Privacy

Your family's privacy, taken seriously.

Build Again is a family product, managed by a parent. We collect the minimum we need, never sell your data, and show no ads. Here's exactly what that means.

Effective date: 26 October 2026 (adds how you found us; previously 3 October 2026) · Build Again Pty Ltd (ACN 697 762 673)

Our commitment

Build Again is a family product, managed by a parent. The account holder is an adult; children use a supervised mode within the parent's account. We collect the minimum data needed to run the service. We do not sell your data, show advertising, or share personal information with third parties for marketing purposes. We do use a small number of trusted service providers to operate the app (listed under "Third parties" below).

What we collect and why

Data
Why we collect it
How long we keep it
Parent's name and email
Your account, sign-in, password reset, and the emails you choose to get
Until you delete the account
Password (hashed) and parent PIN
Sign-in, and keeping kid mode locked
Until you delete the account
Child's nickname (a first name or made-up name), avatar, age band and interests
Show builds that suit your child
Until you delete the profile
Kid-mode PIN (if you set one)
Lock a builder's profile
Until you delete the profile
LEGO sets and loose pieces you own
Work out which builds your bricks can make
Until you remove them
Build activity (which builds, chapters and steps a child reaches, and when)
Let your child carry on where they stopped, and show you their progress
Up to 24 months, or until you delete the profile
Subscription status
Manage the trial and billing
Until you delete the account
How you found us (the campaign tag on a link you followed, or the website that sent you)
Count which of our posts and links bring families, so we spend less on the ones that don't
Until you delete the account
Photos of LEGO pieces or a set box (scanner)
Identify bricks or a set when you use the scanner (sent to a recognition service; see Third parties)
Not stored by us after recognition; Brickognize keeps them (see Third parties)
Photos of finished builds (optional)
A parent may add a photo of a finished build to the family progress page. A photo may include your child. Photos are stored privately for your family, are never shown to anyone outside your account, and are not used for anything else (no recognition, no analysis, no sharing)
Until you remove the photo, withdraw consent, delete the builder's profile, or delete your account — whichever comes first
Security log (sign-in events, IP address, approximate country, device type)
Protect accounts from misuse
12 months
Contact form details (name, email, message)
Reply when you message us
12 months after our last reply
Waitlist (name, email)
Tell you when we launch
Until the launch email, plus 3 months
Gift purchases (buyer and recipient email, sender name, message)
Deliver the gift code
5 years, for tax records
Payment details
Process subscription payments. Handled by Stripe, Apple or Google; we never see or store full card numbers
Kept by them under their own legal duties; our tax records 5 years

What we do NOT collect

  • Child's full name, date of birth, school, or location
  • Photos or images of children, except the optional build photos a parent chooses to add (see above). Children cannot add photos; the camera is never available in kid mode. The scanner is for photos of LEGO pieces only.
  • Device identifiers or advertising IDs
  • Browsing history outside of our app
  • Any biometric data

Children's privacy (COPPA & GDPR-K)

The account holder must be a parent or guardian aged 18 or over. Children don't type in personal information: a parent sets up each builder's profile. When a child uses kid mode, the app records which builds and steps they reach, so they can carry on later and so you can see their progress. We explain this to children in plain words on the "A note for you" card in kid mode.

For children under 13 in the US (COPPA): we collect only what a child needs to use the app, and we never ask for more as a condition of using it. We share it only with the service providers listed below, who use it only to run the app. You can review your child's information, ask us to delete it, or tell us to stop collecting it, at any time: from the child's settings, from Account settings → Danger zone, or by emailing [email protected]. Because the app cannot work without a profile, stopping collection means we delete that child's profile.

