BrickFun Privacy Policy

Effective Date: October 8, 2026

This Privacy Policy explains how Manifest Tools LLC ("Manifest," "we," "us," or "our") collects, uses, and discloses personal information when you use BrickFun, including brickfun.app, its account and saved-build features, and its integrations with ChatGPT, Codex, or other supported assistants (collectively, the "Services").

BrickFun is a product operated by Manifest Tools LLC. This policy covers information handled by us through the Services. It does not replace the privacy policies of OpenAI or other third-party services you choose to use. The Manifest corporate website has its own privacy policy.

1. Information We Collect

The information we collect depends on how you interact with us.

Information you provide

You may provide information when you create or manage an account, save a build, use an integration, or contact us. This may include:

• your email address, account identifier, email-verification status, and a boolean declaration of eligibility for online features (we do not receive the age entered in the website's age check);
• authentication information needed to sign you in, verify your email, reset your password, and manage authorized connections;
• models, build names, imported files or other content you choose to save or send through the Services;
• account and editor preferences, where the relevant feature stores them;
• the contents of messages and diagnostic reports you choose to send us; and
• other information you choose to provide.

BrickFun's account system stores a hashed representation of your password. Sign-in credentials belong in BrickFun's sign-in flow, not in chat messages or plugin tool inputs.

Local storage and saved builds

BrickFun uses browser storage for local drafts, settings, cached content, and recovery data. A local draft is not automatically a public build. When you save or transfer a build to your account, its content and associated metadata are sent to our servers to make it available through your account.

Signing out or deleting your account does not necessarily erase copies, downloads, drafts, or recovery data stored on a device. You can manage local builds through the available editor controls and clear browser storage through your browser settings.

Information received through assistant integrations

When you use BrickFun through ChatGPT, Codex, or another supported assistant, we receive the tool inputs and resources that the host sends to BrickFun to perform your request. Depending on the request, these may include build identifiers, model content, selected-piece information, requested edits, and other task-specific information you choose to share.

When you link a verified BrickFun account, the consent screen identifies the requested permissions. Read access allows the assistant to obtain your account identifier and email address, list or search your saved-build library, and open or read builds you own. Optional write access allows supported creation, editing, and saving of account builds. Read permission covers your owned library; it is not restricted to a single build merely because one build is currently open. The connection does not grant access to unrelated documents stored on your device or to another user's account.

We process authorization codes, access tokens, connection records, requested permissions, and an encrypted account credential needed to carry out the authorized account operations. These credentials belong in the authorization flow, not in chat messages or model-callable tool inputs. The assistant host receives its access token through that flow; BrickFun's account credential is retained on our server rather than exposed to the model or editor panel.

Where a separate browser invitation is available, it authorizes operations on the dedicated local document opened through that invitation; it does not itself authorize access to an account library. Connecting either way does not give BrickFun access to your entire conversation history. Text or resources included in a tool request can nevertheless contain personal information, so avoid sending information that is unnecessary for building or editing your model.

Information collected automatically

Our systems and infrastructure providers receive technical information needed to deliver and protect the Services, such as IP addresses, browser and device information, requested pages or endpoints, request times, response status, and security or error events. We use this information to operate the Services, troubleshoot failures, and prevent abuse.

The editor also keeps diagnostic reports in browser storage. These can include browser information, error messages, stack traces, and limited editor state such as piece counts and active tools. These reports are not automatically uploaded by the editor. We receive a report if you choose to share it with us. Error text may contain information from your use of the Services.

2. Cookies and Similar Technologies

The Services use cookies and browser storage where needed to sign you in, complete authorization flows, remember preferences, save local drafts and recovery data, and cache editor assets.

We aim to minimize unnecessary tracking. Where required by law, we will provide appropriate choices regarding non-essential cookies or similar technologies.

You can control cookies and clear local data through your browser settings. Blocking or clearing storage may prevent sign-in or remove locally stored builds and recovery data. Export anything you want to keep first.

3. How We Use Information

We may use personal information to:

• operate, maintain, secure, and improve the Services;
• create and manage accounts, verify email addresses, and support account recovery;
• store, load, and synchronize builds and preferences through the features you use;
• perform the build, inspection, and editing actions you request through an authorized assistant connection;
• respond to messages, questions, and requests;
• send account, security, and service communications, and other communications where appropriate;
• detect, investigate, and prevent fraud, abuse, security incidents, and other harmful activity;
• comply with applicable law and legal process;
• protect our rights, property, users, and others; and
• support a merger, financing, acquisition, reorganization, sale of assets, or similar business transaction.

We may also create aggregated or de-identified information that does not reasonably identify an individual and use that information for lawful business purposes.

4. How We Disclose Information

We may disclose personal information in the following circumstances:

Service providers

We provide information to vendors that help us operate our business and the Services, such as hosting, infrastructure, email, security, and communications providers. These providers may process information on our behalf in connection with the services they provide to us.

