Including our Cookie Policy. For young Builders of Tomorrow, and their parents and guardians (who are also Builders of Tomorrow – just grown-up!).
Last updated: 24 October 2026 Applies to: a build a day
This is one privacy policy for everyone who plays the Game: players of every age, and parents and guardians.
Part A is our Privacy Policy. Part B is our Cookie Policy. Part C has extra information for people in particular countries.
The short version
We collect only what we need to run the Game: a LEGO® Account, a nickname, progress in the Game, and basic information about the device.
We are separate from The LEGO Group. When you sign in with a LEGO Account, we and The LEGO Group share some information so your accounts stay in step (Section 7).
We do not sell personal data, and we do not show third-party adverts. We do not market to children, and we do not ask parents for permission to do so.
There is no way to spend real money in this Game, and nothing to buy.
Children get extra protection. A parent or guardian can also see, change or delete their child’s data at any time (Section 13).
You can ask to see, correct or delete data at any time (Section 13).
Where to find what
If you are a child: read our short notice, Our Promise To You, and ask your parent or guardian to read this policy with you.
If you are a parent or guardian: Section 3 explains who counts as a child, Section 8 explains what we do about permission, and Section 13 explains your choices.
If you are an adult player: the whole policy applies to you. Section 4 to Section 7 cover your data.
If you play from a particular country: see Part C.
LEGO Digital Play Group means LEGO Digital Play and its affiliated first-party game studios. When we say we, us or our, we mean LEGO Digital Play Group.
The Game is published on the app stores by LEGO Games Lab A/S, a company incorporated in Denmark. LEGO Games Lab A/S is the controller of personal data (any information that relates to an identifiable person) in the Game. That means it decides why and how the data is used, and it is responsible for looking after it.
This policy covers a build a day (ABAD) Technical Beta (the Game). The rules for playing it are in our Terms of Use.
We are separate from The LEGO Group. The LEGO Group (TLG) means LEGO System A/S and its affiliated companies. LEGO Digital Play Group and TLG are independent of each other, though we are part of the same company family. Each decides for itself why and how it uses personal data, and each has its own privacy policy. Section 7 explains the limited ways we and TLG share data when someone uses a LEGO Account, the sign-in account that TLG runs.
Our standard. We apply the standards of the EU General Data Protection Regulation (GDPR) to every player, wherever they live, and we add anything extra local law requires. Part C sets out those extras.
If you have a question about this policy, want to use your rights, or are a parent or guardian with a request about your child, contact our privacy team: privacy.officer@legodigitalplay.com
It helps us find the right information if you tell us your name, which Game is played and the nickname. If you are a parent or guardian, we will need to check that you are the child’s parent or guardian before we share anything about them. If you do not know which LEGO Digital Play Group company is responsible, that is fine. We will pass your request to the right team.
This policy is for everyone who plays the Game, and for the parents and guardians of children who play. It applies in the same way to every player, and gives children extra protection.
In this policy, a child is a player under 18, or any older age at which the law where they live says a parent or guardian must agree for them. Everyone under 18 gets the extra protections in Section 14. A parent or guardian is the adult responsible for a child.
For children. We have a short notice written for you, called Our Promise To You. Please read it, and ask your parent or guardian to read this policy with you.
For parents and guardians. This policy explains what happens with your child’s data and the choices you have. Where we say “you” to a player, a parent or guardian can act for a child (Section 13).
We collect only what we need to run the Game. Later versions of the Game may add features. If a new feature collects different information, or uses it in a different way, we will update this policy before it goes live (Section 15).
What we collect
Examples
Where it comes from
Account and identity
The LEGO Account. The nickname, and any other way a player sets up their profile, such as an avatar if the Game offers one. When the Game account is created, used or deleted. If TLG sends us account information to set up the account in advance, that too.
