Privacy policy

1. Who I am

Stackholm (https://stackholm.dev) is operated by Alexandre Du Lorier as an individual, who is the data controller for the personal data described in this policy. Contact: adulorier@gmail.com.

2. Personal data I collect

If you only read pages: aggregate page-view counts, with no cookie and no per-visitor identifier. My host processes standard server request logs, including IP address, to serve the site and defend it from abuse.

If you answer the developer questionnaire: the company the answers are about, the version of the question set, your chosen options, any free text you type, and a random identifier generated in your own browser so that answering again replaces your previous answer instead of counting twice.

If you report a problem:what you write, which kind of problem you picked, the page you were on, the company the page was about, and your browser’s user-agent string, which is what tells me whether a broken layout is a phone or a desktop. The email field is optional and blank by default; fill it in only if you want an answer.

If you sign in to vote on what gets built next: the account identifier Google gives me, your email address, your name and the web address of your Google profile photo, plus which of the 3 options you picked, when you first signed in, when you last did, and how many times. Google tells me those 4 things and nothing else: not your contacts, not your files, and nothing about your Google account beyond them. The vote is stored against the identifier so that one person holds 1 vote and can change it. Your photo is shown back to you while you are signed in, which means your browser fetches it from Google at that moment; I never copy the image itself.

I ask for no name, job title or employer, and for an email address only where you choose to give one so that I can reply or where you sign in to vote. Signing in is optional and exists for 1 reason: casting that vote. Reading the site never asks who you are, and no company, role or filter is behind it.

3. Purposes and legal bases

Questionnaire answers are processed on the basis of consent, given by choosing to submit them, to publish aggregate developer experience about named employers. Problem reports are processed on the same basis, given by choosing to send one, to correct the data and fix the site, and to write back where you asked for an answer. A vote is processed on the same basis, given by signing in and casting it, to decide what is built next and to tell you when the option you picked is live. The name and photo are processed on the same consent, and only so that the site can show you which account you are signed in with. Analytics and server logs are processed on the basis of legitimate interest, to keep the site available and understand which pages are used. Information about companies is published on the basis of legitimate interest: it is already public, is reported unchanged from its source, and does not describe individuals.

4. Cookies

This site shows no cookie banner, because it sets no cookie you have not asked for. Analytics are cookieless. Reading the site sets nothing at all. Signing in to vote sets 2 cookies, both strictly necessary for that: a short one that lasts 10 minutes and exists to check the sign in came back from where it left, and one that keeps you signed in for 180 days. Signing out deletes the second one. Your filter selections and the questionnaire token are stored in your own browser and never leave it except as described above; clearing this site’s data removes them permanently.

5. Sharing and processors

I do not sell, rent or share personal data. Two processors act on my behalf: Vercel, which hosts the site and provides the cookieless analytics, and Turso, which stores questionnaire answers, problem reports, sign ins and votes. If you choose to sign in to vote, that sign in runs through Firebase Authentication, a Google service, which acts as a third processor and keeps its own record of the account you signed in with. Google itself acts as its own controller for the sign in and will know you signed in here; I send it nothing about you and it sends me your account identifier, your email address, your name and the address of your profile photo. While you are signed in, your browser loads that photo from Google directly. The Firebase code that does this is loaded only when you press the sign in button, so a reader who never signs in never fetches it. Free text is never published automatically: answers shown on a company page are the fixed options only, and nothing you write in a problem report is published.

6. International transfers

My processors may process data outside the EU/EEA, in which case they do so under the European Commission’s standard contractual clauses or an adequacy decision.

7. Retention

Questionnaire answers are kept until replaced by a newer answer from the same browser, until the question set they answer is retired, or until you ask for their removal. Analytics keep aggregate counts; the hash that separates one visitor from another is discarded after 24 hours. Problem reports are kept until the problem is fixed and for 12 months after that, or until you ask for their removal. A vote, and the sign in behind it, are kept until the option it picked is built or dropped, or until you ask for their removal. Server logs are held by my host on its own schedule.

8. Your rights

Under the GDPR you may request access to your personal data, rectification, erasure, restriction, portability, and you may object to processing or withdraw consent at any time. To exercise any of these, email adulorier@gmail.com.

Because I deliberately collect nothing that identifies you, I cannot locate your data from your name or email address, with 1 exception: a sign in and the vote behind it, which are held against the email address you signed in with and which I will delete in full on request from that address. The reliable route to erasure of an answer is to answer again from the same browser, which replaces the earlier answer, or to email me the company and rough date, and I will remove matching answers.

9. Complaints

If you believe I have handled your personal data unlawfully, you may lodge a complaint with Integritetsskyddsmyndigheten (IMY), the Swedish data protection authority.

10. Information about companies

Everything published about a company comes from public sources: filings from Bolagsverket, the company’s own website, and its own job ads. Every figure is dated and its source named, and I do not publish information about individual employees. If something is wrong, email adulorier@gmail.com and I will correct it. I do not remove a correctly reported filed figure, because it is a public record.

11. Changes to this policy

I may update this policy as the site changes. The date at the top reflects the most recent revision.