Privacy Policy

1. Who is responsible

The Case Is Yours and Elaco Books are operated by Elaco Consulting AB, organisation number 559283-7156, Sweden. Elaco Books is an imprint of Elaco Consulting AB, which is the controller for the processing described in this policy.

Address: Lövskogsåsen 58, 427 38 Billdal, Sweden

Questions or privacy requests: privacy@thecaseisyours.com

2. Submitting an accusation (Case Desk)

When you submit an accusation we process the suspect name and page number you enter, the book edition, and your email address.

We use your email address only to send you the verdict. It is not stored in our case database: the submission record (suspect name, page, edition, result and delivery status) is kept without it.

Legal basis: to provide the service you ask for (Article 6(1)(b) GDPR). You do not have to subscribe to anything to receive your verdict.

3. New Cases (our newsletter)

If you tick the New Cases box — on Case Desk or on our homepage — we store your email address, your language, which version of the consent text you agreed to, and when you subscribed, confirmed or withdrew.

We first send you a confirmation email. You are only added once you confirm, and the link expires after 36 hours.

Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw at any time via the unsubscribe link in every email or by contacting us. We keep a record of consent events so we can show that consent was given.

4. The October Case and your Detective ID

The October Case calendar keeps your progress (solved cases, crossed-out names, notes and hints) in your own browser. It is not sent to us unless you create a Detective ID.

If you create a Detective ID we store your email address, your Detective File number, when you signed in, and the progress you make in the calendar, so you can continue on any device. We email you a sign-in link that works once, for 30 minutes; we keep only a one-way hash of it.

Signing in sets one strictly necessary cookie that keeps you signed in on that device for up to 12 months. We use it only to recognise your Detective ID.

Legal basis: providing the Detective ID you asked for (Article 6(1)(b) GDPR). A Detective ID does not sign you up for New Cases. You can sign out or delete your Detective ID, with all saved progress, at any time on the calendar page.

5. Security and abuse prevention

To protect Case Desk and Detective ID against automated abuse we use Cloudflare Turnstile, which evaluates technical signals from your browser, and we limit how many requests can be made.

For those limits we store only one-way cryptographic hashes of IP addresses and email addresses — never the addresses themselves — and delete them automatically shortly after the one-hour limit period ends.

Legal basis: our legitimate interest in keeping the service secure and preventing misuse (Article 6(1)(f) GDPR).

6. Analytics

We measure how the website is used with cookie-free analytics (Vercel Web Analytics). It uses no cookies, and we never send your email address or your verdict to it.

For The October Case we also count, for each of the 31 cases, how many answers it is sent and how many of those are right. These are plain counters. They hold nothing about who answered, and cannot be traced back to you.

Legal basis: our legitimate interest in understanding and improving the website (Article 6(1)(f) GDPR).

7. Hosting, logs and cookies

The website is hosted by Vercel. When you visit, technical data such as your IP address and browser information is processed to deliver the pages and may appear briefly in server logs.

Fonts are served from our own website; your browser does not contact Google. We do not use cookies for analytics or advertising. The only cookie we set is the Detective ID sign-in cookie described in section 4.

8. Who processes data on our behalf

• Vercel Inc. — website hosting and analytics
• Supabase Inc. — database, hosted in the EU (Stockholm, Sweden — eu-north-1)
• Sendinblue SAS (Brevo), France — sending verdict, New Cases and Detective ID emails
• Cloudflare, Inc. — DNS, security, Turnstile and forwarding of email sent to our contact addresses

We have data processing agreements with each of them. Some of these providers are based in the United States. Where personal data is transferred outside the EU/EEA, the transfer is protected by the European Commission's Standard Contractual Clauses in those agreements and, where the provider is certified, the EU–US Data Privacy Framework.

9. How long we keep data

• Case Desk submissions (without email address): 24 months
• The email address used to send a verdict: not stored in our database; it passes through our email provider, which keeps delivery logs for a limited period under our agreement with them
• New Cases subscriptions: until you withdraw consent; sign-ups that are never confirmed are deleted after 30 days
• Consent records: for as long as the subscription exists, plus 3 years
• Rate-limit hashes: deleted automatically shortly after 1 hour
• Detective ID: until you delete it; deleted automatically after 24 months without a sign-in, or after 30 days if the sign-in link is never used

10. Your rights

You have the right to access your personal data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw your consent at any time. You can always object to direct marketing.

Contact us at privacy@thecaseisyours.com. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se.

11. Changes

If we change this policy we update the date at the top. If a change affects your New Cases consent, we will ask for your consent again.