This privacy policy is valid from November 11, 2026. It explains how Pizzakollektivet processes personal data when you use our website and logged-in features.
In short, you can read public content without an account. We use necessary technical information for secure operation. Google Analytics and advertising technology are only activated in accordance with the choices you make in the consent solution.
1. Data Controller
Durmaalslosjen, organization number 921 174 470, is the controller of the personal data mentioned here. Contact us at pizzakollektivet@gmail.com. We do not have a data protection officer.
2. When you visit the website
Firebase Hosting and Cloud Functions process technical information such as IP address, time, URL, device and browser information. The purpose is to deliver the website, prevent abuse, troubleshoot problems, and keep the service safe and stable.
The basis for processing is our legitimate interest in secure and reliable operation, cf. Article 6(1)(f) of the General Data Protection Regulation. Firebase states that Hosting may store IP data for several months, that Cloud Functions only stores IP addresses temporarily, and that security logs may be kept longer when necessary to investigate abuse or fulfill legal obligations.
3. Google login and account
When you sign in with Google, we receive a unique user ID, email address, display name, and possibly a profile picture from Google. We never receive your Google password. The information is used to create your session, display your profile, protect signed-in features, and associate your actions with the correct account.
The basis for processing is that the processing is necessary to provide the logged-in functions you request, cf. Article 6(1)(b). Firebase Authentication also uses IP address and browser information for security and abuse protection; this is based on our legitimate interest in secure operation, cf. letter f.
Account data is stored while the account is active. You can delete your account from My Page. Google states that authentication data is removed from active systems and backups within 180 days of us initiating deletion, and that login IP addresses are typically stored for a few weeks.
When you use a logged-in participant or author feature, we store which version of the Terms of Use you have accepted, a text fingerprint, and the time. The purpose is to document the agreement regarding the account features. The version, document fingerprint, and time are stored while the account is active. They are deleted from the active database together with the account.
4. My recipes, ratings and comments
When you save a recipe or mark it as done, we store the user ID, recipe ID, status, and time. The list is private, while public pages only show aggregate numbers without names.
When you rate or comment, we store your user ID, display name, content, rating and time. Comments and aggregated ratings are displayed publicly. The basis for processing is to provide the function you have chosen, cf. Article 6, paragraph 1, letter b, and to moderate and secure the service, cf. letter f.
Will be stored until you uncheck it or delete your account. Will be deleted from the active database. Public totals for saves and creations will be reduced.
Will be stored until you delete your account, or the rating is removed by moderation. Will be deleted from the active database. The average and number of ratings will be recalculated.
Will be stored until you delete your account, request deletion, or the comment is removed by moderation. Will be deleted from the active database and is no longer visible on the recipe.
5. Articles, images and editorial work
For article authors, we store user ID, display name, email address, article draft, image, editorial status and change history. Editors use the information for evaluation, publication and necessary contact. Upon submission, a notification is sent to the editors from the Pizzakollektivet Gmail account.
The basis for processing is to carry out the publishing process you request, cf. Article 6, paragraph 1, letter b, and our legitimate interest in editorial quality, documentation and secure operation, cf. letter f.
Private drafts are saved while you are working on them and until your account is deleted. Published articles are saved as long as they are part of the editorial archive. Private drafts and associated notices are deleted. Published articles remain, but the author is changed to "Former Contributor". You can contact us if a special situation requires a different assessment.
6. Administrators and editors
For persons with operational access, we store the email address, role and time of role changes. The purpose is access management, security and responsible editorial operation. The basis for processing is our legitimate interest, cf. Article 6, paragraph 1, letter f.
The information is stored as long as access is active and then as long as necessary for security, documentation or legal requirements. The sole editor must share or transfer editorial responsibility before the account can be deleted.
7. Analytics, Ads and Consent
Public pages may use Google Analytics for visitor statistics and Google AdSense for advertising. The technology may process website address, IP address, approximate location, device and browser information, advertising and consent signals, events, and cookies or similar identifiers.
Analytics and advertising purposes that require consent are based on your consent, cf. Article 6(1)(a) and the rules on storage or reading on your device. Our default setting denies advertising, ad personalization, ad data and analytics storage until Google's certified consent solution has communicated your choice. If you decline, Google may still deliver limited ads without personalization where permitted by the regulations and Google's terms.
You can change or withdraw your choice at any time via "Privacy and ads settings" in the footer. Withdrawal does not affect processing that was already lawful. We do not use Analytics to make automated decisions about you.
8. Cookies and local storage
We use a first-party cookie called pk_language to remember the language you actively select. It lasts for up to one year. Firebase Authentication may use necessary local storage to keep you logged in and secure your session. These features are necessary for the selection or service you explicitly request.
Google's consent solution stores your choices so that they can be respected on subsequent visits. Analytics and AdSense can only use optional storage in accordance with your consent signals. The updated vendor and purpose list is available in "Manage Choices" in the consent solution.
9. Contact, sharing and external services
When you send an email to pizzakollektivet@gmail.com, we process your name, email address and the content of the message to respond and follow up on the matter. The basis is Article 6, paragraph 1, letter b or f, depending on the request. We delete the correspondence when the matter and any documentation needs are complete.
The sharing buttons only open services such as email, Facebook, Messenger, WhatsApp, X or Threads when you select them. The external service then processes the information according to its own privacy policy. Instagram links are also only opened when you click.
10. Who we share information with and processing outside the EEA
Google provides Google Cloud, Firebase, Authentication, Analytics, AdSense, consent solutions and Gmail. Google processes data as a data processor for several of its operational functions and may be an independent controller for certain advertising and analytics services. Suppliers only receive information that is necessary for the service they provide.
Some Google services are delivered globally, and Firebase Authentication is processed from data centers in the United States. Transfers outside the EEA shall be subject to Google's applicable data processing terms and legal basis for transfer, such as approved standard privacy statements or a valid adequacy decision where applicable.
We do not sell your personal information. We may provide information to public authorities when we are legally obligated to do so.
11. Security and storage restrictions
The service uses access control, Google login, role-based Firebase rules, encrypted transport, and limited administrator access. However, no web-based service can guarantee complete security.
We store information only as long as the purpose, backups, disputes or legal requirements make it necessary. The periods above are normal periods; a specific case may require shorter or longer storage. We evaluate and delete or anonymize data when the need is no longer needed.
12. Your dishes
You can request access, rectification, erasure, restriction and data portability where the conditions are met. You can object to processing based on legitimate interest. When the processing is based on consent, you can withdraw your consent at any time.
Send your request to pizzakollektivet@gmail.com. We may ask for necessary confirmation of your identity. We will normally respond within one month. You can complain to the Norwegian Data Protection Authority if you believe that the processing violates the privacy rules.
13. Barn
Public content can be read without an account. Logged-in features and content submission are not specifically directed at children. If the law requires consent from a minor's guardian, this must be provided before the minor uses the feature.
14. Changes to the declaration
We update the statement when the service, suppliers or regulations change. The version and date are at the top. Significant changes are clearly notified, and we ask for new consent if a change requires it.