delete your account. |
| Sessions | The Brickium sign-in token is kept in your device's keychain; our server stores only a one-way hash of that token. If you use Sign in with Apple, our server also stores an Apple refresh token. | To keep you signed in and, for Apple, to revoke your authorization when you delete your account. | The Brickium session lasts until sign-out or account deletion. The Apple refresh token is kept until it is replaced or your account is deleted. |
| Account-deletion receipt | A SHA-256 hash of the session token used to request deletion, creation and expiry times, and a flag indicating whether Apple authorization must be revoked manually. It contains no account identifier or readable session token. | To return the confirmed result if the deletion response is lost and the same session retries. | Valid for seven days. After expiry it can no longer be used and is removed when the next account-deletion request is processed. |
| Completion notifications | If you allow notifications: the device’s APNs token, push environment, interface language, account identifier and a hash of its sign-in session; delivery records link a request identifier, and the design identifier when a design was made, to that device and record delivery attempts. The App requests a current APNs token from the system and sends it to our server when notifications are allowed. | With your notification permission, to alert you when a design request is finished, whether the design was made or could not be, including after you leave the creation screen or switch apps. Apple receives the device token, generic notification text, the account identifier and, when a design was made, its identifier; the alert contains no prompt, model name or image. | The server registration and its delivery records are removed on a successful sign-out of that session, device unregistration or account deletion. Deleting a design removes its pending and retained delivery records. Delivery records otherwise remain until these events; expired notices are not sent after one hour. Turning notifications off blocks system presentation; the App requests server unregistration when it next opens and can connect. Already accepted APNs alerts cannot be recalled, and delivery or display is not guaranteed. |
| Inventory | Part numbers, colours and quantities you add by photo, by set number or by hand. | To design models from the bricks you have, and to show which parts of a design you do not have. | Until you delete it or your account. |
| Scan photographs | Photographs of your own bricks that you take or choose for scanning. | To suggest which parts are in the picture. Nothing is added to your inventory until you confirm it. | Not stored on our server. See sections 3 and 4. |
| Scan records | For each scan that is answered: the parts it suggested and, from App 1.6, the parts you confirmed, as part numbers, colours and counts, with the day, the recognition model used and its token counts. No photo. The record has no account column. | To measure how accurate scanning is. | Up to 180 days, also after account deletion. While your account exists, someone with access to our database could match a confirmed list to it; after the account is deleted, it cannot be matched to anyone. |
| Photos you build from | The subject of a photo you choose to build from, cut out on your device. | To decide whether it can be built and to describe it in one sentence for the design request, which you can change before it is sent. | Not stored on our server. It passes through our server's memory to Google for that one request. |
| Photo design checks | In App versions before 1.6, and in App 1.6 when photo design jobs are not offered: two images rendered from each model proposed from a photo, without your request text. Photo design jobs do not send these to Google. | To check, before showing you a design, that people would recognise it as the photo's subject. | Temporary image files on our server are removed after the request is built. The images are sent to Google; its retention is governed by the provider policies linked in section 4. |
| Photo design jobs | From App 1.6: while the job waits or runs, the description of your photo, the sentence as you left it, your choice of parts and your language; after it ends, how it ended, the versions it designed and notes on them. Pictures drawn of each version are sent to OpenAI. What each job cost us is recorded separately. | To make the design in the background, show you its progress and its result, and apply the limits described in the Terms. | The job's own copy of the description, sentence and choices is removed when the job ends. When the job delivers a design, the sentence and the description (subject, names, colours and features) are kept with that design until you delete the design or your account. The rest is removed 30 days after the job ends, or when you delete your account. Temporary image files are removed once they are read; any left by a crash are removed at the next start. The cost record has no account identifier; once the job record is gone, nothing links it to you. It is kept for up to two years. |
| Collection | The sets you add, whether each is still built, stars and their order. | To show your collection and to keep a set's bricks out of designs while it is built. | Until you delete it or your account. |
| Cover photos | Your photo or the set’s catalogue picture chosen as its cover, up to three AI background options for the current original image, and the option you select. The public catalogue name of the set helps guide its background. | To show the selected cover and let you switch between saved options. | Photos and options stay only on your device and are excluded from iCloud backup. Generating a background passes the original image and public catalogue name through our server without retaining the photos there. |
| Barcodes | The digits of a box's barcode. | To find which set it is. | We keep which set a barcode belongs to, not who scanned it. |
