Alibit

Privacy policy

Last updated 2026-09-25

1. Data controller

The data controller is Alex Weström, Svenljunga. Questions about your data go to [email protected].

2. What data we store

We only store what the game needs. Nothing is collected in the background, and we never sell or pass on data for marketing.

Account: username, password (stored as a hash with a unique salt per account — never in plain text, and it cannot be read back) and email address if you choose to give one. The email address is optional and is not used for mailings.
Profile: name, title, department, service number and profile picture if you fill them in. The picture is stored in the database with the account.
The game: which rooms you take part in, your role, your answers in interviews, what you have marked on the board, which cases you have solved, your friends and invitations.
Messages: text you write in the room chat and in private messages to other players. Other players can read what you write there — do not write anything there you do not want to share.
Payment: tier, the date it is paid up to, and your customer number at Stripe. Card details never reach us — they are entered on Stripe's own page and we do not see them.
Technical: when the account was created, and a login token so that you stay logged in between page loads.

3. Why, and on what legal basis

Performing the contract — the account, the game and the payment only work if we store the data (Article 6(1)(b)).
Legitimate interest — closing accounts that disturb others or abuse the service, and keeping the service secure (Article 6(1)(f)).
Legal obligation — bookkeeping of payments under the Swedish Bookkeeping Act (Article 6(1)(c)).

4. How long we keep it

Account details, profile, game data and messages are kept for as long as the account exists. When you ask us to delete the account we remove them within 30 days, except what we are required by law to keep (payment records in the bookkeeping, kept for seven years). Messages in a room may remain in other players' saved games until they are cleared.

5. Who can see the data

We use two sub-processors, both of which process data on our behalf under contract and only for the purposes named above:

Stripe — payments, customer records and receipts. Stripe is a data processor and handles card details in its own name under its own rules.
Cloudflare — operations, traffic and protection against overload. All traffic to the site passes through Cloudflare's network.

In addition, some data is shown to other players in the game: your username, your role, your profile picture if you uploaded one, and what you write in the room chat. That is part of playing together.

We use no analytics tools, no tracking pixels and no advertising, and the data is not passed on to anyone beyond what is stated here.

6. Cookies and storage in your browser

The site sets no cookies. Your login is kept with a token stored in the browser's local storage, and it is only needed so that you stay logged in. No such storage is used to follow you between websites or to build a profile of you.

7. Your rights

You can find out what data we hold about you, and get a copy of it.
You can have incorrect data corrected.
You can have your account and data deleted (see point 4 for what we are required to keep).
You can object to processing based on legitimate interest.

Get in touch at [email protected] and we will answer within a month. If you think we are doing something wrong you can complain to the Swedish Authority for Privacy Protection (IMY).

8. Where the data is

The service runs on a server we operate ourselves, and the data is stored in a database in Sweden. Traffic passes through Cloudflare's network and payments are handled by Stripe, both of which may process data within the EU/EEA.

9. Changes

If we make a material change to this policy it is announced on the start page, and you can always see the date of the last change at the top.

See also the terms — they cover prices, subscriptions and the right to cancel.