The player, and TLG when they sign in or register with a LEGO Account (Section 7)
Gameplay and progress
XP and level. Completed Dailies, Minis, Sets and Sections. Streaks. Challenges. Season Pass progress, and what has been unlocked and when. In-game currency, Energy and Bag balances. The saved game (Cloud Save).
Created as the player plays
Device and technical
Device model, operating system and app version. Language and region. Crash and performance logs. IP address, which we use to keep the Game secure.
The device, automatically
Age and permission information
The player’s age, date of birth or age band, when we ask for it, so we can apply the right protections.
The player, and the LEGO Account
Parent or guardian information
Only what we need to deal with a request from a parent or guardian.
The parent or guardian
Support and feedback
Messages sent to us, and our replies.
The player, or a parent or guardian
We do not collect precise location, photos, videos or voice recordings, or contacts. There is no chat or messaging with other players in the Game, and no way to share things a player makes.
We also use cookies and similar technologies. See Part B.
We use personal data only for the reasons below. Because we apply GDPR standards to everyone, each reason has a legal basis, shown in the right-hand column.
Why we use it
The data we use
Our legal basis
To run the Game account and let the player play.
Account and identity, gameplay and progress, device and technical
Adults and older players: contract. They asked to use the Game under our Terms.
To sign in with a LEGO Account and keep accounts in step (Section 7).
LEGO Account nickname and other account details
To keep the Game secure, and to prevent cheating, fraud and abuse.
IP address, device data, account activity
Legitimate interests in keeping the Game and its players safe, weighed against the best interests of any child. Legal obligation where one applies.
To fix problems and improve the Game.
Crash and performance logs, gameplay data
Legitimate interests in a Game that works well, weighed against the best interests of any child.
To help a player, or a parent or guardian, who contacts us.
Support messages, account information
Contract, or legitimate interests in helping, and our legal duty to respond to requests.
We do not sell personal data, and we do not let advertisers or ad networks collect it through the Game. We do not show third-party adverts.
We do not market to children, and we do not ask parents for permission to market to their children, because we do not do it.
We do not use a child’s data to train AI systems, or to build profiles for advertising.
We do not ask for more personal information than a player needs to play.
We do not use personal data to make decisions about a player by computer alone where those decisions have a legal or similarly significant effect.
This game is free to play, and the game has no purchasing.
A player needs a LEGO account to play the Game, whether it is a child or an adult account. They sign in with their LEGO Account, or register for a LEGO account inside the Game. We and TLG each handle some of a player’s data, as this section explains. The same applies when a child signs in, and a parent or guardian can act for them.
We use this only to run the Game account and keep it up to date.
We send TLG only what it needs to keep the LEGO account up to date. For example, if a player changes their nickname in the Game, we tell TLG so the LEGO account matches. TLG does not use what we send to build analytics or marketing profiles, and it filters out information about activity in the Game that it does not need.
We and TLG are independent controllers. We use this data to run the Game. TLG uses it to keep the LEGO account up to date. Each of us relies on its own legal basis.
A player’s LEGO Account and account information are kept within the LEGO ecosystem, by TLG, for as long as the LEGO account exists.
This means that deleting a Game account does not delete the LEGO account or LEGO Account. To delete those, use the LEGO account settings, which a parent or guardian can do for a child, or contact TLG.
In this Game, we do not ask a parent or guardian for permission for the Game itself, and we do not rely on any permission given to TLG. A player needs a LEGO account to play (Section 7). When a child registers for one, TLG runs its own age check and parent verification, under TLG’s own policy. That step is for the LEGO account only. We do not see or hold the parent’s verification details. A parent or guardian can still see, change or delete their child’s data (Section 13).
We do not share personal data outside LEGO Digital Play Group and TLG, except in the cases below.
We use other companies to provide services to us. They may only use the data on our instructions and under contract. They include:
Apple and Google, where the Game is downloaded, handle data under their own privacy policies.
We may share data where the law requires it, to answer a valid request from a court or public authority, to protect the safety of a player or others, to protect our systems, or to enforce our Terms.
