Privacy Policy
How Blyg AB handles personal data — written in plain language and in line with the EU General Data Protection Regulation (GDPR).
We are a small company and we try to collect as little personal data as possible. This policy explains what we do collect, why, on what legal basis, how long we keep it and what rights you have.
1. Who is responsible for your data
The data controller is:
Blyg AB
Organisation number: 559528-1097
Relävägen 24
176 74 Järfälla, Sweden
E-mail: dev@blyg.se
Phone: +46 76 301 30 11
Because of the size and nature of our business we are not required to appoint a Data Protection Officer. All privacy questions are handled directly by the company’s management via the contact details above.
2. Scope of this policy
This policy applies to:
- our website blyg.se;
- mobile apps published by Blyg AB on the Apple App Store and Google Play (“our apps”), unless an app has its own privacy notice, in which case that notice supplements this policy;
- browser extensions published by Blyg AB, such as the Snack YubiKey extension for Chrome and Firefox;
- contact with us by e-mail or phone, including app support; and
- our business relationships with clients, suppliers and partners.
When we build apps for clients, the client is normally the controller for personal data processed in their app, and their own privacy policy applies. Where we process personal data on a client’s behalf, we do so as a processor under a data processing agreement (GDPR Article 28).
3. What we process and why
| Purpose | Personal data | Legal basis (GDPR) |
|---|---|---|
| Delivering the website securely | IP address, browser and device type, requested page, date and time (technical server logs) | Legitimate interest in operating a secure and working website — Art. 6(1)(f) |
| Answering enquiries and providing app support | Name, e-mail address, phone number, the content of your message, and any device or app details you choose to share | Legitimate interest in answering you — Art. 6(1)(f); or performing a contract with you — Art. 6(1)(b) |
| Preparing and performing client agreements | Name, job title, company, e-mail address and phone number of contact persons; correspondence | Contract — Art. 6(1)(b), or legitimate interest where the contract is with your employer — Art. 6(1)(f) |
| Invoicing, bookkeeping and tax | Name, company, billing address, invoices and payment details | Legal obligation under the Swedish Bookkeeping Act (bokföringslagen) and tax law — Art. 6(1)(c) |
| Establishing, exercising or defending legal claims | Data relevant to the specific matter | Legitimate interest — Art. 6(1)(f) |
We do not sell personal data, we do not use it for advertising, and we do not make decisions about you based solely on automated processing, including profiling (GDPR Article 22).
Where we rely on legitimate interest, we have balanced our interest against your rights and freedoms. You can object to such processing at any time (see Your rights).
4. Our apps
Our apps are designed to work without accounts and without collecting personal data wherever possible. Data you create in an app is, by default, stored only on your device and, if you have enabled it, in your own iCloud or Google account backup, which we cannot access.
- No tracking or advertising. Our own apps do not contain advertising SDKs and do not track you across other companies’ apps or websites.
- Purchases. In-app purchases and subscriptions are processed by Apple or Google. We never receive your card details. We may receive transaction information (such as product, date and country) that does not directly identify you.
- Crash reports and statistics. If you have chosen to share analytics with app developers in your device settings, Apple or Google may provide us with aggregated usage statistics and anonymised crash reports. These help us fix bugs and do not identify you.
- Permissions. An app only asks for device permissions (for example the camera or notifications) when a feature needs them, and you can withdraw them at any time in your device settings.
If a specific app processes more than this — for example if it offers an account or cloud sync run by us — that app’s store listing (Apple’s “App Privacy” details and Google Play’s “Data safety” section) and an app-specific section of this policy will describe exactly what is processed, why and for how long.
5. The Snack YubiKey browser extension
The Snack YubiKey extension (for Chrome and other Chromium browsers, and for Firefox) has a single purpose: it lets the Snack web app on a Snack server you choose sign you in and decrypt your messages with the certificate on your own YubiKey (its PIV smart card), so the private key never leaves the card and your PIN is never typed into a web page. It works together with the Snack card helper, a small program you install on your computer that talks to the card.
Blyg AB does not collect, receive or store any data through the extension. The extension has no analytics, no advertising and no remote code, and it makes no network connections of its own. Everything it handles stays on your computer:
| Data | What it is used for | Where it stays, and for how long |
|---|---|---|
| Your YubiKey PIN | Unlocking the card when a Snack site you allowed asks for a signature or a key | Typed only in the extension’s own window and passed straight to the card helper on your computer; never stored, never sent to a website or to us |
| The certificates on your card (public information: your name or e-mail address as the certificate states it) | Letting the Snack site you allowed know which certificate to use | Read from the card when needed and given only to sites you allowed; not stored by the extension |
| Signatures and key agreements made by the card | Signing you in and decrypting your messages in Snack | Given only to the site you allowed, which asked for them |
| The list of Snack sites you allowed, and when | Asking you only once per site; you can remove a site in the extension’s menu | In your browser’s extension storage on your computer, until you remove it or uninstall the extension |
| Your setting for how long the card stays unlocked | Locking the card after that much time without use | In your browser’s extension storage on your computer |
| Recent requests (which site asked for what, and when) and per-site counts | Showing you in the extension’s menu what the card has been used for | In memory only; gone when you close the browser |
How the extension uses its browser permissions:
- Access to websites (https pages): Snack servers are run by many organisations at their own addresses, so the extension’s small content script is present on https pages. It only passes on messages that a page sends to it, and does nothing on a site until you have allowed that site in the extension’s own window. It does not read, collect or change the content of pages.
