The game, in plain English

Privacy Policy

Your @ and your town or city show up in the game by default once your house is created, by a comment on our post or by a direct message. You can withdraw your consent and ask us to remove them at any time. We never publish the text of DMs, and we don't sell your personal data.

Who runs the game

UK Brick by Brick is run by Nicolas Kai, an individual based in Brazil, who is responsible for your data (the “controller”). The game's Instagram account is @ukbrickbybrick. The servers are in the United States, outside the UK. Questions and requests: email [email protected] or send a direct message (DM) to @ukbrickbybrick. Last updated: 12 November 2026.

We follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, for cookies and similar technologies, the Privacy and Electronic Communications Regulations (PECR).

What we collect and why

• Public comments on our posts: your @, the account and comment IDs, the text and the time. We use them to find your town or city, build your house, count points and avoid counting anything twice. If a comment includes an email address or a phone number, we strip it out before saving the text.
• Stories in comments: if a comment tells a story, we may keep it to retell it in a video. See Stories.
• DMs: we receive messages with your town or city and region, requests about your data and support messages. We use the content and your @ to answer and to identify your participation in the game. The text of a DM isn't published on the site or in videos.
• Story mentions of our page: we record only that the mention happened and its date, for scoring, without collecting photos or story content.
• Follower count: background information for game integrity. It gives no points and isn't published.

This information comes from Instagram (Meta), from what you post. We read comments through Instagram's official tools. When needed, we check them again or import them by hand. We keep the history to check scores, fix errors and prevent abuse.

We don't collect passwords, email addresses (unless you write to us by email), phone numbers, photos, device location or the list of accounts you follow. Our web server sees your IP address to deliver the page; our logs don't keep it. Your town or city comes from your comment on a post or from the place and region you send by direct message, not from GPS. If you DM us, we use your @ and your message to handle your house, data or support request. How long we keep it is in “How long we keep things”.

Our lawful basis

UK law asks us to say on what basis we use your data for each purpose:

Where we rely on legitimate interests, we've weighed them against your rights, and you can object at any time (see “Your rights”).

Your consent

When you comment your town or city on one of our posts or DM it to us, you agree that we use your @ and your town or city to build your house and show them in the game, as this policy explains. Commenting doesn't mean you agree to every use: we use your data only for the purposes listed here, and we ask again before any new purpose. You can withdraw your consent at any time by asking us to delete your data (see Delete my data); your house then leaves the game. Withdrawing doesn't make what we did before it unlawful.

Instagram data we read

You never log in to UK Brick by Brick with Instagram. We use Meta's official tools, with the permissions shown in our app settings, only on our own Instagram account:

• Comments on our posts: your @, your Instagram account ID, the text and the time.
• Direct messages you send to our account: your @, your ID and the message.
• Mentions of our account in your stories: only that the mention happened, and when. We don't keep the photo or video.
• Basic public data about our own account and posts.

We don't read your feed, your followers or following lists, your other messages, or stories that don't mention us. We use this data only to run the game as described here. We don't sell it, we don't use it for advertising, and we don't give it to data brokers. If you ask us to delete your data, we do. Meta's own policies apply to what Meta holds.

What other people can see

The site and the game's videos can show your @, your town or city, your region, the place's code in the game, whether your house is settled, your house level, your total points, this week's points, this week's points by category, the founder badge, your office, your leaderboard positions and the date you joined. This data also makes up the public files that feed the map. If you share a story in a comment and we approve it, a video can also retell it with your @ (see Stories).

We never publish internal or Instagram IDs, the text of comments or DMs, who voted for whom, who you tagged and who tagged you, your old @s, the exact time you joined, points of people who don't have a house yet, the full history of point categories, spam or fraud flags, whether an account is suspended, why someone was hidden as a child or deleted, story photos or videos, whether you follow our page, or the internal record that keeps a deleted account from coming back. Your original comment stays subject to Instagram's rules and settings.

Stories

Some comments on our posts tell a story: on a post where we ask for stories, with #mystory, or in a longer comment. We may retell some of these stories in animated videos on our social media accounts, with your @. A person reads each story before it goes into a video, and we don't retell stories of anyone under 13.

