Privacy policy

1. Who is responsible for Sklica?

An operator has not yet been appointed. Before Sklica launches publicly, this notice must name the legal person or organisation responsible for personal information (the data controller), provide their privacy contact email and contact address, and give any required representative or data protection officer details.

This draft describes the current application build. It is not a statement that an operational service has completed its UK data protection obligations.

2. The short version — including for younger builders

Your list of bricks and your building progress are saved in this browser. They are not sent to a Sklica account. Anyone using the same browser profile may be able to see them.

When you choose a photo, Sklica looks at it on your device. It does not upload that photo to us or use it to train AI. Take pictures of bricks, rather than people or private information.

Loading pages and downloading models uses the internet. The hosting service receives technical information needed to deliver those requests. You can clear Sklica’s saved information using your browser’s site-data settings. Ask a trusted adult if you need help.

3. What stays on your device

Sklica uses an IndexedDB database named sklica to save brick part numbers, colours and quantities; model identifiers and instruction progress; and imported model information, including source credits. These records stay in this browser profile unless you export them or share your device.

Photos selected for scanning are resized and analysed in browser memory using conventional image processing. The current build does not persist the scan photo in its database or send it to the model download service. The working image remains while the app is open, including when you switch sections. Reloading or closing the app normally clears it. Your original photo remains wherever you saved it, and your device or browser may retain its own copies.

Importing a collection reads the file locally. Exporting creates a file on your device; you control where that file is saved or shared. Sklica does not provide cloud backup or cross-device synchronisation.

The app does not ask for your name, date of birth, address, precise location or payment information. Choosing a camera or file through your device may involve your browser’s permission controls. That permission is not a general consent to other processing.

4. Cookies, local storage and offline files

The application code does not set cookies or include advertising pixels, analytics tags or cross-site tracking. This does not mean it uses no device storage. UK rules on storage and access technologies also cover local storage, IndexedDB and browser caches.

Local storage remembers whether you have dismissed the welcome screen (sklica-welcome) and when you dismissed the install reminder (sklica-install-dismissed). The latter is checked to suppress the reminder for seven days; the stored timestamp itself has no automatic deletion date.

Browser caches store application files, downloaded model geometry and model source files so requested features can work offline and repeated downloads can be avoided. The service worker manages cached application versions. Inventory, progress, preferences and downloaded content otherwise remain until removed, overwritten, evicted by your browser or cleared through site-data settings. There is no fixed automatic expiry for these records.

This storage supports the local workspace, your explicit selections and offline features. It is not used for advertising or behavioural measurement. Before launch, the operator must document the applicable PECR exception for each purpose, remove unnecessary storage, and obtain consent before any non-exempt storage or access begins. Any cookies or tools added by the eventual host must also be assessed and disclosed.

5. What leaves your device

When online, your browser requests pages, images, fonts, model files and other application resources from the service hosting Sklica. Requests expose technical information such as your IP address, requested URL, request time and browser-supplied headers. The hosting and security services may record some of this information in access or security logs. The deployed services, enabled logs, exact fields and retention periods must be confirmed before launch.

Downloading an LDraw model sends the selected set and model identifiers to Sklica’s model endpoint. The endpoint fetches public metadata or model files from library.ldraw.org. In this build it does not deliberately forward your IP address, collection, progress or scan photo to LDraw; LDraw receives a request from the server. The selected identifiers may appear in hosting request logs.

Following a source or attribution link opens an external website. That site receives your request and applies its own privacy and cookie practices. The app has no public profiles, messaging or social-sharing service.

6. Why personal information may be used

Where technical request information is personal data, it is needed to deliver requested pages and files, maintain availability, investigate faults and protect the service from abuse. The proposed basis for this limited processing is ordinary legitimate interests under Article 6(1)(f) UK GDPR: operating a reliable and secure service. The future operator must record a necessity and balancing assessment, including children’s interests, before relying on this basis.

If you later contact the operator, your contact details and the information you choose to send would be used to answer and manage your enquiry, ordinarily on the basis of legitimate interests in responding. Processing necessary to meet an applicable legal duty, such as handling data-rights requests, would rely on Article 6(1)(c). No contact form or support mailbox is configured in this build.

The current build has no targeted advertising, sale of personal information, marketing list, AI training, profiling or solely automated decisions producing legal or similarly significant effects. Local colour suggestions and build matching help you choose pieces and models; you review the results.

There is no requirement to provide an account or photo. You can enter bricks manually. Network request information is necessary to deliver online resources; without it, online pages and new model downloads cannot be delivered. Previously cached features may still work offline.

7. Providers, disclosures and international transfers

The production host and any security, logging or support providers have not been selected or verified. Cloudflare Pages has been discussed as a deployment option but is not confirmed by this notice. Before launch, the operator must name the providers, explain their roles and recipients, and identify the relevant processing locations.

If a provider processes personal information outside the UK, the operator must establish an applicable UK adequacy regulation or an appropriate safeguard, such as a UK International Data Transfer Agreement or UK Addendum where required, and explain how you can obtain information about those safeguards. No transfer arrangement is asserted by this draft.

An operator may have to disclose information it actually holds where required by law or necessary to establish, exercise or defend legal claims. This does not give the operator access to your browser-only inventory or photos.

8. Retention, deletion and security

Device storage lasts as described in section 4. You can remove individual inventory entries within the app or clear all Sklica site data in your browser to remove the local database, preferences and caches. Clearing site data can permanently remove your collection and progress and may require models to be downloaded again. Export anything you want to keep first. Removing a home-screen icon alone may not clear browser storage.

Clearing site data does not delete an exported file, an original photo, or any separate hosting logs. Delete those files through your device’s normal file or photo controls. The operator cannot restore browser-only records after they are lost.

Before launch, the operator must set and state specific retention periods, or meaningful criteria, for request and security logs, correspondence and rights-request records. No unverified log retention period is promised here.

Your browser’s access controls help separate local data from other websites. The current build does not provide an additional password or app-level encryption for local records. Use a trusted device and browser profile. Production hosting must use HTTPS and appropriate access and security controls; no service or device can be guaranteed completely secure.

9. Your UK data protection rights

Depending on the circumstances, you may ask a controller for access to your personal information, correction, erasure, restriction of processing and portability. You may object to processing based on legitimate interests. These rights have conditions and exceptions; portability does not apply to every type of processing.

If processing is based on consent in a future feature, you can withdraw that consent at any time without affecting the lawfulness of processing before withdrawal. Browser permission controls let you change camera access separately.

Once appointed, the operator must provide a working contact route for these requests. Requests are normally answered without charge and within one month, subject to the legal rules on verifying identity, clarification and permitted extensions. Only proportionate information should be requested to verify identity. The operator cannot retrieve information that exists only on your device.

You can complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint/ or by calling 0303 123 1113. You do not have to contact the operator first, although doing so may help resolve the issue.

10. Children and families

Sklica’s building activities may appeal to children. The current build does not ask children to create profiles, provide their age, enable location tracking or share photographs publicly. Its brief privacy summary is intended to be understandable by younger users as well as adults.

Before launch, the operator must assess whether the ICO Children’s Code applies, complete any required data protection impact assessment, and check that the design and providers protect children’s best interests. This draft does not substitute for that assessment. Parents and carers can help children use shared devices and clear saved data.

11. Changes to this policy

This draft was reviewed against the application build on 28 October 2026. The operator must complete the unresolved details and update the notice when the service or its data use changes. Material new purposes must be explained before they begin, and consent obtained where required. The updated date will show when the notice was revised.