Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

We are subject to the EU General Data Protection Regulation (GDPR) and the Swedish Data Protection Act (Dataskyddslagen 2018:218). The supervisory authority for data protection matters in Sweden is the Swedish Authority for Privacy Protection (IMY — Integritetsskyddsmyndigheten).

2. What Data We Collect

2.1 Account Registration

When you create an account on our community platform, we collect:

• Username — your chosen display identifier
• Email address — for authentication and password recovery
• Password — stored as a secure bcrypt hash (we never store plain-text passwords)
• Display name — your chosen public name

2.2 Profile Information

You may optionally provide:

• Bio — a short personal description
• Location — a text-based location you choose to share
• Avatar preferences — emoji and colour gradient for your profile avatar

2.3 Community Content

When you participate in our community, we store content you create:

• Social feed posts and comments
• Questions and answers in the Q&A forum
• YouTube video shares and votes
• Location submissions and ratings
• Event RSVPs
• Private messages between members

2.4 Contact Form

When you use our contact form, we collect your name, email address, subject, and message content.

2.5 Technical Data

When you visit our website, certain technical data may be collected automatically by our web server and third-party services:

• IP address — collected by our web server for security and by third-party services when loading external resources
• Browser type and version
• Pages visited and timestamps

3. How We Use Your Data

We do not use your data for automated decision-making, profiling, or targeted advertising.

4. Legal Basis for Processing

Under GDPR Article 6, we process your personal data on the following legal bases:

• Consent (Art. 6(1)(a)) — when you create an account or submit a contact form, you consent to the processing described in this policy.
• Contract performance (Art. 6(1)(b)) — processing necessary to provide the services you have signed up for (e.g., maintaining your account, enabling the community platform).
• Legitimate interest (Art. 6(1)(f)) — website security, fraud prevention, and service improvement. Our legitimate interest is operating a safe and functional website.

You may withdraw your consent at any time by deleting your account or contacting us. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

5. Data Sharing & Third Parties

We do not sell, trade, or rent your personal data to third parties. However, the following third-party services may process data when you visit our website:

We may also share data when required by Swedish law or EU legislation, or when necessary to protect our rights.

6. International Data Transfers

Some of our third-party service providers are based in the United States. When personal data is transferred outside the EU/EEA, we ensure appropriate safeguards are in place:

• Google (Fonts, YouTube) — operates under the EU-U.S. Data Privacy Framework.
• DreamHost — our hosting provider processes data in the United States under standard contractual clauses.

Your account data (username, email, profile content) is stored in a MySQL database hosted by DreamHost.

7. Data Retention

8. Your Rights Under GDPR

As a data subject under GDPR, you have the following rights:

• Right of access (Art. 15) — request a copy of your personal data.
• Right to rectification (Art. 16) — correct inaccurate data. You can edit your profile directly, or contact us for other data.
• Right to erasure (Art. 17) — request deletion of your personal data ("right to be forgotten"). You can delete your account, or contact us.
• Right to data portability (Art. 20) — receive your data in a structured, machine-readable format.
• Right to restriction of processing (Art. 18) — request that we limit how your data is processed.
• Right to object (Art. 21) — object to processing based on legitimate interest.
• Right to withdraw consent — at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days.

If you believe we have not handled your request appropriately, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY):

9. Children's Privacy

Under Swedish law, children aged 13 and over may consent to data processing related to information society services. Our community platform is intended for users aged 13 and over. We do not knowingly collect personal data from children under 13.

If we learn that we have collected data from a child under 13, we will delete it promptly. If you believe a child under 13 has provided us with personal data, please contact us.

10. Data Security

We take reasonable technical and organisational measures to protect your personal data:

• Passwords are stored using bcrypt hashing — we never store or have access to your plain-text password.
• Authentication tokens are generated using cryptographically secure random bytes.
• HTTPS is enforced across the entire website to encrypt data in transit.
• Database access is restricted and uses parameterised queries to prevent SQL injection.
• Session management — expired sessions are automatically cleaned up.

No method of data storage or transmission is 100% secure. If you believe your account has been compromised, please contact us immediately.

11. Changes to This Policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. If we make significant changes, we will notify registered users via email or a prominent notice on our website.

12. Contact Us

If you have any questions about this privacy policy or how we handle your personal data, please get in touch: