Privacy Policy

Last updated: 25 August 2026

This policy covers the Snackis / HAELGE website and the companion Android app, Vehicle app. If you only use the app, there is a shorter policy written specifically for it: Privacy policy for the app.

1. Who is responsible for your personal data?

This service (Snackis / HAELGE and the Vehicle app) is run by Christofer Hägg as a personal project. Christofer Hägg is the data controller for the personal data processed here, and can be reached at helge1337@live.com.

2. What data do we collect?

Account details: email address, nickname and password (stored hashed, never in plain text).
Profile picture: if you choose to upload one.
Posts and messages: text you write in the forum, the chat or in direct messages. Chat messages and to-do entries are stored encrypted in the database, but are shown in plain text to you and to the people you are communicating with.
To-do lists: text you save in your personal list. Stored encrypted, shown in plain text to you when signed in.
Family data: if you create or join a family group, the group name, membership and any owner role.
Vehicle data: vehicle name, VIN, registration number, service and inspection dates, mileage, part numbers, fluid types and any notes you choose to save.
Vehicle files: images and PDF documents you upload to a vehicle, such as inspection reports, service receipts or photos. You decide what they contain — bear in mind that a document like an inspection report may itself contain personal data such as a name and a registration number. Alongside the file we store its original filename, file type, size, a checksum and the time of upload. Location data (GPS coordinates) and other hidden metadata are stripped from images automatically on upload.
Points and tasks: points earned, tasks completed, purchases in the points shop and any achievements.
Notification data: the technical details needed to deliver a notification. For browser notifications this is an endpoint URL and encryption keys; for the Android app it is a Firebase registration token, an installation identifier generated by the app, the device model name and the platform.
Activity data: when the account was created, likes and similar interactions.

We do not collect location data, contacts, advertising identifiers or analytics about how you use the service. There are no ads and no third-party trackers.

3. Why do we process your data, and on what legal basis?

Account administration and sign-in — to create and manage your account. Legal basis: contract (GDPR art. 6(1)(b)).
Forum and chat — to show your posts and messages to other users. Messages are stored encrypted, but are decrypted and displayed to sender and recipient — the encryption protects the data in the database, not from the people the conversation is meant for. Legal basis: contract (art. 6(1)(b)).
Vehicle records and files — so you can keep track of service history, part numbers and documents. Files are private and visible only to the owner of the vehicle. Legal basis: contract (art. 6(1)(b)).
Vehicle reminders — to remind you before a service or inspection falls due. App and browser notifications require you to allow notifications; email reminders are switched on per vehicle. Legal basis: consent (art. 6(1)(a)), which you can withdraw at any time by turning the reminder off.
Family features — to share shopping lists, points and tasks with the family members you invite yourself. Legal basis: contract (art. 6(1)(b)).
Security and troubleshooting — to protect the service from abuse, for example by letting an administrator warn, ban or remove accounts that break the terms. Legal basis: legitimate interest (art. 6(1)(f)).

4. Deleting your account

You can delete your account yourself, at any time, without contacting us. There are two routes, and both remove the same data:

In the Android app: open Account from the menu, choose Delete account, enter your password and confirm.
On the website: go to Personal data and choose Delete.

Deleting the account permanently removes:

your account, email address, nickname and profile picture
every vehicle you saved, with all service records, inspection dates, part numbers and notes
all files you uploaded to your vehicles — both the database records and the files themselves on the server's disk
your forum posts, chat messages, direct messages and to-do entries
your points, purchases, achievements, tasks and family memberships
your notification registrations and every saved sign-in session on all your devices

The deletion is immediate and permanent. There is no grace period and no backup we can restore from, so export anything you want to keep before you delete the account — see section 8 on your right to data portability.

One exception: messages you sent to another user exist in that conversation for the recipient as well. Where the same message is also stored against the recipient's account it may remain visible to them.

5. How long do we keep your data?

Your data is kept for as long as your account is active. When you delete your account the data is removed as described in section 4. Accounts that never confirm their email address are removed automatically after three days. Inactive accounts may be removed after a long period of inactivity. Notification registrations for devices that have not been seen for six months are cleaned up automatically.

6. Is your data shared with anyone?

We do not sell your personal data and we do not share it for commercial purposes. The following technical dependencies exist:

Google Firebase Cloud Messaging — used to deliver notifications to the Android app. The notification text and your device's registration token pass through Google's servers. Google acts as a processor for this delivery, and Google's own privacy policy applies to it.
Browser push services — if you enable notifications on the website, your subscription data passes through your browser's built-in push service (for example Google FCM for Chrome or Mozilla Push for Firefox).
Email — reminder and account emails are sent through Gmail's SMTP service.
Server and database — the service runs on a self-hosted server in Sweden, with a MySQL database on the same machine.
Uploaded files — stored on the service's own server and never passed to any third party. If virus scanning is enabled it runs locally on the same machine, so the files never leave the server.

Google may process notification delivery data outside the EU/EEA. Such transfers rely on the EU-US Data Privacy Framework and the standard contractual clauses in Google's terms. No other data is transferred outside the EU/EEA.

7. Cookies and similar technology

The website uses strictly necessary cookies only — no tracking or advertising cookies:

Authentication cookie (.AspNetCore.Identity.Application) — keeps you signed in during your session.
Antiforgery token — protects against cross-site request forgery, and is technically required for forms to work safely.

Because no non-essential cookies are used, no cookie consent banner is required. The service worker (for offline and PWA support) stores technical data in the browser cache so the app can run — this is functionally necessary.

The Android app does not use cookies. It stores your sign-in tokens in the operating system's encrypted storage, and a local copy of your vehicles so the app works without a connection. Both are removed when you sign out or delete your account.

8. Your rights

Under the GDPR and the Swedish Data Protection Act (2018:218) you have the right to:

Access your data (art. 15) — download it from Personal data.
Rectify inaccurate data (art. 16) — edit it in your profile, or contact us for anything you cannot change yourself.
Erasure (art. 17) — delete your account from the app or the website, as described in section 4.
Restrict processing (art. 18) — contact us.
Data portability (art. 20) — export your data from Personal data. Uploaded files are not part of the export file, but each file can be downloaded individually from the vehicle it belongs to, under its original filename.
Object (art. 21) — to processing based on legitimate interest.
Withdraw consent (art. 7(3)) — turn notifications off in your account settings, or email reminders off on the vehicle. Withdrawing consent does not affect processing that already took place.

We answer requests within one month, as required by art. 12(3).

9. How is your data protected?

Passwords are stored hashed and salted, never in plain text.
All traffic between your device and the server runs over HTTPS.
Chat messages and to-do entries are stored encrypted in the database.
Uploaded files are not publicly accessible. They live outside the site's public folders, cannot be fetched by URL, and every download requires you to be signed in and to own the vehicle the file belongs to.
Filenames cannot be guessed. Every file is given a random name on the server; your original filename is stored separately and used only for display and download.
Metadata is stripped. GPS position and other hidden information is removed from images before they are saved.
File types are checked by content, not by file extension, and only images and PDFs are accepted.

No technical measure is complete protection. Avoid uploading documents containing sensitive personal data that you do not actually need in the service.

10. Children

The service is not directed at children under 13. If you are under 13, please do not create an account. If you believe a child under 13 has registered, contact us and the account will be removed.

11. Contact and complaints

For any question about how your personal data is handled, email helge1337@live.com.

You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), the supervisory authority for data protection in Sweden.

This privacy policy applies to Snackis / HAELGE and the Vehicle app, and may be updated. Registered users are notified of material changes by email.