By sharing your story in a comment, you allow UK Brick by Brick to retell it in an animated video with your @. You can ask us to remove it at any time.

What we keep

• the text of the comment and your @;
• the comment ID, the post ID and the date of the comment;
• whether you have a house on the map, and its town or city;
• whether you follow our account, which we check by hand;
• the status of our review and an internal note.

The text, your @ and the note stay in our private panel. They don't go to the site or to the public files that feed the map.

How long we keep it

• Waiting for review: if we don't review a story, we delete it ninety days after the comment.
• Declined: we delete the text, your @ and the note within thirty days. We keep only the comment ID, so the same comment doesn't come back to the queue.
• Approved or made into a video: kept for up to twelve months after we approve it.

Removing your story

Email [email protected] or DM @ukbrickbybrick and ask us to remove your story. It leaves the queue and any future video right away. Your stories are also deleted if you withdraw your consent, if you ask us to delete your data (see Delete my data) or if you're under 13.

Your business on the map

To put a business on the map, you fill in the business name, its Instagram @, the type of business, the town or city, the brand colour and a WhatsApp number for contact, and you accept the rules.

• The name, the @, the type, the town or city and the colour are public on the map and in the public files for the days of the listing, as a building with a sponsored badge.
• The WhatsApp number is personal data. We use it only to talk to you about the order (approval, decline or refund). It's never published or used for marketing, and we delete it ninety days after the listing ends. The amount paid is never published either.
• When you place a business order, we keep a one-way scrambled version of your IP, not the IP itself, only to limit abuse.
• You pay in USDT on the TRON network (TRC-20). PayGuin operates the payment: it creates the address you pay to and tells us when the payment arrives. We don't send PayGuin anything about you: no name, no email, no phone number and no ID.
• A transfer on TRON is recorded on a public blockchain. The address, the amount and the transaction are visible to anyone and stay there for good; neither we nor PayGuin can delete them.
• From the payment, we keep only the order code, the amount, the payment address, the status (paid, approved, declined or expired) and PayGuin's charge ID, to confirm the payment and to send a refund. A declined order is refunded in full, in USDT, to a wallet address you send us by DM.
• PayGuin has its own policy for the data it handles when it operates the payment.

PayGuin only processes the USDT payment. It is not responsible for delivery, support or the content of what the seller offers.
The seller is UK Brick by Brick. Contact: DM @ukbrickbybrick on Instagram.

We don't sell or share the WhatsApp number or the order. To ask for a copy, a correction or the deletion of this data before the deadline, use the same DM and include the order code (NEG-…).

How long we keep things

• Active players: your house, @, points and history stay while you play.
• Deleted players: see Delete my data. We don't keep long-term backups; any backup copy is deleted within 30 days.
• Business orders: the order code, amount, payment address, status, the name and @ on the order and PayGuin charge ID, for 5 years, for accounting and refunds. The WhatsApp number is deleted ninety days after the listing ends.
• Comments and DMs: the ones we use for the game stay while you play, until you ask us to delete them. Incoming messages we don't use are deleted within 24 hours.
• Stories: see Stories.
• Your cookie choice: 6 months in your browser, then we ask again.
• Server logs: they don't record your IP address, your @ or your messages. Web server logs are deleted after about 15 days.

When we no longer need personal data for the purposes above, we delete it or make it anonymous.

Site analytics and ads

The public site doesn't use analytics tools or ad pixels, and no third party sets cookies on it. If that changes, it will only happen with your consent: a banner will ask first, with “Reject all” as easy as “Accept all”, and we'll update this policy before it happens.

We don't sell your data

We don't sell personal data. We never give Meta or Google your @, your comments or your DMs. We don't collect special category data such as health, religion or political opinions, and we don't collect precise location, government ID numbers or passwords.

We use service providers (processors) that handle data only for us and under our instructions: our hosting provider (servers in the United States), PayGuin (payments only; we send PayGuin no personal data about you). Instagram/Meta is the source of most of the data.

