Privacy policy

Effective 2026-09-30.

Stud Ticker is a website for LEGO® collectors: a catalog of sets, your own inventory and its value, saved searches, and news. This page explains what we collect, why, who else is involved, and your choices. Questions or requests: [email protected].

What we collect

• Your account: your email address, the name you choose, and your password, stored only as a secure one-way hash (argon2id), never as the password itself. Also your plan (Free or Pro) and your settings (theme, avatar). An avatar you upload is resized and its camera details (such as location) are removed. We don't collect payment details.
• Sign in with Google, if you choose it: Google tells us your name, email address and profile picture (the "openid email profile" permissions). We never see your Google password or any other Google data.
• What you add: your inventories (sets, condition, quantities, and purchase details such as store, date and price), receipts you upload, your saved searches, and which news stories and videos you've opened (to show "Visited", "New" and "Unread only"). Receipts are private: only you can see them.
• Your camera, only when you use it: scanning a barcode happens inside your browser, and nothing from the camera is sent to us unless you take a photo and choose to attach it to a purchase.
• Cookies and browser storage: a sign-in cookie (so you stay signed in, up to 14 days), a security cookie that protects forms against forgery, a cookie with your time zone (to show times in your local time), and, if you open an invitation link, a cookie that remembers it until you sign up (at most 30 days). Your browser also remembers which camera you picked for scanning. We use no advertising or tracking cookies.
• Visits: when you use the site we record each visit: when it started and ended, how many pages you opened, the first page and the site you came from, your IP address, your browser and system (e.g. "Chrome on Windows"), and an approximate location and network estimated from the IP address (city, region and country, e.g. "San Jose, CA"; never a street address). We look the address up on our own server, in the free DB-IP database: it isn't sent to anyone. For accounts we also record failed sign-in attempts. We use this to keep the site and your account secure (for example to spot a sign-in from an unusual place, or to block abuse) and to understand, in total, where our visitors come from.
• The Community, if you take part: your topics, replies, pictures (resized, with camera details such as location removed), reactions, the topics you follow and have read (for "new" markers and notifications), and reports you send. Other members see your name, avatar, posts, when you joined, how many sets and posts you have and, unless you hide it in User settings, whether you're online and when you were last seen. Who reported a post is only seen by the team. The team can see hidden posts and a member's post history, to keep the Community safe.
• Invitations: if someone invites you, we keep your email address (and name, if given), whether the invitation was delivered, when you opened its link (with the approximate place, as above) and whether you signed up.

How we use it

Only to run Stud Ticker: your account and inventory, prices and values, saved searches, news, security and abuse prevention, and answering you when you write. We don't sell your information, don't show advertising, and don't use analytics or tracking services.

Who else is involved

• Google: if you sign in with Google, Google's Privacy Policy applies to that sign-in. You can remove Stud Ticker's access at any time in your Google security settings.
• YouTube: the News page shows videos using YouTube API Services. When you press play, the video plays in YouTube's own player (in its privacy-enhanced mode, which loads nothing from YouTube until you press play); YouTube may then collect information as described in the Google Privacy Policy. By using the videos you agree to the YouTube Terms of Service. What we keep from YouTube (video titles, pictures, view counts) is refreshed or deleted within 30 days.
• News sites: story pictures on the News page load directly from the sites that published them, so those sites can see your IP address, as with any picture on the web. Opening a story takes you to their site.
• Hosting: the companies that host and protect the site (our server provider and Cloudflare) process requests on our behalf, only to run it.
• Email: the emails we send (invitations, welcome and password reset emails) go out through an email delivery service, which handles your email address and the message only to deliver it.
• Our data sources (Rebrickable, Brickset, eBay, Walmart and others): we fetch LEGO catalog and price information from them. We send them nothing about you.
• The law: we'd share information only if legally required to.

How long we keep it

Your account and everything in it stays until you ask us to delete it. Deleting your account removes your inventories, receipts, saved searches, uploaded pictures and news history. Your Community posts stay in their conversations, shown as from a former member, unless you ask us to remove them too. Backups roll over within 30 days.

Visit records are kept for 1 year for accounts and 90 days for visitors who aren't signed in; after that only daily totals remain (numbers of visits per country, region and city, with no IP addresses). Records of automated visitors (search engines and other bots) are kept 30 days.

Your choices

• See and change your details any time in User settings (your name at the top of the page).
• Ask us for a copy of your information, to correct it, or to delete your account: [email protected].
• If you signed in with Google, remove our access in your Google security settings.

Children

Stud Ticker is not meant for children under 13, and accounts are for people 13 or older. If you believe a child under 13 has given us information, tell us and we'll delete it.

Security

The site uses HTTPS, passwords are stored only as secure hashes, receipts are only shown to their owner, and administrators' changes are logged. No system is perfectly secure, but we work to protect your information.

Changes

If this policy changes, we'll update it here with a new effective date.

LEGO® is a trademark of the LEGO Group, which does not sponsor, authorize or endorse this site. See also our Terms of use.