Privacy policy

Who we are

Tech Debt Weekly is published by Literally AS (org.nr: 835 004 112, Oslo, Norway), the data controller for the personal data described here. Contact us via the contact form.

What we collect, why, and on what legal basis

Newsletter subscription. When you subscribe, your email address and the version of the consent wording you were shown are passed to Buttondown, the service that delivers our newsletter. Buttondown first sends you a confirmation email — you are only subscribed once you confirm. Legal basis: your consent (GDPR Art. 6(1)(a)). You can withdraw at any time via the unsubscribe link in every email; Buttondown then stops sending to your address and keeps the opt-out on record.

Contact form. When you write to us we store your name, email address, and message so we can answer you. Legal basis: our legitimate interest in responding to messages sent to us, and pre-contractual steps where relevant (Art. 6(1)(b)/(f)). Checking the box on the form acknowledges this policy; it is not consent.

Reader accounts.If you sign in, we hold your email address, the display name and profile picture your sign-in provider gives us (or the name you set), the provider's identifier for your account, your session tokens, and what you do with the account: your votes, bookmarks, and comments. We use this to run the account and the features it unlocks. Legal basis: the terms of use you accept when you create the account (Art. 6(1)(b)). Comments are public and shown with your display name until you delete them or your account. We do not store IP addresses, browser details, or login history with your account, and we keep no provider access tokens after sign-in. Creating an account is not a newsletter subscription; that stays a separate, confirmed choice.

Processors and identity providers

Data is processed on our behalf by: Buttondown (newsletter delivery, double-opt-in confirmation, and subscription state, under its data processing agreement), Neon (database hosting), Vercel (website hosting and request logs), Resend (email notifications to us, and sign-in links to you), and Slack (contact-form notifications to our team channel).

GitHub and Googleact as independent controllers when you choose to sign in through them; their own policies govern that step. They also receive a request, carrying your IP address and browser identity but no referrer, whenever a page shows a commenter's profile picture, because those pictures are loaded from their servers. No other third-party request happens before you act: if you play an embedded video, YouTube's player loads only after you click play, in privacy-enhanced mode.

Retention

• Contact submissions: name, email, and message are redacted after 180 days.
• Newsletter subscriptions: held by Buttondown while your subscription is active, and as an opt-out record after you unsubscribe so no further email is sent. An erasure request removes the record entirely.
• Reader accounts: until you delete the account. Sessions end after 7 days without use; sign-in links expire after 10 minutes; the hashed record we keep to limit sign-in emails is deleted after 24 hours. Comments stay until you or we delete them; a deleted comment with replies is shown as a placeholder without its text. View counts hold no personal data.

Your rights

You can request access to, correction of, or erasure of your personal data, and you can object to or ask us to restrict processing. You can delete your account yourself from settings; for anything else write to us via the contact form and we will respond within 30 days. You also have the right to complain to Datatilsynet (the Norwegian Data Protection Authority), datatilsynet.no.

Scope

Consent given on Tech Debt Weekly applies to Tech Debt Weekly only, and an account here is an account here only: we do not share subscriber lists or reader accounts across publications, we run no queries across their readers, and we run no third-party analytics or advertising scripts. If you also have an account on one of our other blogs, it is a separate account you manage separately.

If the blog changes hands

Tech Debt Weekly may be sold or transferred as a business. Its data, meaning reader accounts, comments, contact submissions, and the newsletter list, would transfer with it, and the new owner would become the controller for the same purposes. We would notify you before any transfer, with time to delete your account or unsubscribe; a transfer outside the EEA would rest on a lawful transfer mechanism; and if the new owner changed materially, newsletter consent would be asked for again.