Our current infrastructure includes Cloudflare for website delivery, network protection, and account email delivery, and Hetzner for server hosting. Google's Gmail service processes support and privacy correspondence received through our mailboxes.

Assistant integrations and sharing you request

When you connect BrickFun to an assistant, information needed to answer your request is returned to that host. Depending on the tool and the permission you grant, this can include account or library information, model content or summaries, selected-piece information, previews, and the results of edits. The host handles information it receives under its own policies.

Your account builds are private by default. If you choose to export or share a build using an available sharing feature, recipients may keep their own copies. Where a feature creates a share link, anyone who receives the link may be able to access the shared content. Do not share information you intend to keep private.

Legal and safety reasons

We may disclose information when we reasonably believe doing so is necessary to:

• comply with law, regulation, legal process, or a valid governmental request;
• enforce our agreements or policies;
• investigate or prevent fraud, abuse, or security incidents; or
• protect the rights, safety, or property of Manifest or others.

Business transactions

Information may be disclosed or transferred as part of an actual or proposed merger, financing, acquisition, restructuring, bankruptcy, sale of assets, or similar transaction.

At your direction

We may disclose information when you direct us to do so or consent to the disclosure.

5. Sale and Targeted Advertising

We do not currently sell personal information or share personal information for cross-context behavioral advertising, and we do not currently process personal information for targeted advertising.

If our practices change, we will update this policy and provide any choices required by applicable law.

Where applicable, we recognize legally required browser-based opt-out preference signals, such as Global Privacy Control.

6. Diagnostics and Analytics

The editor's diagnostic reports remain on your device unless you choose to share them. You can download or clear reports using the editor's problem-report controls. Clearing diagnostic reports does not itself delete your builds.

Our infrastructure providers may process technical usage information and delivery logs to provide and secure their services. This is separate from the editor's local diagnostic reports.

We do not currently use third-party tracking analytics, display advertisements, or automatically upload editor diagnostic reports. Necessary infrastructure and security processing described above is separate from tracking analytics.

We do not currently use private builds or assistant tool inputs to train AI models. An assistant host's own processing is governed by its policies.

Before materially changing how we use or disclose personal information, we will update the policy and provide the notices, controls, and consent requests required by applicable law. An updated policy does not, by itself, authorize a new use of previously collected information where consent or another legal requirement applies.

7. Communications

If you sign up to receive marketing or product communications from us, you can unsubscribe using the link in the message or by contacting us.

Even if you opt out of marketing communications, we may still send non-marketing communications when necessary to respond to you or administer an existing relationship.

8. Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, including to operate our business, comply with legal obligations, resolve disputes, maintain security, and enforce agreements.

Retention depends on the type of information:

• Account information and account-saved builds: retained while you maintain them through your account. You can delete builds using the available account controls and request or initiate account deletion. Account deletion removes associated builds from the active account database, subject to any lawful preservation requirement.
• Local drafts and recovery data: remain in the relevant browser until removed through the available controls, cleared through browser settings, or evicted by the browser. These are separate from server-side account deletion.
• Editor diagnostics stored on your device: bounded to the eight most recent diagnostic sessions, with up to 40 entries per session; you can clear them sooner. This is a count limit, not a fixed time limit.
• Account-linked authorization: authorization codes expire after one minute and access tokens after ten minutes. Account grants last no more than 24 hours after consent, and may end sooner if the account credential's initial validity ends. No refresh tokens are issued. Revocation stops further authorized account access. Expired or revoked account-linked credentials and authorization records are removed from active storage within 24 hours of expiration or revocation; recovery copies are subject to the backup limit below.
• Account-build creation retry records: a mapping between a creation request and its resulting document is retained for seven days to prevent duplicate builds when a request is retried. The expired mapping is removed within 24 hours after that period; removing it does not delete the build saved to your account.
• Browser invitation connection records: unclaimed invitations expire after 15 minutes; relay sessions expire after 24 hours or a service restart. Expired server-side session capabilities and records are removed by hourly cleanup, within 24 hours after expiration. Disconnecting invalidates the browser connection and removes its server-side connection credential. Local session records can remain in tab storage until removed or the tab session ends.
• Shared snapshots: sharing creates a separate server copy accessible to anyone with its link. Snapshots are deleted automatically within 30 days of creation. Contact privacy@brickfun.app with the share link to request earlier removal. Session expiration does not erase your device's local document or copies someone else has downloaded.
• Application request logs: our account server retains request logs for five days. We disable its optional logging of IP addresses and account IDs, but request URLs may contain identifiers. Hosting and email-delivery providers retain their own technical records to operate and secure their services and meet legal requirements. See Cloudflare's privacy policy and Hetzner's data protection information.
• Support correspondence: received at support@brickfun.app and retained for as long as reasonably needed to respond, follow up on related issues, maintain a useful support history, or meet a specific legal obligation or dispute. We do not currently apply an automatic fixed deletion deadline to support email. You can request deletion by contacting privacy@brickfun.app, subject to applicable legal exceptions.
• Database backups and rollback checkpoints: deleted information may remain in backup copies after removal from active systems, for up to 90 days. Hourly cleanup removes expired snapshots. Backups are for recovery, not an indefinite archive of deleted builds.

