Privacy & cookies
Cookies and other goodies
Most websites ask you to accept their cookies. We don't, and we owe you an explanation. So every cookie this site uses has been put on trial. Here are the cookies.
The law
A website may only store information in your browser if you consent: the EU ePrivacy Directive, article 5(3), in Sweden chapter 9, section 28 of the Electronic Communications Act (LEK). There is one way out: no consent is needed when the cookie is strictly necessary for a service you have explicitly asked for. The EU data protection authorities have described which cookies qualify (Article 29 Working Party, opinion 04/2012).
The cookies
sessionid
- Charge
- Remembers who you are after you log in.
- Evidence
- A random number that points to your login on our server; it contains nothing about you. Set when you log in, or start to log in with BankID. Deleted when you close the browser, or after two weeks if you ticked "Remember me". A BankID login ends after two hours without activity; for that, our server notes when you were last active.
- Verdict
- Pass Logging in is a service you explicitly asked for, and without this cookie you would have to type your password on every page (opinion 04/2012, section 3.2). The two-week version is not exempt by itself, so it only exists if you tick "Remember me", which says it uses a cookie: that tick is your consent.
csrftoken
- Charge
- Stays in your browser for a year.
- Evidence
- A random security token. It proves that a form you send really came from this site and not from a malicious page trying to post in your name. Scripts can't read it.
- Verdict
- Pass Security that protects the service you use is strictly necessary, and such cookies may live longer to do their job (opinion 04/2012, section 3.3).
lang
- Charge
- Remembers your language.
- Evidence
- "en" or "sv". Only set when you click a flag. Deleted when you close the browser. If you are logged in, your choice is also saved on your account, on our server, so it follows you to other devices without any extra cookie.
- Verdict
- Pass You asked for it by clicking the flag, and it only lasts for this browser session, which is exactly what the authorities exempt (opinion 04/2012, section 3.6). A one-year language cookie would have needed your consent, so the court ordered it shortened.
messages
- Charge
- Briefly carries a notice such as "Profile saved".
- Evidence
- The text of the notice, signed by our server. It exists only between the page where you did something and the next page, which shows the notice and deletes it.
- Verdict
- Pass It completes something you just did and is gone a moment later (opinion 04/2012, section 3.1).
Witness for the defence
__cf_bm, cf_clearance
- Who
- Cloudflare, the network that protects this site from attacks and overload. These cookies are theirs, not ours, and only appear when needed.
- Evidence
- Help tell people from bots.
__cf_bmlives for 30 minutes;cf_clearanceis only set if you had to pass a check. - Verdict
- Pass Protection of the service against abuse, used for nothing else.
Other cookies and unwanted things
- Analytics and visitor statistics
- Advertising and retargeting cookies
- Social media pixels and "like" buttons
- Fingerprinting and other tracking without cookies
- Local storage in your browser
If any of them ever shows up, this page changes first, and you get a real choice before anything is stored.
Personal data (GDPR)
The General Data Protection Regulation (EU) 2016/679 (GDPR) and the Swedish Data Protection Act (2018:218) apply to the personal data we process.
Account data
- Data
- Email address, display name, language, how you log in (password or BankID), password (stored only as a one-way hash), date joined and last login.
- Purpose
- To provide your account. The email address is used for login and notifications and is never shown to other users.
- Legal basis
- Contract (Article 6(1)(b))
- Retention
- Until you delete your account.
Login and verification with BankID
- Data
- Your personal identity number (personnummer), and that BankID confirmed it. Only if you sign up with BankID or switch your account to BankID. We do not store the name BankID returns.
- Purpose
- To log you in with BankID, and to show other users that your account is verified, which makes fraud harder. An account is shown as verified only while it logs in with BankID, never with a password. Other users see that it is verified, never the number. Our staff can see the number when investigating fraud.
- Legal basis
- Contract (Article 6(1)(b)). The personal identity number is used because secure identification is important (Swedish Data Protection Act, chapter 3, section 10).
- Retention
- Until you delete your account. If our staff switch your account to a password, for example while BankID is unavailable, the number is kept so that your next BankID login switches it back.
Ads and images
- Data
- The text, price, location and images you publish. Images are re-encoded on upload, which removes embedded metadata such as GPS position.
- Purpose
- To publish your ads.
- Legal basis
- Contract (Article 6(1)(b))
- Retention
- Until you delete the ad or your account. Expired and sold ads remain in your account until then.
Messages
- Data
- Messages between buyer and seller, with the time they were sent and read.
- Purpose
- To deliver your messages and notify you of unread ones. Staff may read a conversation when handling a report or investigating abuse.
- Legal basis
- Contract (Article 6(1)(b)); review by staff: legitimate interest in a safe service (Article 6(1)(f))
- Retention
- Until you or the other party deletes their account, which deletes the conversation for both.
Reports and blocks
- Data
- Reports you submit (reason and description) and the users you block.
- Purpose
- Moderation and protection against abuse.
- Legal basis
- Legitimate interest (Article 6(1)(f))
- Retention
- Blocks: until you delete your account. Reports: until the reported content is deleted; if your account is deleted first, the report is kept without any link to you.
Server logs
- Data
- IP address, time, requested page and browser type, for every visitor. Failed login attempts are also counted per IP address.
- Purpose
- Security, troubleshooting and protection against attacks.
- Legal basis
- Legitimate interest (Article 6(1)(f))
- Retention
- Logs: two weeks. Failed login counters: a few minutes.
Where the data is stored
All data is stored on servers in Sweden. Cloudflare, Inc. protects the site against attacks and handles the traffic to it as our data processor; it sees your IP address and the pages you request. Any transfer to the United States is covered by the EU–US Data Privacy Framework and the EU standard contractual clauses. We share data with no one else, unless the law requires it (for example a request from the police).
BankID logins go through TIC Identity (The Intelligence Company AB, Sweden), our data processor, on their own site: it sees your IP address, as BankID requires, and receives your personal identity number from BankID and passes it on to us.
We do not sell your data, use it for advertising, or make automated decisions or profiles about you.
Your rights
You have the right to access, correct and delete your data, to receive it in a portable format, to restrict its processing, and to object to processing based on legitimate interest. You can download your data and delete your account on your account page; for anything else, contact us. You can also lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se.
The download contains everything except your personal identity number, which is never shown on the site; we send it to you on request.
Last reviewed 2026-10-28.