Privacy Policy
What we process, why we process it, and the rights you have. Written to be read.
Last updated: 11 July 2026
JustDoable is the data controller for this website. If you have any question about this policy or your data, reach us through the contact page — we answer personally.
When you create an account we process your name, email address, and a securely hashed password, plus session data that keeps you signed in. We process this to provide the service you signed up for.
Experts additionally have a public profile: display name, bio, crafts, price, profile photo, and links to their own channels. Profiles are public by design — that is what they are for. Profile photos are stored with our hosting provider.
If you write to us through the contact form, we keep your message and email address so we can reply.
If you express interest in becoming an expert, we store your email, craft, message, and the time you gave consent — only so we can get back to you about it. This is based on your explicit consent, which you can withdraw at any time by asking us to delete the signup.
We send account email — verification, password reset, and similar — through Brevo, our email processor. We do not send marketing email without asking you separately first.
To protect the service against abuse we count requests per IP address in short-lived rate-limit records that expire and are cleaned up automatically (rolling windows of about an hour). Administrative actions on the platform are recorded in an internal audit log.
We use Vercel Web Analytics — a cookieless service that gives us aggregate page statistics. It does not track you across websites and does not store identifiers on your device.
We only set cookies that are needed: your sign-in session and your language preference. No advertising cookies, no third-party tracking.
The service runs on Vercel and stores data in a Neon PostgreSQL database located in the United States (AWS us-east-1). For transfers outside the EU/EEA we rely on the EU Standard Contractual Clauses and the providers' equivalent safeguards.
Account data is kept while your account exists. Contact messages and interest signups are kept as long as they are needed for follow-up. You can ask us to delete your data at any time.
Under the GDPR you can request access to your data, have it corrected or deleted, restrict or object to processing, and receive a copy in a portable format. Contact us and we will help.
You also have the right to lodge a complaint with IMY, the Swedish Authority for Privacy Protection (imy.se).