Privacy Policy

1. Who we are

Flytta Sweden ("we", "us") is a small, independent project that helps people moving to Sweden track the steps required by Migrationsverket, Skatteverket, and Försäkringskassan. Flytta Sweden is not affiliated with, endorsed by, or acting on behalf of the Swedish government or any government agency.

This policy explains what personal data we collect through flytta-sweden.se, why we collect it, and the choices and rights you have.

2. Information we collect

If you don't create an account, we don't collect anything that identifies you personally. Your checklist progress is tied to a random identifier generated in your browser and stored in local storage — we never see who that identifier belongs to unless you sign up.

If you create an account (with email and password, or by continuing with Google), we collect:

• Email address and, optionally, your name.
• A securely hashed password (we never store your password in plain text).
• If you sign in with Google: the name, email address, and account identifier Google shares with us, and whether Google has verified that email address.
• Your checklist progress (which steps you've marked complete) and the situation you selected.
• Technical data needed to keep you signed in: a session cookie containing a random token. We store only a one-way hash of that token, never the token itself.

3. How we use your information

We use the information above only to run the service:

• To create and secure your account, and keep you signed in between visits.
• To save your checklist progress and show it back to you on any device you log in from.
• To send you account-related email — verifying your email address, and password reset links — via our email provider, Resend.
• To detect and prevent abuse of the service (for example, malformed or suspicious login attempts).

4. Legal basis for processing (EU/EEA users)

Where the GDPR applies, we process your account data because it's necessary to provide the service you've asked for (performance of a contract) — for example, keeping you signed in and saving your progress. We process technical/security data (like session tokens) on the basis of our legitimate interest in keeping the service secure and reliable.

5. Cookies and local storage

We use one essential cookie to keep you signed in after you log in — it's required for the service to work and isn't used for advertising or cross-site tracking. If you never create an account, we don't set this cookie at all.

For anonymous (logged-out) use, we store a random identifier in your browser's local storage so your checklist progress persists between visits on that device. This never leaves your device unless you sign up, at which point it's used once to merge that progress into your new account.

We use Vercel Analytics to understand overall traffic to the site. It's designed to be cookieless and does not build a profile of individual visitors.

6. Who we share data with

We don't sell your data, and we don't share it with advertisers. We use a small number of service providers to run Flytta Sweden, each of which processes data on our behalf:

• Google — if you choose to sign in with Google, to verify your identity.
• Resend — to deliver verification and password-reset emails.
• Neon — our database provider, which stores account and progress data.
• Vercel — our hosting provider, which also provides the cookieless analytics described above.

7. International data transfers

Some of the providers listed above may process data outside the European Economic Area, including in the United States. Where that happens, they do so under appropriate safeguards, such as the EU Standard Contractual Clauses, as required by their own data processing terms.

8. How long we keep your data

We keep your account data for as long as your account exists. Email verification and password-reset links expire automatically (within hours) and are deleted once used. If you ask us to delete your account, we'll delete your personal data within a reasonable time, except where we're required to keep records for legal or security reasons.

9. Your rights

If the GDPR or a similar law applies to you, you have the right to access, correct, delete, or export your personal data, and to object to or restrict certain processing. To exercise any of these rights, contact us using the details below — we'll do our best to respond within a reasonable time.

You also have the right to lodge a complaint with your local data protection supervisory authority.

10. Data security

Passwords are hashed (never stored in plain text), session tokens are only ever stored as a one-way hash, and connections to the site are encrypted. No method of transmission or storage is 100% secure, but we take reasonable, industry-standard steps to protect your data.

11. Children's privacy

Flytta Sweden is not directed at children, and we don't knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we'll delete it.

12. Changes to this policy

We may update this policy from time to time as the service changes. If we make material changes, we'll update the effective date at the top of this page.

13. Contact us

Questions about this policy, or requests relating to your personal data, can be sent to privacy@flytta-sweden.se. For anything else, reach us at contact@flytta-sweden.se.