Privacy Policy

1. Data Controller

• Controller: Partfolio (independent developer)
• Website: https://partfolio.app
• Contact: hello@partfolio.app

For privacy-specific requests (access, deletion, correction, objection), email us with "Privacy Request" in the subject line.

2. Scope

This policy applies to:

• The Partfolio iOS app for iPhone and iPad
• This website, including the waitlist signup flow and support pages
• Cloud sync and backup for Partfolio Plus subscribers (see below)
• Marketing and launch emails you choose to receive

Partfolio does not sell subscriptions on this website. Purchases are handled only through Apple in-app purchase in the App Store.

3. Data We Collect

Depending on how you use the app and website, we may process the following categories of data:

3.1 Account and Contact Data

• Display name
• Email address
• User identifier (Firebase UID)
• Sign-in provider metadata (Sign in with Apple or Google)
• Profile photo, if you choose to upload one (stored in your private cloud storage)

3.2 Inventory and App Content

• Your collections, boxes, drawers, part quantities, wanted lists, label codes, and related notes
• Export files you generate (BrickLink XML, CSV, JSON) remain on your device unless you choose to share them

Your inventory lives on your device. If you subscribe to Partfolio Plus, a copy is also backed up to your own private cloud storage so you can sync across devices. We do not use your inventory to build advertising profiles, and we do not sell inventory data.

3.3 Waitlist and Marketing Data

• Email address submitted on this website
• Consent timestamp, signup source, and a hashed record of the IP address used at confirmation (for proof of consent)
• Marketing email preferences managed in the app or via unsubscribe links

Waitlist signups use double opt-in: your address is not added to our mailing list until you confirm via the email we send.

3.4 Website Analytics

• Aggregated, cookieless page-view and performance metrics via Vercel Analytics and Vercel Speed Insights
• UTM campaign parameters when present in the page URL (captured without advertising identifiers)

3.5 Camera and On-Device Permissions

• Camera access to read QR codes on your storage labels and boxes
• Photo library access only if you choose to select or save images in supported flows

The camera is used to read QR codes on labels and boxes. Partfolio does not use the camera to identify LEGO® parts.

4. What We Do Not Collect

• No advertising. Partfolio does not show ads on any plan, does not request the App Tracking Transparency permission, and does not collect an advertising identifier. An advertising SDK is present in the app binary but is disabled and never initialised, so it neither runs nor receives any data.
• No tracking SDKs. We do not use third-party analytics or crash SDKs that profile you across apps or sites.
• No advertising identifiers (such as IDFA) for monetisation or cross-app tracking.
• No collection of collection value. The app has no pricing logic and does not calculate what your parts are worth in money.

5. Purposes of Processing

We process data to:

• Provide core app functionality (inventory, search, labels, exports)
• Authenticate your account and sync Plus backups across your devices
• Operate the waitlist and send emails you have agreed to receive
• Measure website traffic and performance in aggregate
• Respond to support and privacy requests
• Maintain security and prevent abuse
• Comply with legal obligations

6. Legal Bases (GDPR)

For users in the EEA, UK, and Switzerland, our legal bases include:

• Contract performance: to provide the app and account features you request
• Consent: waitlist and marketing emails, and any optional preference you enable in the app
• Legitimate interests: website security, aggregated analytics, and service reliability, balanced against your rights
• Legal obligations: compliance with applicable law

You can withdraw marketing consent at any time from Settings → Privacy & Security in the app, or via the unsubscribe link in emails.

7. Third-Party Services

We use the following service providers:

• Google Firebase — authentication, Firestore database, and cloud storage for Plus backup and sync
• Apple — Sign in with Apple and App Store subscription management
• Google — Google Sign-In (authentication only)
• SendGrid — waitlist confirmation, welcome, and marketing emails (only after you confirm or opt in)
• Vercel — website hosting, cookieless analytics, and performance monitoring
• Cloudflare — Turnstile bot protection on the waitlist form

These providers process data under their own terms and privacy notices as processors or, in some cases, independent controllers. We do not authorise them to use your inventory for their own advertising.

8. Cookies and Similar Technologies

This website uses cookieless analytics through Vercel Analytics. It does not set advertising cookies or use cross-site tracking technologies that require a consent banner under typical ePrivacy interpretations for this type of measurement.

The waitlist flow may use strictly necessary technical measures (such as a signed confirmation token in the confirmation link) to complete double opt-in. We do not use those mechanisms for profiling.

9. Data Retention

• On-device inventory: retained until you delete it, export it, or delete your account
• Plus cloud backups: retained while your account is active. Cloud backups you have already made are not wiped if your Plus subscription lapses.
• Account data: deleted when you delete your account from the app (see Delete account)
• Waitlist and marketing records: kept while you remain subscribed and for a limited period afterward to prove consent
• Website analytics: retained according to Vercel's configured retention windows in aggregated form

10. International Data Transfers

Your data may be processed in countries outside your country of residence, including the United States, where our service providers operate. When required by law, we rely on appropriate safeguards such as standard contractual clauses offered by those providers.

11. Your Rights

Depending on your region, you may have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your data
• Restrict or object to certain processing
• Data portability
• Withdraw consent
• Lodge a complaint with a supervisory authority

You can export your inventory at any time from Settings → Export Inventory and delete your account from Settings → Privacy & Security → Delete Account, on any plan. You can also request a data export from Settings → Privacy & Security → Request My Data.

To exercise other rights, contact hello@partfolio.app.

12. Children's Privacy

Partfolio is not directed at children under 13 (or higher local digital age thresholds where applicable). We do not knowingly collect personal data from children without appropriate legal basis or parental consent.

13. Security

We use reasonable technical and organisational measures designed to protect your data. No method of transmission or storage is completely secure. Keeping your device and Apple or Google account secure is important because your inventory is stored locally.

14. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated through the app and/or this website where appropriate. The "Last updated" date reflects the latest version.

15. Contact

Questions or privacy requests:

• Email: hello@partfolio.app
• This policy: https://partfolio.app/privacy