Last updated: 9 October 2026
Who we are
EcoScore is a carbon footprint tracker at ecoscore.aver-web.se and in the EcoScore Android app, operated by Timmie Hemmingsson, a sole trader in Sweden trading as Vireo, at Vistorp Kullen 1, 521 95 Kättilstorp, Sweden. That person ("we") is the data controller for the personal data described below. Contact: support@aver-web.se.
What we collect
- Account data: email address, display name, country, optional city and avatar.
- Carbon footprint data: your questionnaire answers and calculated footprint. This reveals lifestyle information (diet, travel, consumption) and we treat it as sensitive: it is never shared individually, never sold, and never visible to other users or employers without your explicit opt-in.
- Activity data: challenges accepted and completed, points, day counts, badges.
- Billing data: subscription status. Payment details are processed by Stripe (web) or Google Play (Android) — we never see your card number.
- Usage analytics: anonymous product events (e.g. "calculator completed") via PostHog (EU-hosted), only where enabled.
- Push notification token: if you turn on notifications in the Android app, the device token Expo's push service needs to deliver them. It is deleted when you turn notifications off, and when you delete your account.
- Feedback: anything you write in the in-app feedback form, together with the account that sent it, so we can reply and so you can have it exported or deleted with the rest of your data.
- Launch note: if you ask for the launch note on our website, the address you enter, the project you asked about, your language, and where the request came from (the campaign parameters in the link you used). We send one confirmation email first; unconfirmed addresses are deleted after three days. Confirmed addresses are kept with our email provider, Resend (EU region), until you unsubscribe, which you can do from any email we send.
Legal bases (GDPR)
- Contract — providing the service you signed up for.
- Consent — social features, the launch note and other marketing emails, analytics.
- Legitimate interest — fraud prevention, service security.
Where your data lives
All user data is stored in our self-hosted Appwrite instance, hosted in the EU. API traffic runs through Cloudflare's network. Error reports (Sentry) and analytics (PostHog) use EU endpoints where configured.
Your rights
- Export: download all your data as JSON from Settings.
- Deletion: delete your account in Settings — all personal data is removed permanently (cascading deletion), immediately, except the accounting record of a payment that bokföringslagen requires us to keep.
- Rectification, restriction, objection, portability: contact support@aver-web.se. You may also lodge a complaint with your supervisory authority (in Sweden: IMY).
Retention
Data is retained while your account exists. Deleting an account erases your personal data immediately, with one exception the law does not let us make: if you ever paid, the accounting record of the payment is kept until the end of the seventh year after the calendar year in which the financial year closed, because bokföringslagen (1999:1078) 7 kap. 2 § requires it — it holds the transaction, not your footprint. Encrypted backups roll off within 30 days. Audit logs required for billing disputes are kept up to 12 months. Launch-note addresses: unconfirmed, three days; confirmed, until you unsubscribe.
Changes
We will notify you by email of material changes to this policy at least 14 days before they take effect.