Privacy Policy

1. Controller and contact

Controller: Lindforge, Sweden. Contact: rickard@lindforge.dev.

We have not appointed a Data Protection Officer, as we are not required to. The contact address above reaches the person responsible for data protection.

2. What we collect and why

Account data — your email address, plus the display name and avatar your sign-in provider supplies. Purpose: to create and secure your account. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Retention: until you delete your account.

Content you submit — links you pin, tags you add, comments you write. Purpose: to operate the board. Legal basis: contract (Art. 6(1)(b)). Retention: until you delete it or your account.

Activity records — which posts you marked liked, shared, saved, opened or commented on. Purpose: this is the core feature; the board exists to show you this history. Legal basis: contract (Art. 6(1)(b)). Retention: until you delete your account.

Connected accounts (optional) — if you link TikTok, Instagram, Facebook or YouTube, we store the access token that platform issues, your account ID and your public username there. Purpose: to show which account is linked and to import your own posts when you ask. Legal basis: consent (Art. 6(1)(a)), withdrawable at any time by disconnecting. Retention: deleted the moment you disconnect.

Moderation records — reports you file or that concern your content, and staff decisions. Purpose: to keep the board lawful and usable, and to comply with our obligations as a hosting service. Legal basis: legitimate interests and legal obligation (Art. 6(1)(f) and (c)). Retention: up to 12 months after resolution.

Technical logs — IP address and request metadata generated by our hosting provider. Purpose: security, abuse prevention and debugging. Legal basis: legitimate interests (Art. 6(1)(f)). Retention: as configured by our host, typically no more than 30 days.

3. Cookies and third-party embeds

We set one strictly necessary cookie for your sign-in session, and store your cookie choice locally in your browser. Neither requires consent.

We run no advertising, analytics or tracking scripts of any kind.

Posts play through Instagram, TikTok and YouTube's own embed players, which set their cookies on your device once loaded. We do not load any of them until you allow it, and the board works fully without them — declining shows every post as a thumbnail and a link. You can change your choice at any time from the footer.

4. What we never do

We do not sell, rent or share personal data for advertising, and we do not build advertising or behavioural profiles.

We do not collect your contacts, precise location, advertising identifiers, or your private messages on any platform.

We never post, like, comment, follow or message on your behalf without an action you take in the interface. The single exception is the YouTube like button, which performs exactly the like you clicked.

5. Processors and recipients

Supabase — database and authentication. Netlify — hosting and delivery. Both act as processors under written agreements and process data only on our instructions.

Platform APIs (Google, Meta, TikTok) receive requests only for actions you initiate on a connected account.

We otherwise disclose data only where legally required, and we will tell you unless the law forbids it.

6. International transfers

Our processors may process data outside the EEA, including in the United States. Where they do, transfers rely on the European Commission's Standard Contractual Clauses, and on the EU-US Data Privacy Framework where the recipient is certified. You can request a copy of the safeguards from the contact address above.

7. Your rights

You have the right to access your data, correct it, erase it, restrict or object to processing, and receive it in a portable format. Where processing rests on consent, you may withdraw it at any time without affecting prior processing.

Email rickard@lindforge.dev and we will respond within one month. There is no charge for a reasonable request.

You also have the right to complain to a supervisory authority. In Sweden this is Integritetsskyddsmyndigheten (IMY), imy.se. You may instead complain to the authority where you live or work.

8. Deleting your account

Disconnecting a platform immediately deletes the stored token and everything imported through it.

To delete the whole account, follow the steps on our data deletion page. We remove your profile, connections, activity records and comments within 30 days.

Posts you pinned may remain on the board with your name removed, because other people's activity records reference them. Say so in your request if you want those removed too, and we will.

9. Security

Access is enforced at the database level by row-level security policies, not only in the interface. Traffic is encrypted in transit. We never see or store your password — sign-in is handled by our authentication provider.

If a breach is likely to put your rights at risk, we will notify the supervisory authority within 72 hours and inform you without undue delay.

10. Children

This service is not directed at children under 13, or under the age set by your national law where that is higher (up to 16 in parts of the EU). We do not knowingly collect their data; contact us and we will delete it.

11. Automated decision-making

A post is hidden from public view automatically once three separate users report it. This is a temporary measure pending human review, it produces no legal effect for you, and a moderator makes the final decision. You may contest any outcome at the contact address above.

12. Changes

Material changes are announced on the board before they take effect, and the effective date at the top of this page is updated.