| Design requests and results | What you type, the design that is generated, its building instructions, your build progress, and any step you report as one that will not go together. | To generate, check and show you your designs. | Until you delete the design or your account. When you delete a design with taken-apart builds, its model, wheel positions, parts list and instructions remain in Build History until account deletion; the dedicated prompt and request-metadata fields are excluded from that history snapshot. Model names and model content may still reflect what you asked for. A deletion marker prevents a retried request from recreating a deleted design. |
| Design request receipts | The request identifier, a one-way fingerprint of its context, and a completed unsuccessful outcome with its errors, reasons and metrics. | To return the same completed result after a lost response or service restart without generating again or counting an attempt twice. | Until account deletion. We do not keep photos or a separate raw-prompt field in these receipts, but error or reason text may repeat user-provided content. |
| Recommendation preferences | Stable IDs of recommendations successfully created, the current daily batch, seen IDs and up to five shuffle request receipts. | To exclude completed recommendations across devices and apply the five daily batch changes without counting retries twice. No AI call is needed to recommend ideas. | Completed recommendation IDs remain until account deletion, including after an individual design is deleted. The daily batch and its receipts are replaced on the next active UTC day. The App also keeps account-scoped history and pending requests on the device; guests have a local daily counter. |
| Previous design geometry | Part numbers, positions, rotations and wheel mounts of the saved design selected for another version. | With separate in-App consent, to propose a different structure for the same request. | The source and delivered designs remain saved until you delete them or your account. The geometry sent to OpenAI is subject to the provider policy in section 4. |
| Rendered design views | Two images rendered from a proposed 3D model, together with the text of your request. | With updated design consent, to check whether the proposed model is recognisable as what you requested before delivery and committing a creation credit. | During normal processing, temporary image files on our server are removed after the request content is constructed. An abrupt interruption can leave temporary files on our server. The image data is sent to OpenAI; its retention is governed by the provider policies linked in section 4. |
| Purchases | The pack you bought, Apple's transaction identifier and the number of creations credited. Apple takes the payment; we never receive your card number or billing address. | To credit what you paid for, once, and to take it back if Apple refunds it. | Kept after account deletion, attached only to the deleted account's random identifier, so that the same purchase cannot be credited twice and so that we hold the transaction records the law requires. |
| Free-creation marker | A one-way hash of your Apple or Google account identifier. | To recognise whether the same sign-in account has already received the initial free creation, including after account deletion and recreation. | Kept after account deletion. This marker does not include the account profile, but it can recognise the same sign-in account on a later visit. |
| Usage counters | Your balance of creations, and how many scans, design requests, cover tidy-ups, new barcode lookups, photos checked and photo designs started you made today. | To apply the limits described in the Terms. | Account-linked counters are deleted with your account. Anonymous daily totals of cover tidy-ups and barcode lookups remain to enforce service-wide limits; they contain no account identifier. |
| Technical data | IP address, time, the address requested and the result. | To deliver the service and protect it from abuse. Processed by our server and by Cloudflare, which carries the traffic. | Only as long as needed to operate and secure the service. |
| Crash reports | Diagnostics provided by Apple, only if you have chosen to share them with developers. | To fix defects. | As provided by Apple. |
Where the GDPR applies, we process account, inventory, design and purchase information to perform our contract with you (Article 6(1)(b)); technical data, the free-design marker and the retained purchase record for our legitimate interest in securing the service and preventing fraud (Article 6(1)(f)); and transaction records where the law requires them (Article 6(1)(c)).
We do not collect your contacts, your precise location or biometric information. Recognition works on pictures of plastic bricks; we do not use photographs to identify anyone. Please frame your photographs so that people are not in them. When you build from a photo, the App looks on your device for faces and people in what would be sent, and does not send it if it finds one.
3. How a photograph is handled
- You take or choose a photograph in the App. It is sent to our server over an encrypted connection.
- Our server passes it to Google's Gemini API, which returns a list of candidate parts.
- We show you that list. You correct it and confirm it, or discard it.
- Our server does not write the photograph or thumbnails to disk. To recover a lost response without sending your photo to the AI again, it temporarily caches the suggested part rows and a one-way photo fingerprint in memory. The answer can be retrieved for 10 minutes; the cache is discarded on cleanup, service restart or account deletion. Separately, it keeps a scan record of the suggested parts and, from App 1.6, the parts you confirm, without the photo, for up to 180 days (section 2). Only the part numbers, colours and quantities you confirm are saved to your inventory.
