Privacy Policy

Last updated: 29 October 2026

Rebrickable Pty Ltd, based in Australia, operates Rebrickable and is responsible for the personal information described in this policy. This policy explains how we collect, use, store and disclose personal information when you browse our website, use an account or our API, buy or sell MOC instructions, or contact us.

For privacy questions, requests or complaints, email help@rebrickable.com.

Information we collect

The information we collect depends on how you use Rebrickable:

• Account and profile information: your username, email address, password stored in hashed form, account preferences, and any profile details you choose to provide, such as a location, website or profile image.
• Your LEGO collection and activity: sets, parts, lists, saved preferences, followed designers, liked MOCs, submissions, uploads, comments, Workbench posts and other activity associated with your account.
• Messages and support: messages you send through Rebrickable, enquiries, reports and correspondence, including attachments and information needed to investigate or respond.
• Purchases and sales: orders, subscriptions, invoices, payment and refund status, transaction identifiers, payment-provider account details and information needed to calculate tax, such as your country.
• Designer tax information: where required for tax reporting, your legal name, date of birth, address, contact details, business details and Australian Business Number (ABN), as applicable.
• Technical and usage information: IP addresses, browser and device information, pages visited, referral sources, timestamps, cookies, API usage and logs used to operate and secure the service. We may infer your approximate location, such as your country, from your IP address. This is not precise GPS location.

We collect information directly from you, automatically when you use the service, and from payment providers when they confirm payments or account activity. Other users may also provide information about you in messages, transactions or reports.

You can browse much of the site without an account, but technical information may still be collected. If you do not provide information needed for an account, purchase, sale or tax obligation, we may be unable to provide that feature.

We do not ask you to provide sensitive information such as health information, religious beliefs or political opinions. Please avoid including sensitive information or other people's private details in uploads or messages.

How we use information

• To create and manage accounts, remember preferences and provide collection tools, building suggestions and other features.
• To publish the content you submit and provide community features, including comments and messages.
• To process purchases, subscriptions, designer sales, commissions, refunds and invoices.
• To deliver account and transaction messages, and optional updates according to your notification preferences.
• To respond to enquiries, moderate content, investigate reports and resolve disputes.
• To prevent fraud, identify returning banned users, protect accounts and enforce our terms.
• To understand site usage, diagnose problems and improve Rebrickable.
• To keep business records and meet legal obligations, including tax reporting.

Where UK or European data protection law applies, our legal bases depend on the purpose: performing our contract with you to provide the service; complying with legal obligations such as tax reporting; pursuing legitimate interests in operating, securing and improving the service, subject to your rights; and consent where required. This policy does not itself constitute consent to optional tracking.

Public information and privacy settings

Your username and content you publish, such as MOCs, comments and Workbench posts, may be visible to other people and search engines. Use your profile privacy settings to control visibility of the profile and collection pages covered by those settings. Custom lists have their own public or private settings.

Private messages are intended for their recipients. We may access messages when necessary to provide support, investigate abuse or comply with law. Recipients can retain or share information you send them.

Public information may be copied or indexed by others. Removing it from Rebrickable does not necessarily remove copies held by other people or search engines.

Payments and information shared with designers

Payments are processed by Stripe or PayPal. We do not receive or store your full card number or card security code. We do receive information needed to record and manage transactions, which can include payment identifiers, payer details and payment status. Payment providers also process information under their own privacy policies.

When you buy a designer's MOC instructions, the designer can access transaction information, including your username, email address, purchase details and buyer country, to manage the sale and provide support. The designer is responsible for their own handling of information they receive.

Cookies and analytics

We use cookies and similar browser storage to keep you signed in, protect forms and accounts, remember preferences and understand how the site is used.

We use Google Analytics to measure visits and activity. Google receives technical and usage information through this integration, including information about your browser, device and interactions with the site. Some designer pages also use the designer's own Google Analytics integration, allowing that designer to receive analytics about visits and activity on those pages.

We do not currently display third-party advertising. See Google's Privacy Policy for information about Google's processing.

