Last updated: DRAFT — not yet in force.
Who we are
Bricks and Octane is an independent fan site about LEGO cars, racing, and motorsports. This policy explains what information we collect, why, and the choices you have. It is written to support the EU/UK GDPR and the California CCPA/CPRA.
A 13+ site
Bricks and Octane is made for adult LEGO fans and is intended for people aged 13 and over. Nobody has to tell us their age to read the site; until you do, we treat you as an adult. Creating an account starts with an age check: you choose one of three answers — 18 or older, 13 to 17, or under 13 — with nothing pre-selected and no date entry, and it runs before we collect any account details or hand off to a sign-in provider. If you answer under 13, we block the sign-up, remember the device for 30 days so it cannot immediately retry, and keep no record of the rejected attempt — no age, no email. We do not knowingly create accounts for, or collect personal information from, children under 13, and we do not offer child accounts, parental-consent flows, or guardian dashboards. See our Age & Teen Privacy notice.
Information we collect
- Age signals. We store only the age group you chose (under 13, 13 to 17, 18 or older — or unknown if you never answered) with your privacy choices — never a date of birth, for anyone. A member who registered as 13 to 17 keeps that setting until they change it themselves. (Members who registered before September 2026 gave a birth month and year; we keep that privately, never show it, and no longer collect it.)
- Account data. If you register, your username, email address, hashed password (or a sign-in-provider identifier), and any profile details you add.
- Your privacy choices. Your consent selections (analytics, ads, personalization) are stored in a first-party cookie and recorded server-side so we can honor them. We store only a one-way hash of your first-party cookie id — never the raw id, and never your IP address.
- Usage data. Only with your consent, first-party analytics about how you use the site. These events store a hashed session id and a coarse location (country/region/city derived from your request and then discarded) — never your raw IP address or precise location.
- Submissions. If you submit a build or other content, what you send us plus attribution back to the original source (we link out; we do not rehost creators’ imagery).
- Payments. If you buy a membership, our payments processor (Stripe) handles your card details; we receive only your subscription status and entitlements, not your full card number.
How we use information
To run and secure the site, to create and manage your account, to honor your privacy choices, to process memberships, and — only with your consent — to measure usage and show advertising. We do not use your data for automated decisions that produce legal or similarly significant effects. We do not sell your personal information, and we do not “share” it for cross-context behavioral advertising, as those terms are defined under CCPA/CPRA.
Consent & legal bases
Analytics, advertising, and personalization are all opt-in — none is required to use the site, and nothing in those categories runs until you turn it on. Necessary cookies and core account processing rely on our legitimate interest in operating the service and on performing our agreement with you. You can withdraw consent at any time from your cookie preferences.
Teen users (13–17)
Registered members aged 13 to 17 get our strictest defaults, enforced server-side and not overridable from the browser: no behavioral analytics, no personalized advertising, no personalized feed or recommendations, and no inclusion in marketing or affiliate tracking. Anything a teen submits is reviewed by a human before it appears, and identifying details are withheld from the public credit.
Third parties we use
We use a small set of processors, each engaged under its own terms and only for the purpose described. Several are disabled unless configured for this deployment:
- Google Analytics 4 — first-party usage measurement, loaded only with your analytics consent.
- Google Search Console — aggregate search-performance data about our own pages (no per-visitor tracking).
- Mailgun — sends account and, if you opt in, newsletter email.
- Stripe — processes membership payments.
- Cloudflare — content delivery, bot protection (Turnstile), and the coarse country signal used for our first-party analytics.
- Advertising networks (e.g. Google AdSense) — only when ads are enabled and only for a consenting adult visitor; never for a teen or a minimized visitor.
How long we keep data
We keep each category of data only as long as we need it, and enforce a documented retention schedule with an automated pruning job. See our Data Retention Policy for the periods per data type.
Your rights & choices
Depending on where you live, you can access, export, or delete the data we hold about you, and withdraw consent at any time. Use the privacy request form or open your cookie preferences. We verify your identity by email before acting on a request.
International
The digital-consent age under the GDPR varies by country (13 to 16). Our position for the regions we serve is being finalized with counsel and will be stated here before this policy takes effect.
Contact
Privacy questions: privacy@bricksandoctane.com.