Privacy policy

Studsly is a tool for keeping track of a LEGO collection. This policy explains what we store about you, why, and who else gets to see it. It describes the service as it actually is today — not as it might become.

Who is responsible

Studsly is run by Christian Stenbo. No company has been established behind the service yet, so the data controller is Christian Stenbo. Questions, access requests and deletion: legal@studsly.com. Found a security hole? Write to security@studsly.com.

What we store

Your account. Your email address. Nothing else. We do not store passwords, because Studsly does not use them — you sign in with a six-digit code sent by email, or with Google.

Your collection. What you register yourself: which sets, parts and minifigures you own, quantities, condition, whether the box and instructions are present, whether the set is built, and your notes.

Where things are kept. Studsly lets you write down where an item sits — «Attic / Shelf 3», for example. This is free text you choose yourself, and you decide how specific to be. We store no address.

Purchases and value. Purchase date, where you bought it, order reference, price, shipping and any import duty — whatever you choose to enter. Studsly also calculates an estimated value based on what comparable items have actually sold for.

Photos. Photos you upload of your own items, including the photo you take when you scan something, which is saved with the item.

Change log. Studsly records when a field changes, from what to what. It is there so you can see the history of your own items, and so a value estimate can be explained.

What we do not store

We do not store passwords, payment cards, national identity numbers or postal addresses. We have no analytics tools, no tracking pixels and no ad networks. We do not sell your data, and we do not share it with anyone for marketing.

Why we store it

We process this information in order to provide the service you asked for. The legal basis is the contract between us (GDPR Article 6(1)(b)), and for operations, backups and troubleshooting our legitimate interest in keeping the service working and not losing data (Article 6(1)(f)).

Who else sees it

Studsly runs with help from a few providers. They process data on our behalf and are not allowed to use it for anything else.

• Supabase — stores the database, the photos and the sign-in. EU (Stockholm).
• Vercel — runs the site itself. EU/US.
• Google — signing in with Google, if you choose it. US.
• Google Drive — receives a backup of the database. US.
• Backblaze — receives an encrypted backup of the photos you add. EU (Netherlands).
• Anthropic — see the section on image recognition below. US.

Scan photos also go to Brickognize, which is not one of our processors. See the section on image recognition below.

Transfers to the US rely on the EU Standard Contractual Clauses.

Studsly also looks things up against Rebrickable (catalog data) and BrickLink (price history). Those lookups contain set and part numbers — not information about you.

About image recognition

When you use the camera to identify a set, a minifigure or a part, a smaller copy of the photo is sent to Brickognize (brickognize.com), a recognition service for LEGO. If Brickognize cannot answer, the photo is sent to Anthropic instead. Anthropic processes it on our behalf and uses it only to answer that one question.

Brickognize is an independent service with its own terms. Under those terms it may keep the photos it receives and use them for its own purposes, including training its recognition models. You can ask Brickognize to remove a photo. If you would rather avoid this, register the item manually instead. The camera is optional.

We keep a record of each scan: what the recognition suggested and what you chose. We use it to measure and improve recognition for you. It is deleted together with the item if you delete the item, and together with your account.

We measure how fast pages load: the page type, the timing and the app version. It is not linked to your account.

Cookies

Studsly uses only the cookies that keep you signed in. None of them follow you to other sites. There is no tracking to switch off, and therefore no cookie banner.

How long we keep it

For as long as you have an account. If you ask us to delete it, we delete the account and its contents. Backups rotate, and deleted data disappears from them within 90 days.

Your rights

You have the right to see what we have stored, to have errors corrected, to have everything deleted, and to receive your data in a machine-readable format. Write to legal@studsly.com and we will answer within 30 days.

Account deletion is currently done by emailing us. We confirm once it is carried out.

If you believe we are handling your data wrongly, you can complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no), or to the supervisory authority in your own country.

Changes

If we change this policy in a way that matters to you, we will say so by email before the change takes effect.