4. Who receives information
| Recipient | What they receive | Purpose | Location |
|---|---|---|---|
| Google LLC (Gemini API) | Scan photographs; cover images you ask to edit and the set’s public catalogue name; the cut-out subject of a photo you build from, or the part you frame or the whole photo, as you choose, and, in App versions before 1.6 or without photo design jobs, two rendered views of each model proposed from it | Part recognition; cover backgrounds; checking and describing a photo to build from, and, before App 1.6 or without photo design jobs, checking that people would recognise a proposed model as what the photo shows | United States |
| UPCitemdb (UPC Item DB) | The digits of a barcode, sent by our server | Finding the set a barcode belongs to | United States |
| OpenAI, L.L.C. (API) | The text of your design request and a list of your available parts; with separate consent for another version, the previous design’s geometry; with updated design consent, two rendered views of a proposed model and the request text; when you build from a photo, the one-sentence description of it (which you can edit), a list of your available parts and, for another design of it, the previous design’s geometry; for a photo design job, the description of the photo with its names, features and colours, the sentence as you leave it, a list of your available parts and pictures our server draws of the job's own designs, never the photo | Design generation and visual recognisability check; designing a model from a photo | United States |
| Tencent Cloud | Everything our server stores | Hosting | Santa Clara, California, United States |
| Cloudflare, Inc. | Network traffic, including your IP address | Delivery and protection of the service | Global network |
| Apple | Sign in with Apple; purchases; with notification permission, the APNs token, generic completion alert, account identifier and, when a design was made, design identifier | Authentication; payment; delivery of completion notifications. Apple is the seller of record and handles your payment under its own privacy policy. | Global |
| Sign in with Google, if you choose it | Authentication | Global |
We require third parties receiving personal data from the App to provide protection at least equivalent to the protection described in this policy and required by Apple’s App Review Guidelines. Providers process data under their applicable terms, including the OpenAI Data Processing Addendum and, for paid Gemini API services, Google’s Data Processing Addendum.
We do not automatically attach your Brickium account identifier, profile name or email address to AI requests. Text or images you choose to submit may contain personal information, so please avoid including it. Provider data use and retention depend on the service and its applicable terms: OpenAI API data controls and Google Gemini API terms. OpenAI normally retains abuse-monitoring logs for up to 30 days, subject to its stated exceptions. Under its default settings, the Responses API also retains response data as application state for at least 30 days; account settings may change this. Photo design jobs send their requests to OpenAI with storage off, so OpenAI does not keep that conversation as a record that can be retrieved later; its abuse-monitoring logs still apply, and content in its prompt cache is kept for the cache's own period. Google’s paid services retain content for a limited period for abuse prevention. Depending on project settings, Google may also store developer-owned API request and response logs with separate retention. Unpaid services and optional data-sharing programs have different data-use terms. We have not claimed a zero-retention arrangement.
We disclose information to authorities only where the law requires it.
5. Where information is processed
Our server is in the United States, and the providers above process information in the United States and other countries. If you use the App from elsewhere, your information is transferred to the United States.
6. Deleting your account
Me → your account → Delete account deletes, immediately: the account record with your name, email address and provider identifier; every session; your balance of creations, including creations you bought and have not used; your scan and design counters; and your inventory, designs, builds, archived history snapshots, design request receipts, push registrations/delivery records, photo design jobs and step reports. What remains is described in the Account-deletion receipt, Purchases, Free-creation marker, Usage counters and Scan records rows of section 2, and the cost records in its Photo design jobs row. If you signed in with Apple, you can also stop using Apple ID with Brickium in your Apple Account settings.
7. Your rights
Wherever you live, you may ask us for a copy of the information we hold about you, ask us to correct it, ask us to delete it, ask for it in a portable format, or object to processing based on our legitimate interests. Write to zhang3917@gmail.com; we answer within 30 days and do not charge a fee. You can revoke notification permission at any time in iOS Settings; this does not interrupt a request already accepted by our server. You can revoke camera and photo access at any time in iOS Settings; the App keeps working with set import and manual entry. If you are in the European Economic Area or the United Kingdom you may also complain to your data protection authority.
California and Nevada. We do not sell or share personal information as those terms are defined in California and Nevada law. We do not let third parties collect information about your activity over time and across other services, so we do not respond differently to a Do Not Track signal.
8. Children
The App is intended for people aged 18 and over and is not directed to anyone under 18. When you create an account you confirm that you are 18 or older. Please do not allow anyone under 18 to use the App or your account. If you believe someone under 18 has given us personal information, write to us and we will delete it together with the associated account.
9. Artificial intelligence
Part recognition and design generation are performed by AI systems. Every design and every set of instructions is generated by such a system and then checked by deterministic software; a recognition result is a suggestion that you confirm. Before the first photograph and before the first design request, the App tells you which provider will receive what and asks for your permission. Asking for another version of a saved design requires a separate consent covering the previous geometry as well as the request, parts list and new rendered views. A photo design job in App 1.6 is covered by the building-from-a-photo consent given in this or an earlier version. The updated design consent also covers the two rendered views; earlier consent does not cover them and the updated App asks again; where the GDPR applies, that permission is your consent to this sharing. Your choices are recorded on your device, separately for each account and feature. You can change them at Me → AI sharing. Earlier device-wide choices do not grant the updated permissions. The App checks the current account’s choice before starting a new request or a retry. Withdrawal affects future transmissions and does not recall content already sent. This processing decides only which design you are shown. It has no legal or similarly significant effect on you.
10. Security
Connections are encrypted with TLS. Brickium session tokens are stored on our server only as hashes. Access to the server is limited to the developer. No system is perfectly secure; if a breach affects your information we will tell you and the authorities as the law requires.
11. Changes
If we change this policy we will change the date above, and for material changes we will tell you in the App before they take effect.
12. Contact
Zhang Liu · zhang3917@gmail.com