Privacy Notice

Last updated 7 October 2026

In short

We store what we need to run sessions: your email, your display name, which sessions you sign up for, and your membership details.
Your display name is shown publicly on the list for the current session. Anyone visiting the site can see it. You choose the name, so a first name or nickname is fine.
We never sell your data or use it for advertising.
You can change your name, turn off emails or delete your account yourself, on your account page.

1. Who is responsible for your data

IF Academ (non-profit association, org. no. 846501-7161), Malmö, is the data controller for the personal data on this website. For anything about your data, email ifacadem@karen.mah.se.

2. What we collect and why

Your account: Your email address, the display name you choose, a user ID, and a password if you choose to set one (stored only in scrambled, hashed form). We use these to log you in, show your name on session lists and send you emails about sessions you are part of.
Session sign-ups: Which sessions you sign up for, when you signed up, whether you have a confirmed spot or are in the queue, and which part of a split session you chose. This is how we run the spots and the queue.
Membership registration: When you register as a member: your full name, whether you study at Malmö University, whether you are a member of Studentkåren Malmö, how you paid, and the name of whoever paid for you or took your cash payment. Also any notes you add, and whether the board approved or rejected your registration. We need this to check that you meet the membership requirements and have paid the fee. If you register through our Google Form instead, the same kind of information is stored in Google Forms.
Email notifications: Which sports you want emails from when a new session is posted. New accounts start with volleyball emails turned on. You can turn them off at any time, from your account page or with the unsubscribe link in each email.
Feedback: Feedback you send is anonymous: we store the text and its category, but not who sent it. Please don't include personal details in it. The thumbs up or down you can give a session you attended is anonymous too: we store the session and the vote, not who gave it. We only note on your sign-up that you answered or closed the question, so we don't ask again.
Technical data: Our hosting providers keep your IP address and browser details in logs for a short time. We count page visits and measure how fast pages load without cookies (Vercel Web Analytics and Speed Insights).

Why we're allowed to: we use your data because it's part of your membership. The exceptions are the public session list, new-session emails, feedback and technical logs. For those we rely on our legitimate interest in letting people see who's coming, telling you about sessions, improving the association and keeping the site secure. You can object to those (see section 5).

You need an email address to log in, and membership details to become a member. Without them you can't sign up for sessions. We make no automated decisions about you. The queue is simply first come, first served.

3. Who can see your data

Anyone visiting the site: the display names on the current session list for each sport, and whether each person has a spot or is in the queue. Earlier sessions are not shown.
Other members and activity leaders: the same session lists.
The board (admins): email addresses, display names, membership and payment details, and whether you have attended in the last 30 days.
Our service providers, who handle data only on our instructions: Supabase (database and login, data stored in Ireland), Vercel (website hosting), Brevo (email, France), and Google (only if you use our Google Form). The site's fonts, icons and code are served from our own website, so your browser doesn't contact any other service while you use it.

Supabase, Vercel and Google are US companies. Any access from outside the EU/EEA relies on the EU-US Data Privacy Framework or the EU's Standard Contractual Clauses. If you join our Facebook, Messenger or WhatsApp groups, Meta handles that data under its own privacy policy.

4. How long we keep it

Your account: until you delete it. Accounts with no login for 2 years are deleted automatically.
Attendance history: made anonymous (your name and user ID removed) 12 months after each session.
Membership and payment details: deleted 2 years after the end of the membership year they belong to.
Feedback: deleted after 2 years. Session ratings are anonymous counts and are kept.
Technical logs: kept by our providers for a short period, normally a few weeks at most.

If you delete your account, we remove your login, email address, display name, notification settings and membership details right away, and free your spot in any upcoming session. Sessions that have already happened keep an anonymous count, with your name removed.

5. Your rights

You have the right to:

see the data we hold about you and get a copy of it;
correct it. You can change your display name on your account page;
have it deleted. You can delete your account on your account page;
object to processing based on legitimate interest, for example to your name appearing on the public list, or to emails about new sessions;
restrict how we use it while a question is being looked into;
take it with you (data portability) in a machine-readable format.

Email ifacadem@karen.mah.se and we will answer within one month, free of charge. If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se.

6. Cookies and storage on your device

We keep a few small items in your browser. They are only used by our own website: none of them track you, show you ads or are shared with other companies, and no other website puts cookies on ours. Each one is needed for something you asked for (staying logged in) or remembers something you did on the site, so we don't ask for consent. Our visit statistics (Vercel Web Analytics and Speed Insights) work without cookies.

Cookies (only set when you log in):

ifa_rt: Keeps you logged in. Safari deletes a website's stored data after 7 days without a visit, and this cookie lets us restore your login when that happens. It holds a login token, can't be read by scripts on the page and is only sent to our own website. Kept for 180 days, and removed when you log out.
ifa_rt_set: Contains only the number 1. It tells the page that a saved login exists, so it doesn't look for one when there is none. Kept for 180 days, and removed when you log out.

Local storage (kept in your browser and read only by our own pages):

sb-…-auth-token: Your login session, created by our login service (Supabase). Removed when you log out.
ifa_rt_armed: A short fingerprint of your login token and when it was last saved in the ifa_rt cookie, so we don't save it again when nothing has changed. Removed when you log out.
last_seen_announcements_at: When you last opened Announcements while logged out, so we can show a red dot for new posts. When you're logged in, we keep this time with your account instead, and delete it with your account.
notifyModalOpened: Remembers that you've opened the email notification settings, so the button stops being highlighted.
ifa_admin_feedback_seen: Board members and activity leaders only: which feedback they have already seen on the admin page.

Items without an end date stay until you clear them. You can delete all of them at any time in your browser's settings. If you do, you will be logged out and the red dot for announcements may come back.

7. Changes

If we change how we handle your data, we will update this page and the date at the top. If a change matters to you, we will also tell you on the site or by email.