Privacy policy
This policy sets out what data Oppat processes about you, what it is used for, and what rights you have.
Last updated September 15, 2026
Data controller
Little Red Hen AS is the controller of the personal data processed in Oppat. Privacy questions go to the address below.
Little Red Hen AS
- Company registration number
- NO 818 764 022
- Registered address
- Frostveien 18B, 1164 Oslo
- Contact
- personvern@oppat.no
What we collect
- From the Google sign-in: name, email address and profile picture.
- From you: your postcode, which we use to look up your municipality.
- From your use: the listings and photos you post, the messages you send, requests and collections, ratings, karma and any reports.
- From operations: technical logs with timestamps, error messages and IP address.
What we use it for, and on what basis
| Purpose | Legal basis |
|---|---|
| Account and sign-in | Contract (GDPR art. 6(1)(b)) |
| Showing nearby toys, passing on requests and messages | Contract (art. 6(1)(b)) |
| Email notifications about requests and messages | Contract (art. 6(1)(b)) — can be switched off in your profile |
| Moderation, the limits against misuse, and karma | Legitimate interest (art. 6(1)(f)) — keeping the service safe to use |
| A log of who was granted which access | Legitimate interest (art. 6(1)(f)) — traceability |
What others see
Other users see your first name and the initial of your surname — “Marte H.” — alongside your municipality. Your email address, your full surname and your exact postcode are never shown to other users. Where a toy is collected is something you arrange between yourselves in the message thread.
The environmental ledger
The figures on the front page and the method page are totals with no link to individuals. They cannot be traced back to you.
Who we share with
We do not sell data, and we do not share it for marketing. To run the service we use a few providers who process data on our behalf:
- Google — sign-in
- Uploadthing — storage of listing photos
- Resend — sending email notifications
- Railway — hosting and database, in the EU
- Sentry — error tracking, so we find out when something in the service goes wrong
Some of the providers are American. Transfers rely on the European Commission's standard contractual clauses and the providers' own data processing agreements. The database holding accounts, listings and messages is in the EU.
Error reports do not carry who you are: no name, no email address, no cookies, and not what you typed into a form. We do not trace performance either, and we make no recordings of the screen.
How long we keep it
Your account is stored until you delete it. When you do, your name, email address, profile picture and postal code are removed, and your listings are taken down. The photos you uploaded are deleted for good — including from listings that have already been picked up.
Messages and ratings remain, but without a name — the other party should still be able to read what was agreed. Confirmed handovers remain in the environmental ledger as anonymous figures, and the role change log remains as an event without a name.
Your rights
You have the right to access the data we hold about you, to have inaccuracies corrected, to have data erased, to demand that processing be restricted, to object to processing based on legitimate interest, and to receive your data in a machine-readable format.
Deletion you do yourself, from your profile. For anything else, send an email to the address below. We answer within 30 days.
Complaints
If you believe we process your data contrary to the rules, you may complain to the Norwegian Data Protection Authority. We would appreciate hearing about it first, so we can put it right.
Cookies
We use one cookie: the one that keeps you signed in. It is necessary for the service to work, which is why we do not ask for consent to it. We have no analytics, no tracking and no advertising.
Children
The service is for adults. You must be over 18 to hold an account, and we do not knowingly collect data about children. Do not post photos with children in them.
Security
All traffic is encrypted. Internal access to data is limited to those who need it, and every change of access level is written to a log.
Changes
We may change this policy. The date at the top shows when it was last changed, and for changes of consequence we will tell you.