- Native messaging: to talk to the Snack card helper on your computer, which reaches the card.
- Storage: for the list of allowed sites and your unlock setting, as described above. An administrator of a managed computer may also provide a list of allowed sites.
- Idle: to lock the card as soon as your screen locks or your computer goes idle.
The Snack server you sign in to is run by whoever operates it (your organisation, or Blyg AB for its own servers), and your messages there are handled under that operator’s privacy policy. The extension itself sends nothing to Blyg AB.
The use of information received from Google APIs and browser permissions by the extension adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements: the data described here is used only to provide the extension’s single purpose, is never sold or transferred to third parties, and is never used for advertising, creditworthiness or lending.
To remove everything the extension stores, uninstall it, or remove the allowed sites in its menu.
6. Cookies and tracking
Our website does not use cookies, analytics, tracking pixels or third-party embeds, and all fonts and images are served from our own domain. Because nothing is stored on or read from your device, no cookie consent is required. If this changes, we will update this policy and ask for your consent where the law requires it.
7. Who we share data with
We only share personal data when necessary, with:
- Service providers (processors) who help us run the business — for example web hosting, e-mail and accounting services. They may only process the data on our instructions and under a data processing agreement.
- Apple and Google, who distribute our apps and process payments as independent controllers under their own privacy policies.
- Our accountant and auditors, to meet our legal obligations.
- Public authorities, such as the Swedish Tax Agency (Skatteverket), when we are required to by law.
You can ask us for a current list of the service providers that process your data.
8. Transfers outside the EU/EEA
We aim to keep personal data within the EU/EEA. If a service provider processes data outside the EU/EEA, we make sure the transfer is lawful under Chapter V of the GDPR — for example because the European Commission has issued an adequacy decision for the country (including the EU–U.S. Data Privacy Framework for certified companies) or because the provider has signed the Commission’s Standard Contractual Clauses. You can contact us for a copy of the relevant safeguards.
9. How long we keep data
| Data | Retention |
|---|---|
| Website server logs | Normally no more than 30 days, unless needed to investigate a security incident |
| Enquiries and support messages | Up to 12 months after the matter is closed |
| Client and supplier contact details | For the duration of the business relationship and up to 24 months afterwards |
| Accounting records (invoices, contracts relevant to bookkeeping) | 7 years after the end of the calendar year in which the financial year ended, as required by the Swedish Bookkeeping Act |
When data is no longer needed, we delete or anonymise it.
10. Security
We protect personal data with appropriate technical and organisational measures, including encrypted connections (HTTPS/TLS), encrypted devices, multi-factor authentication on our accounts, least-privilege access and regular software updates. If a personal data breach occurs that is likely to put your rights at risk, we will notify the Swedish Authority for Privacy Protection within 72 hours of discovering it and, where it is likely to result in a high risk to you, tell you without undue delay.
11. Your rights
Under the GDPR you have the right to:
- Access — get confirmation of whether we process your data and a copy of it (Art. 15);
- Rectification — have incorrect data corrected (Art. 16);
- Erasure — have your data deleted, unless we must keep it by law (Art. 17);
- Restriction — have processing limited in certain situations (Art. 18);
- Data portability — receive data you provided to us in a machine-readable format (Art. 20);
- Object — object to processing based on legitimate interest (Art. 21);
- Withdraw consent — at any time, where processing is based on consent, without affecting earlier processing (Art. 7(3)).
To use your rights, e-mail dev@blyg.se. It is free of charge. We will reply within one month; for complex requests this may be extended by two further months, and we will tell you if so. We may need to verify your identity before handling the request.
12. Complaints
If you are unhappy with how we handle your data, please contact us first — we want to put it right. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live or work. In Sweden this is:
Integritetsskyddsmyndigheten (IMY) — Swedish Authority for Privacy Protection
Box 8114, 104 20 Stockholm, Sweden
www.imy.se · imy@imy.se
13. Children
Our website and services are not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has given us personal data, please contact us and we will delete it. Any app intended for children will comply with the applicable rules, including Apple’s Kids category and Google Play’s Families policies.
14. Changes to this policy
We may update this policy when our services or the law change. The date at the top shows when it was last updated. If we make significant changes, we will make that clear on this page and, where appropriate, in our apps.
15. Contact us
Blyg AB, Relävägen 24, 176 74 Järfälla, Sweden
E-mail: dev@blyg.se · Phone: +46 76 301 30 11