Storage, access and security

Private data lives in our database and event log, with access limited to the team. The public files sit with our hosting provider, on servers in the United States. Instagram/Meta is the source of the data and also publishes the original comment.

While you play, we keep what your participation needs. When you ask us to delete your data, the timeline is on the deletion page: we act within one month, usually much sooner. Copies someone else already downloaded are out of our reach. An internal record remains so the house doesn't come back. It keeps only the Instagram ID, the final status, the moment the exit took effect and a request code with no other data. Anyone who asked for deletion, or whose account Instagram deleted, doesn't come back. We protect the data with safeguards suited to how sensitive it is, but we can't promise absolute security.

If something goes wrong

We keep a record of every personal data breach. If a breach is likely to put your rights at risk, we report it to the Information Commissioner's Office (ICO) within 72 hours of finding out, and if the risk to you is high, we tell you without undue delay. We take steps right away to reduce the harm and stop it from happening again.

Cookies and storage

Under PECR, we only store or read something on your device without asking when it's strictly necessary for the site to do what you asked. Everything else waits for your yes. You can change your choice at any time with the “Cookie settings” link at the bottom of every page.

The public site doesn't set cookies, no third party sets cookies on it, and there's nothing optional to accept right now.

The local storage stays on your device; we never receive it. You can clear it in your browser settings. Admin pages use security cookies (HttpOnly, session only); visitors don't get them.

Children

UK Brick by Brick is for people 13 and older and isn't directed to children under that age, which is the age UK law sets for a child's own consent online. If a comment or DM tells us the person is under 13, we never create a house for them. Within about 5 minutes we remove them from the site and delete their comment or message text, their @ and their history from our database. We keep only their numeric Instagram account ID, the date and a status flag, so they aren't added again, plus a one-way scrambled copy of their @ used only to recognise them if they comment again. At the same time we ask Instagram to hide the comments of theirs that we had already read on our posts. Hiding isn't deleting: after that, only they and our page can see those comments, and they can still delete them or report them to Instagram. We don't hide their DMs, comments by other people that mention them, or a new comment they post after that, which we discard when it arrives. Parents or guardians: email [email protected] or DM @ukbrickbybrick with the account's @ and we will delete what we hold.

Your rights

Under UK data protection law, you have the right to:

• Access: know what we have about you, where it came from, how we use it and who gets it, and get a copy.
• Rectification: ask us to fix wrong or incomplete data, like a town matched by mistake.
• Erasure: ask us to delete your data, as described in Delete my data.
• Restriction: ask us to pause using your data while we check a complaint, or to take your @ or town off the map and the public files.
• Objection: object to what we do on the basis of legitimate interests; we then stop unless we have a strong reason that overrides yours.
• Portability: get the data you gave us in a structured, commonly used format.
• Withdraw consent: at any time, for the game or for cookies, as easily as you gave it.
• Automated decisions: the game matches towns and counts points automatically, but none of it has legal or similarly significant effects on you, and a person reviews any of it if you ask.
• Complain: to us first, and you can always complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint.

Using these rights is free, and we won't treat you worse for using them.

How to ask

Email [email protected] or DM @ukbrickbybrick. We answer within one month. If the request is complex and we need up to two more months, we tell you why within the first month. We check it's you only as much as needed (for example, a DM from the account, or a reply to the email). Someone you authorise can ask for you. If you disagree with our answer, write back and a person reviews it.

Where your data is processed

UK Brick by Brick is run from Brazil. Our servers are in the United States. Your data is stored outside the UK, in the United States, and also accessed by the operator in Brazil to run the game and answer requests. Neither country has a UK adequacy decision covering all of this. When your data leaves the UK, we protect it with the safeguards UK law accepts, such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses with our providers, and we apply the same protections described in this policy wherever the data is. While it is there, it is subject to the laws of those countries, and their courts, law enforcement and national security authorities may be able to access it. To ask about these safeguards, write to us.

Changes to this policy

We'll post any changes on this page with a new date. Changes to why we use data or what we publish get a new review before they take effect, and we ask for your consent again where the law requires it.