Privacy policy

1. Who I am

Stackholm (https://stackholm.dev) is operated by Alexandre Du Lorier as an individual, who is the data controller for the personal data described in this policy. Contact: alex@stackholm.dev.

2. Personal data I collect

If you only read pages: aggregate page-view counts, with no cookie and no per-visitor identifier. My host processes standard server request logs, including IP address, to serve the site and defend it from abuse.

If you answer the developer questionnaire: the company the answers are about, the version of the question set, your chosen options, any free text you type, and a random identifier generated in your own browser so that answering again replaces your previous answer instead of counting twice.

If you share feedback:what you write, which kind of problem you picked, the page you were on and the company the page was about. Your browser’s user-agent string is kept only when you say something is broken, since it tells me whether a broken layout is a phone or a desktop. The email field is optional and blank by default; fill it in only if you want an answer.

If you sign in to vote on what gets built next: the account identifier Google gives me, your email address, your name and the web address of your Google profile photo, plus which of the 3 options you picked, when you first signed in, when you last did, and how many times. Google tells me those 4 things and nothing else: not your contacts, not your files, and nothing about your Google account beyond them. The vote is stored against the identifier so that one person holds 1 vote and can change it. Your photo is shown back to you while you are signed in, which means your browser fetches it from Google at that moment; I never copy the image itself.

If you leave your email on the about page or the dream pass page: the address, when you left it and which of the 2 pages, nothing else.

I ask for no name, job title or employer, and for an email address only where you choose to give one so that I can reply, where you sign in to vote, where you leave it to hear about the next thing I build, or where you leave it to hear when the dream pass opens. Signing in is optional and exists for 1 reason: casting that vote. Reading the site never asks who you are, and no company, role or filter is behind it.

3. Purposes and legal bases

Questionnaire answers are processed on the basis of consent, given by choosing to submit them, to publish aggregate developer experience about named employers. Problem reports are processed on the same basis, given by choosing to send one, to correct the data and fix the site, and to write back where you asked for an answer. A vote is processed on the same basis, given by signing in and casting it, to decide what is built next and to tell you when the option you picked is live. The name and photo are processed on the same consent, and only so that the site can show you which account you are signed in with. An email left on the about page is processed on the same basis, given by typing it in, for 1 purpose: to write to you when I build the next thing. An email left on the dream pass page is processed on the same basis, for 1 purpose: to write to you once when it opens. Analytics and server logs are processed on the basis of legitimate interest, to keep the site available and understand which pages are used, for how long, which job ads get opened, what people search for, which filters they pick, and whether a visit shows a sign of a person (a scroll, a pointer move or a key press), which is how automated traffic is told apart. Information about companies is published on the basis of legitimate interest: it is already public, is reported unchanged from its source, and does not describe individuals.

4. Cookies

This site shows no cookie banner, because it sets no cookie you have not asked for. Analytics are cookieless. Reading the site sets nothing at all. Choosing a language with the link in the menu sets 1 cookie named lang, which only remembers that choice for 1 year. Signing in to vote sets 2 cookies, both strictly necessary for that: a short one that lasts 10 minutes and exists to check the sign in came back from where it left, and one that keeps you signed in for 180 days. Signing out deletes the second one. Your filter selections and the questionnaire token are stored in your own browser and never leave it except as described above; clearing this site’s data removes them permanently.

5. Sharing and processors

I do not sell, rent or share personal data. Two processors act on my behalf: Vercel, which hosts the site and provides the cookieless analytics, and Turso, which stores questionnaire answers, problem reports, sign ins, votes and the emails you leave. If you choose to sign in to vote, that sign in runs through Firebase Authentication, a Google service, which acts as a third processor and keeps its own record of the account you signed in with. Google itself acts as its own controller for the sign in and will know you signed in here; I send it nothing about you and it sends me your account identifier, your email address, your name and the address of your profile photo. While you are signed in, your browser loads that photo from Google directly. The Firebase code that does this is loaded only when you press the sign in button, so a reader who never signs in never fetches it. Free text is never published automatically: answers shown on a company page are the fixed options only, and nothing you write in a problem report is published.

6. International transfers

My processors may process data outside the EU/EEA, in which case they do so under the European Commission’s standard contractual clauses or an adequacy decision.

7. Retention

Questionnaire answers are kept until replaced by a newer answer from the same browser, until the question set they answer is retired, or until you ask for their removal. Analytics keep aggregate counts; the hash that separates one visitor from another is discarded after 24 hours. Problem reports are kept until the problem is fixed and for 12 months after that, or until you ask for their removal. A vote, and the sign in behind it, are kept until the option it picked is built or dropped, or until you ask for their removal. An email left on the about page is kept until I have written about the next thing, or until you ask for its removal. An email left on the dream pass page is kept until I have written that it is open, or until you ask for its removal. Server logs are held by my host on its own schedule.

8. Your rights

Under the GDPR you may request access to your personal data, rectification, erasure, restriction, portability, and you may object to processing or withdraw consent at any time. To exercise any of these, email alex@stackholm.dev.

Because I deliberately collect nothing that identifies you, I cannot locate your data from your name or email address, with 1 exception: a sign in and the vote behind it, which are held against the email address you signed in with and which I will delete in full on request from that address. The same goes for an email left on the about or dream pass page: write from it and it is gone. The reliable route to erasure of an answer is to answer again from the same browser, which replaces the earlier answer, or to email me the company and rough date, and I will remove matching answers.

9. Complaints

If you believe I have handled your personal data unlawfully, you may lodge a complaint with Integritetsskyddsmyndigheten (IMY), the Swedish data protection authority.

10. Information about companies

Everything published about a company comes from public sources: filings from Bolagsverket, the company’s own website, and its own job ads. Every figure is dated and its source named, and I do not publish information about individual employees. If something is wrong, email alex@stackholm.dev and I will correct it. I do not remove a correctly reported filed figure, because it is a public record.

11. Changes to this policy

I may update this policy as the site changes. The date at the top reflects the most recent revision.