If LEGO Digital Play Group is merged, sold or reorganised, personal data may pass to the new owner. We would tell people first, and the new owner would have to respect this policy.
Data is held on servers in the UK. Because we and our service providers work in different countries, data may be sent to, or accessed from, other countries.
When we send personal data to a country that does not have data protection rules the EU recognises as adequate, we use a safeguard the law accepts. You can ask us for more information about these safeguards (Section 2).
We keep personal data only for as long as we need it for the reasons in Section 5, or as long as the law requires. We do not keep it for ever. This table is our written retention policy.
Data
Why we keep it, and for how long
Account and profile
To run the Game account. While the account is active, then 30 days after it is deleted
Gameplay and progress, including Cloud Save
So the player keeps their progress. Until the Game account is deleted, then 30 days
Inactive accounts
If an account hasn’t been used for 6 months, we may delete it. We tell the player in the Game first, and for a child’s account we also tell the parent or guardian where we hold their contact details.
Device and technical data, crash reports
To keep the Game working. 365 days
IP addresses in security logs
To keep the Game secure. 365 days
Support messages
60 days after we close the case
Age and permission records
Only if we hold these records. To show we followed the law. While the account is active, and 30 days after
Parent or guardian information
Only as long as needed to answer a request from a parent or guardian. 365 days.
LEGO ID and account information held by TLG
Kept by TLG for as long as the LEGO account exists. See Section 7.
If a player, or a parent or guardian for a child, asks us to delete data, we will, except where we must keep something to meet the law, settle a dispute or enforce our agreements. We will tell them if that applies.
We use technical and organisational measures to protect personal data from loss, misuse and unauthorised access.
No system is perfectly secure. You can help: choose a nickname that does not include personal details, keep your account secure, and tell us if you notice a problem. If a breach puts personal data at risk, we will tell the person affected, or for a child their parent or guardian, and the regulator, as the law requires. Where the law asks us to, we will also tell the child, in words they can understand.
You have these rights over your personal data. Some depend on where you live, and Part C has the details.
If you are a parent or guardian. You can use all of these rights for your child, at any time. You can also say no to us collecting or using any more of your child’s data.
If you are a child. These rights are yours too. Your parent or guardian can use them for you by contacting us (Section 2).
How to use your rights. Contact us using Section 2. We may ask you to prove who you are, and a parent or guardian to show they are the child’s parent or guardian, so that data does not go to the wrong person. It is free. We will reply within one month. If the request is complex we may take up to two more months, and we will tell you why. If we say no, we will tell you the reason.
What deleting means. Some data is needed for the Game to work. If a request is to delete data or to stop collecting it, the Game account, or some features of it, may stop working.
Data held by TLG. LEGO account data is held by TLG, which has its own responsibilities. To use your rights over that data, contact TLG.
Complaints. Please tell us first, so we can put things right. You can always complain to your data protection authority. Part C lists them. Because LEGO Games Lab A/S is incorporated in Denmark, you can also complain to Datatilsynet, the Danish Data Protection Agency.
Whichever country a player lives in, we design the Game with the best interests of children, and of everyone under 18, in mind:
Some countries also have online safety laws for games, such as the UK Online Safety Act.
If anything in the Game worries you or your child, contact us. A child who is worried can tell a parent or guardian, who can contact us.
We may update this policy, for example when the law changes or the Game does. The date at the top shows the latest version. If a change matters, we will tell people in the Game before it takes effect. If we change how we use a child’s data in a way that matters, we will also tell parents and, where the law requires, ask for permission again before the change takes effect.
This part explains how the Game uses cookies and similar technologies, and the choices players and parents have. Children: there is a short, friendly version just below.
A cookie is a tiny bit of information saved on your phone or tablet to help a game or website remember things, like that you’re logged in. They have nothing to do with chocolate chips. Sadly.
In this game, we only use the cookies the game needs to work. We don’t use cookies to show you ads, and we don’t use them to follow you around the internet. We don’t ask you to say yes to any extra cookies, either.
Want to know more? Ask your parent / guardian to read the rest of this Part.
Cookies are small data files that an app or website saves on your device. A cookie does not hold or collect information by itself. But when a server reads it, it can help a service work better, for example by remembering that you are signed in.
We also use similar technologies that work in the same way: storage inside the app on your device, software kits from other companies (often called SDKs), tags, pixels and scripts. In this policy, “cookies” means all of these. We use them in the Game.
Like most digital services, we and the companies that help us collect some technical information automatically. This can include an IP address, the type of device, browser or app, the operating system, the internet provider, the date and time of a visit, and how a player moves around the Game.
We keep this technical information apart from account details, except where we need to link them to run the Game or keep it secure.
The cookies we use fall into three groups.
Group
What they do
Do we ask first?
Necessary
Needed for the Game to work, so they are always on. They keep a player signed in, remember language and region, save progress, and help keep the Game secure.
No. We do not need permission for cookies that are strictly necessary, because the Game cannot work without them. They can still be deleted (see B6).
Functional and performance
Optional. They help us see how the Game is used, find and fix problems, and improve it.
Adults and older players: yes. They are off unless the player says yes, and the choice can be changed at any time.
Children: we do not use these for children, and we do not ask a parent to agree to them.
Marketing and advertising
Cookies and identifiers used to show adverts or to track people across other apps and websites. We do not use any in the Game.
Not applicable, because we do not use them.
Some cookies last only while the Game is open. Others stay for a set time after the player last played, up to 800 days. Similar technologies, such as storage inside the app, do not expire on their own. They can be removed by clearing the Game’s data or deleting the Game.
Necessary cookies cannot be switched off, because the Game would not work, but they can be deleted. For any optional cookies, a player can change their choice at any time.
Cookies are saved on the device, so we cannot delete them for you. You can limit or remove them in your device’s settings, for example by resetting or limiting your advertising identifier, clearing the Game’s data, or deleting the Game. If you use a web browser, you can block or delete cookies in its settings. Your device or browser’s help pages explain how. A parent or guardian can do this on a child’s device.
If you switch off cookies on your device, some parts of the Game may stop working. If you have questions about cookies, contact us using Section 2.
We apply the standards of the EU General Data Protection Regulation (GDPR) to everyone who plays the Game, wherever you live. Where the law of your country asks for more, we do that too. This part sets out those extras.
If you or your child live in the Philippines, the Data Privacy Act of 2012 and the rules of the National Privacy Commission (NPC) apply. Under that law, we are the “personal information controller” for the Game.
People in the Philippines have the right to be informed about how their data is used, to object, to see their data, to have it corrected, to have it erased or blocked, to receive it in a portable form, and to claim damages if they are harmed by the misuse of their data. You can complain to the NPC at any time. Our Data Protection Officer’s details are in Section 2. If a data breach that is likely to cause serious harm happens, we will tell the people affected and the NPC as the law requires.
For children. The NPC expects privacy information for children to be written in a way children can understand and to have extra safeguards. That is why we have a short notice for children, Our Promise To You. If a breach affecting a child’s data has to be reported, we will tell both the child’s parent or guardian and, where it is appropriate, the child.
If you or your child live in New Zealand, the Privacy Act 2020 applies. It is built around 13 Information Privacy Principles. In particular, you can ask to see the information we hold about you and ask us to correct it. We must collect information fairly, and not intrude unreasonably on anyone’s personal affairs, especially where children and young people are concerned.
If a privacy breach is likely to cause serious harm, we will tell the people affected and the Privacy Commissioner. You can complain to the Office of the Privacy Commissioner.
New Zealand law has no fixed age at which a child can agree to how their data is used. We apply the same protections that apply everywhere else in the Game.