Image delivery

We use BunnyCDN and Cloudflare to deliver and cache images. This includes images viewed on Rebrickable or loaded from cdn.rebrickable.com by other websites and apps.

These providers process your IP address and technical request information to deliver images, and keep request logs. Rebrickable does not set or use cookies for image delivery, or use image requests for tracking, advertising, usage statistics or linking activity to your account. Direct image requests do not run our website's Google Analytics code.

For information about the providers' privacy practices, see Bunny.net's Privacy Policy and Cloudflare's Privacy Policy.

When we disclose information

We do not sell or license your personal information, or share it for third-party advertising. We disclose information where needed to provide Rebrickable or meet legal obligations, including:

• Service providers: hosting, storage and backup providers; BunnyCDN for image delivery; Cloudflare for site delivery and security; SendGrid for email delivery; and Stripe and PayPal for payments. These providers receive or process information needed for their services.
• Analytics: Google and designers using their own Google Analytics integration, as described above.
• Other users: information you publish or send to them, and transaction information provided to designers when you buy their instructions.
• Tax authorities: information required by law, including Australian designer identity and sales information reported to the Australian Taxation Office under the Sharing Economy Reporting Regime (SERR).
• Legal and safety matters: where required by law or necessary to address fraud, protect people or our service, or establish, exercise or defend legal claims.

Where information is stored

Rebrickable is operated from Australia and our site servers are located in the United Kingdom. Our service providers may process information in other countries as part of their global services. Information may therefore be transferred outside your country, where privacy laws may differ. Where applicable law requires safeguards for international transfers, those requirements apply to our handling of your information.

Retention and account deletion

We keep personal information for as long as needed for the purposes described in this policy. Retention depends on the type of record, whether your account is active, applicable legal recordkeeping requirements, and whether information is needed to prevent fraud, enforce bans or handle a dispute.

You can request account deletion in Profile Settings. Account deletion disables access and starts removal of account details and associated content; some removal is processed in the background.

Deletion does not erase every record immediately. We retain limited account history and security records, including previous usernames and email addresses, where needed to detect fraud or returning banned users. We also retain transaction, invoice and tax records where needed for sales, accounting and legal obligations. These records may remain linked to your former account.

Backup copies may remain until replaced or removed through the backup cycle. Payment providers, designers and other recipients may retain their own records under their own responsibilities.

Security

We use HTTPS and technical and organisational measures to protect personal information against unauthorised access, loss and misuse. No internet service or storage system can be guaranteed completely secure. Keep your password and API credentials confidential, and contact us if you suspect unauthorised access to your account.

If a personal information breach occurs, we will assess it and notify affected people and relevant authorities when required by applicable law.

Your choices, rights and complaints

You can update account details, change profile privacy settings and manage optional email notifications in Profile Settings. Optional emails may also include unsubscribe links. Essential account, security and transaction messages may still be needed to provide the service.

Depending on the law that applies to you, you may have rights to access or correct personal information, request deletion, restrict or object to processing, receive a portable copy of information, or withdraw consent where processing relies on consent. Withdrawal does not affect the lawfulness of earlier processing.

To make a request or complaint, email help@rebrickable.com with enough detail for us to understand it. We may need to verify your identity before providing or changing personal information. We will respond within applicable legal time limits and explain any legal grounds for declining a request.

You can also complain to the relevant privacy regulator, including the Office of the Australian Information Commissioner, the UK Information Commissioner's Office, or your local European data protection authority, where applicable.

Children and age information

We do not routinely collect ages or verify the age of people creating accounts, and do not currently enforce a general minimum account age. Date of birth may be collected separately where required for designer tax reporting. If you are a parent or guardian with concerns about a child's personal information on Rebrickable, contact help@rebrickable.com.

External links, embedded content and affiliates

Rebrickable includes links to external websites and may display embedded content, such as videos. External providers may receive technical information when their content loads, and may use their own cookies. Their privacy policies apply to their processing.

Some external links are affiliate links. If you follow one and make a purchase, we may earn a commission. The retailer or affiliate network may use cookies or referral identifiers to attribute that purchase.

Changes to this policy

We may update this policy as the site or our practices change. We will publish updates here and change the date above.