Privacy policy

This is a translation for your convenience. Only the German version is legally binding.

Controller

Maximilian Hößbacher, Max Hößbacher IT-Service und 3D-Druck, Gottlieb-Bögner-Str. 93, 63849 Leidersbach, Germany. Email: hallo@lay-a-brick.de. We are not required to appoint a data protection officer.

Principles

• No ads, no social media plugins. The only third-party service is Google Analytics, and we only load it with your consent.
• We serve fonts, scripts and images ourselves. Without your consent, no data is transferred to other providers when you visit lay-a-brick.
• We do not store IP addresses in our database in plain text, only as a checksum (hash) calculated with a secret value that changes every day. The IP address cannot be derived from it.
• An account is optional. Building, printing and sharing via link work without one.

Hosting and server logs

lay-a-brick is hosted by ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, on servers in Germany. We have concluded a data processing agreement with ALL-INKL pursuant to Art. 28 GDPR.

Each time a page is accessed, the web server processes technically necessary data: IP address, date and time, the address accessed, the amount of data transferred, the browser identifier and the previously visited page. This is necessary to deliver the site and to fend off attacks (Art. 6(1)(f) GDPR). The host’s logs are deleted automatically after a short time.

Use without an account

The editor saves your model in your browser’s storage (localStorage). This data does not leave your device as long as you don’t share anything. The following is also stored only in your browser: your choice of light or dark theme and the edit keys for models you have shared via link.

If you share a model via link without an account, we store the model, a preview image, the name you optionally entered, timestamps and the IP checksum described above. The purpose is to provide the link (Art. 6(1)(b) GDPR). We automatically delete links that nobody has accessed for 365 days.

Account

For an account, we store: username, email address, password (only as an Argon2id hash, never in plain text), optionally a display name and short bio, language, appearance, and the times of registration and last sign-in. For two-factor authentication, we store the secret in encrypted form and the recovery codes only as a hash.

For your security, we keep a log of security-related events (for example, sign-in, password change) with timestamp and browser identifier. It is deleted after 180 days, and you can view it in your account.

The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR); the protective measures are based on our legitimate interest in a secure service (Art. 6(1)(f) GDPR). The data remains stored until you delete your account. Accounts are available from age 16.

Models, likes and views

We store your models with title, description, tags, category, preview image and timestamps. Only you can see private models; models shared via link can be seen by anyone who knows the link, and public models by everyone. Public models are licensed under CC BY 4.0 and show your username.

We store likes and “Built it” with your account and the model. We count views once per visitor and day; for this, we use the daily IP checksum or your account number and delete this assignment after two days. To prevent misuse (for example, mass likes), we analyze whether many reactions come from the same checksum within a short time (Art. 6(1)(f) GDPR).

Google Analytics

With your consent, we use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). It shows us which pages are visited and how often, roughly which countries visitors come from and which devices they use. This helps us improve lay-a-brick.

For this, your browser stores cookies from Google (see the table below), and Google receives: pages visited with time, the previously visited page, browser, operating system, screen size, language, approximate location (derived from the IP address) and a random identifier for your browser. Google Analytics 4 does not store complete IP addresses. The data may also be transferred to servers of Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which there is an adequacy decision of the European Commission (Art. 45 GDPR). We have a data processing agreement with Google under Art. 28 GDPR. Google deletes the data after 14 months at the latest.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Without consent, Google Analytics is not loaded. You can withdraw your consent at any time with effect for the future: under “Cookie settings” at the bottom of every page. When you withdraw, we delete the Google cookies in your browser. We only store your choice in your browser’s storage (localStorage, entry “lab.consent”).

Cookies

We set technically necessary cookies without consent (§ 25(2) TDDDG). Your browser only stores the Google Analytics cookies if you have agreed.

Emails

We only send emails that are necessary for your account: address confirmation, password reset, security notices and decisions on reports. There is no newsletter and there are no tracking pixels. Emails are sent via the ALL-INKL mail system.

Reports

If you report content, we store the reason, text, the address concerned, optionally your email address and the IP checksum. This serves to process the report under the Digital Services Act (Art. 6(1)(c) and (f) GDPR). We keep reports for up to two years so that we can document our actions.

Automated checks

We automatically check titles, descriptions, tags and names for brand names, links and inappropriate terms. If a text fails the check, you can change it. We do not make any other automated decisions within the meaning of Art. 22 GDPR.

Recipients and third countries

Apart from ALL-INKL as our host, only Google receives data about you, and only if you have agreed to Google Analytics (see above, including a possible transfer to the USA). Beyond that, we only disclose data if we are legally required to.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can do much of this directly in your account: under “My data”, you can download all your data as a ZIP file or delete your account completely. For everything else, an email to hallo@lay-a-brick.de is enough. You can withdraw a consent at any time (Art. 7(3) GDPR).

You can also lodge a complaint with a data protection supervisory authority, for example the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.

Changes

We update this policy when the service changes. The version published here applies. Last updated: 26 October 2026.