For children in the EU/UK (GDPR Article 8): The legal basis for processing your children's profiles and activity is parental consent, granted during account creation. We rely on our contract with you to run your account and subscription, and on our legitimate interest in keeping the service secure for the security log. In the UK we follow the ICO's Age Appropriate Design Code. You can withdraw consent at any time by deleting a profile or the account. Build photos are subject to a separate, explicit parental consent given the first time a parent adds one; that consent can be withdrawn at any time from the family progress page, which deletes every build photo.

Third parties

We use a small number of trusted service providers to run the app. They process data to provide their service to us, not for their own marketing. The one exception is Brickognize, which may also keep scanner photos to improve its recognition (see below):

  • Railway (railway.app) — cloud hosting and database. Stores your account, profile, and build data.
  • Cloudflare (cloudflare.com) — serves and protects our website and app. All traffic passes through it; it keeps no profile of you for us.
  • Resend (resend.com) — sends email. If you contact us, your name, email and message are processed to deliver and reply to your enquiry.
  • Brickognize (brickognize.com) — LEGO piece recognition. When you use the scanner, the photo you take of LEGO pieces or a set box is sent to Brickognize to identify them. Only the photo is sent, from our servers, with location data removed. Brickognize keeps the photos and uses them to improve its recognition (it confirmed this to us in writing on 7 October 2026, and does not yet offer an opt-out), so photograph bricks only and keep people out of the picture. We tell you this in the app before your first scan.
  • Rebrickable (rebrickable.com) — LEGO set and part catalogue data and pictures. We send set or part numbers only. Set and part pictures load from Rebrickable's image server, which sees your device's internet (IP) address, as any site you load pictures from does.
  • Stripe (stripe.com) — processes subscription payments made on our website. We do not store full card numbers ourselves.
  • Apple (apple.com) — processes subscription payments made through the iOS app via In-App Purchase. Payment is handled by Apple under its own terms; we receive only the subscription status.
  • Google (google.com) — processes subscription payments made through the Android app via Google Play. Payment is handled by Google under its own terms; we receive only the subscription status.
  • RevenueCat (revenuecat.com) — tells us whether an App Store or Google Play subscription is active. It receives your household's account number, your device type, and the store's purchase receipt, never names or emails.

We do not use advertising networks, cross-site tracking, or social login providers.

Overseas disclosure

Some of our service providers store or process data outside Australia, mainly in the United States: Railway (hosting and database), Cloudflare (website and app delivery), Resend (email), Stripe (website payments), RevenueCat (app subscription status) and Brickognize (piece recognition). By using Build Again you consent to this disclosure. We take reasonable steps to ensure these providers handle personal information in a manner consistent with the Australian Privacy Principles.

For families in the UK and EU: Railway and RevenueCat protect data sent to the United States with the European Commission's standard contractual clauses and the UK addendum to them; Resend, Stripe and Cloudflare are certified under the EU-US Data Privacy Framework and its UK extension. Brickognize is based in the EU.

Privacy complaints

If you have a question or complaint about how we handle personal information, contact us at [email protected] and we will respond within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au). Families in the UK may complain to the Information Commissioner's Office (ico.org.uk), and families in the EU to their national data protection authority.

Cookies

We use a single authentication cookie (ba_token) to keep you logged in. The app also keeps three small settings on your device: whether it is in kid or parent mode, a PIN preference, and whether you have seen the scanner notice. No advertising or tracking cookies.

Data security

Passwords are hashed using bcrypt and never stored in plain text. All data is transmitted over HTTPS. Each family's data can be reached only through that family's account. We keep a written information security programme and review it every year. If a data breach affects you, we will tell you without undue delay.

Your rights

You have the right to access, correct, delete, and receive a copy of your data. We reply within 30 days. Email: [email protected]

Deleting your account

A parent can delete the account and all its data in the app, or ask us by email. The steps, what is deleted and what is kept are on the Delete your account page.

Contact

Data controller: Build Again Pty Ltd (ACN 697 762 673), Level 1, 457–459 Elizabeth Street, Surry Hills NSW 2010, Australia · [email protected] · +61 493 031 441