When information is no longer needed, we may delete it, anonymize it, or otherwise remove it from active use, subject to applicable law. Copies you have exported or shared, and information held by an assistant host, are governed by the recipient's own storage and deletion practices.

9. Security

We use reasonable technical, administrative, and organizational measures designed to protect personal information.

No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

10. Your Privacy Rights and Controls

Depending on where you live and applicable law, you may have rights regarding your personal information, including rights to:

• request access to personal information we hold about you;
• request correction of inaccurate information;
• request deletion of information;
• obtain a portable copy of certain information;
• object to or restrict certain processing; and
• opt out of certain sales, sharing, targeted advertising, or profiling where applicable.

You may submit a privacy request by emailing privacy@brickfun.app.

The Services also provide controls for managing account builds, exporting models, deleting your account, and clearing local diagnostic reports. You can revoke an account-linked assistant through your BrickFun account's connection controls and remove the integration through the host's available controls. A browser invitation can be disconnected using the editor's connection panel. Closing an editor panel or browser tab is not the same as revoking an account grant. Revocation or disconnection stops further authorized access; it does not erase previously returned information, delete your builds, or undo an operation already delivered or in progress. To remove information held by the assistant host, use that host's controls or contact it directly.

We may need to verify your identity before completing a request. Authorized agents may submit requests where permitted by applicable law.

We will not discriminate against you for exercising a privacy right provided by law.

Because privacy laws differ by jurisdiction and contain various exemptions and applicability thresholds, not every right listed above applies in every circumstance.

11. International Visitors

Manifest is based in the United States.

If you access BrickFun from another country, your information may be processed in the United States or other countries where we or our service providers operate. Those jurisdictions may have data-protection laws different from those in your country.

Where applicable law requires specific safeguards for international transfers, we will use appropriate safeguards.

12. Children

BrickFun is intended for a broad audience, including children under 13. The website and editor are distinct from integrations with third-party assistants, which have their own age and account eligibility requirements. BrickFun does not grant permission to bypass those requirements.

Children under 13 can use BrickFun’s editor without an account and export their builds to files on their device. Accounts, cloud saving or synchronization, and remote assistant connections are not available to children under 13 in this release. A parent should start a child's local session in a separate browser profile, rather than let a child use an unlocked adult account. An adult's account is not a substitute for a child-account consent process.

BrickFun does not store users’ ages or dates of birth on its servers. Account records include an eligibility status for online features. This status is not proof of age or parental consent.

In a child's local guest session, build content and editor diagnostics stay on the device unless exported to a file. Our delivery and security providers necessarily receive network identifiers, such as IP addresses, to send the website and assets, perform network communications, and prevent abuse. Such identifiers are used only to support these internal operations, not to contact the child, target advertising, train AI models, or build a behavioral profile. We limit access and use infrastructure protections and provider arrangements to restrict processing to those purposes. The retention limits described above apply to the relevant technical records; clearing browser storage removes local drafts, diagnostics, and eligibility choices.

We have not introduced child cloud accounts or a parental-consent system for them. We will not enable those features before providing any required parental notice, verifiable consent, and parent review/deletion controls. Agreement to the Terms does not replace required privacy consent.

Children should ask a parent or guardian to contact support or send diagnostic reports for them. If we learn that a child has sent personal information outside the limited practices described here, we will address the request as permitted by law and delete the information promptly when it is no longer needed, rather than retain it as an ordinary support history.

The operator responsible for these practices is Manifest Tools LLC, 1401 21st St Ste R, Sacramento, CA 95811, United States; telephone +1 628 997 9607; email privacy@brickfun.app.

Parents or guardians with questions or requests concerning a child's information can contact privacy@brickfun.app. We may need to verify the requester's identity and authority before providing information or completing a request.

13. Third-Party Sites and Services

BrickFun may contain links to websites or services operated by others.

Their privacy practices are governed by their own policies, not this Privacy Policy. We encourage you to review the privacy policies of third-party services you use.

14. Changes to This Policy

We may update this Privacy Policy from time to time.

When we do, we will post the updated policy on this page and change the effective date above. If changes materially affect how we use previously collected personal information, we will provide additional notice when required by applicable law.

15. Contact Us

For questions about this Privacy Policy or our privacy practices, or to exercise a privacy right, contact:

Manifest Tools LLC Email: privacy@brickfun.app