Last updated: October 28, 2026 (EDT)
What changed in October 2026: Brickonia accounts, public experience reviews and automated moderation are described below. Our email address book now lives in Supabase.
Brickonia collects as little as a store can collect and still ship you a box of bricks. This page says exactly what we keep, why, and what we will never do with it.
What we collect, and why
| What | Why | Where it lives |
|---|---|---|
| Name, shipping address, email, phone (if given) | To deliver your order and send order updates | Shopify (our store platform) |
| Order history | Receipts, returns, warranty | Shopify |
| Payment details | To process payment: we never see your full card number; payment is handled by Shopify Payments and its processors | Shopify Payments |
| Email address (the monthly letter, only if you ask and confirm) | The letter you asked for: new sets and build ideas, at most once a month | Supabase. The confirmation email leaves from our Google Workspace mailbox |
| Account email, sign-in provider identifier and basic profile information (if you choose Google) | Create and secure your Brickonia account; keep you signed in | Supabase Auth. Google processes the sign-in if you choose Google |
| Experience rating, optional message and public nickname, language, market and submission dates | Save and publish your feedback, prevent duplicate reviews and record moderation decisions | Supabase; published review fields are visible on Brickonia. Review text, nickname and language are processed by OpenAI Codex for moderation |
| What you send through the contact form (your name if you give it, your email, your message) | To answer you. It is never added to a mailing list | Our Google Workspace mailbox |
| Basic technical data (IP address, browser type) | Security, fraud prevention, making pages load right | Shopify and hosting logs |
What stays on your device
The Dream Box (« Boîte à rêves »), the sets you save for later, is stored in your own browser's local storage. It never leaves your device. We can't see it, we don't sync it, and we will never email you about it. A dream is not a sales lead.
Your unfinished review is kept in this browser tab’s session storage so a refresh or interrupted sign-in does not erase it. It is cleared after a confirmed submission. Sign-in credentials are not kept in that draft.
Your account and experience reviews
Creating an account or submitting a review does not subscribe you to the newsletter. We use email codes or Google sign-in to confirm your account. If you choose Google, we use basic identity information to sign you in; we do not request access to your Gmail, Drive or Calendar.
When you submit a review, its rating, optional message, optional public nickname and date can appear on the homepage and review pages after moderation. Your account email and sign-in identifiers are never included in public reviews. Please do not put private contact details in a message or nickname.
OpenAI Codex checks review messages and nicknames for spam, abuse and personal information. The moderation input excludes your account email, sign-in credentials and star rating; anything you type into the message or nickname is part of that input. Positive and negative feedback follow the same rules. Uncertain messages stay unpublished; a rating may be published without a message containing personal information. You can ask us to reconsider a decision by writing to hello@brickonia.com.
You can edit or delete your review from your account. Deleting it removes it from public pages and erases its stored message and nickname; limited decision and security metadata remains to prevent accidental republication and investigate abuse. Contact us to request deletion of your account or a copy of its information.
The newsletter promise
- We ask, then we check: signing up sends you one email with a link, and you are subscribed only once you confirm. Didn't confirm? You won't hear from us again.
- At most one email per month. That is a ceiling, not a target.
- Unsubscribe is one click, in every email, in plain sight.
- We never buy, sell, rent, or trade email lists. Yours included. No data resale, ever.
- Signing up for the newsletter is never required to buy, return, or get help.
- The newsletter is for ages 16 and up.
What we never do
- Sell or rent your personal information. To anyone. For anything.
- Add you to marketing emails because you bought something or saved a dream.
- Use invisible trackers to follow you around the internet.
We measure site activity through Cloudflare Web Analytics and operational reporting to our parent company, InceptionAI. Operational reports exclude account emails, cookies and URL query strings. A daily-changing visitor identifier helps count visits without sharing the raw IP address with our parent company.
Cookies
When you choose a shopping country, a first-party cookie remembers that choice for up to one year, renewed when you visit. We synchronize it between the Brickonia market sites you use so future visits open your chosen store. You can change it in the language and country menu or clear it by deleting your browser cookies.
Essential cookies keep your Brickonia cart together and secure your account. Account cookies are inaccessible to page scripts and are sent over HTTPS in production; they keep you signed in for up to 30 days, renewed when you return. Signing out clears your account session on that domain. The same account works on our market domains, but each domain maintains its own sign-in session. Google also processes its sign-in interaction when you choose that option. Any Shopify checkout uses Shopify’s own cookies.
Who we share data with
Only the services and partners needed to run the site, provide your account, process your feedback, answer you or deliver an order:
- Shopify: store platform, checkout, payments.
- Supabase: accounts, authentication, the email address book and review storage.
- Google: optional Google sign-in and identity confirmation.
- OpenAI: automated moderation of review text and public nicknames through Codex.
- Cloudflare and InceptionAI: hosting, site security and operational traffic reporting.
- Google Workspace: our mailbox, where your messages to us arrive and from which we write back.
- Our fulfillment and distribution partners: they receive your name and shipping address to pack and ship your order, and nothing more.
- Carriers: name, address, phone (for delivery notifications).
- We never share for marketing. If a court order compels disclosure, we comply with the law and tell you when we are allowed to.
Some of our service providers, including Shopify, process data outside Québec and outside Canada. We choose providers whose protections are equivalent to what the law requires here.
How long we keep things
- Order and invoice data: as long as tax and consumer law require, typically 7 years for tax records in Canada.
- Newsletter addresses: until you unsubscribe, then removed from the active list within 30 days.
- Support emails: about 2 years.
- Account information: while your account is active, or until you request deletion subject to necessary legal or security retention. Review messages and nicknames are erased when you delete the review; limited moderation and security metadata may remain.
Your rights (PIPEDA and Québec Law 25)
You can, at any time, ask us:
- What we hold about you (access).
- To correct anything inaccurate.
- To delete your personal information, where the law allows us to (we must keep what tax law makes us keep).
- To withdraw consent to the newsletter (or just click unsubscribe).
- For your data in a portable format (Law 25 right to data portability).
Write to our privacy officer (below). We answer within 30 days. If you're unsatisfied, you may complain to the Commission d'accès à l'information du Québec (CAI) or the Office of the Privacy Commissioner of Canada (OPC).
Privacy officer (Law 25 requirement)
Québec's Law 25 requires a designated person in charge of personal information protection. At Brickonia, that responsibility is held by the person with the highest authority in the business. Reach them at hello@brickonia.com.
If something goes wrong
If a confidentiality incident ever puts your information at serious risk of injury, we will notify you and the CAI as Law 25 requires, quickly and in plain language, the same honesty we promise everywhere else.
Children
Bricks are for everyone; checkout is for adults. Our store is not directed at children, and we do not knowingly collect personal information from children. Orders must be placed by someone of the age of majority in their province or state.
Changes to this policy
If this policy changes, the date at the top changes with it, and meaningful changes get a plain-language note on this page. We will never sneak a quiet edit that loosens the promises above.
Contact
Write to us at hello@brickonia.com. A real person from the Brickonia Team answers.