Privacy Policy

Last updated 3 November 2026

This policy covers bjel.ke, bjelke.domains, bjelke.christmas, and the sign-in service at auth.bjel.ke. They are personal sites. We do not run ads, and we do not sell personal data.

Who is responsible

The data controller is Bjelke Solutions AS, Norway. For access, correction, or deletion, email contact@mail.bjel.ke.

Signing in with X

You can read bjel.ke without an account. Searching domains, opening your DomainDex, and guessing on the advent calendar need a sign-in. Sign in with X uses OAuth through auth.bjel.ke. X tells us your user id, handle, display name, and avatar address. We ask X whether you follow or subscribe to @chribjel, and, on a door, whether you follow the person behind it. That only changes how many searches or hints you get. It is not a decision about credit, a job, or anything legal.

X refresh tokens are sealed on our server and are not put in a cookie the page can read. A short-lived access token sits inside the httpOnly session cookie so the site can call X for you. Scripts on the page cannot read that cookie.

What we store

  • Account: X user id, handle, display name, and avatar URL. The picture itself stays on X.
  • Session cookies. auth.bjel.ke keeps a central session. Each site keeps its own sealed session cookie (about 30 days, renewed while you use the site). A separate non-secret cookie only records when that session should be refreshed.
  • Domain search: the name you typed, whether the search was allowed, your tier that day, and a daily count. DomainDex keeps the domains you checked and whether they are owned. The public leaderboard shows handles, avatars, and counts, not your list of domains.
  • Advent calendar: guesses, hints you opened, solves, and the leaderboard built from them. Your browser may also keep a local note of guesses you already solved, in its own storage, so a door can reopen without asking the server first.
  • A short Redis cache of follower and subscriber tier, and of a follow check on a door. Tier 2 is kept for a few minutes. A follow or subscription is kept for about six hours. Rate limits use Redis too, including a short-lived hash of the IP address on domain search. Login codes expire within minutes.

Who processes it

  • Vercel hosts the sites and provides Web Analytics and Speed Insights. Those are page measurements, not ads. Christmas analytics drops requests whose path contains /api.
  • Neon hosts the Postgres database (accounts, sessions, sealed X tokens, searches, DomainDex, guesses, and solves).
  • Upstash hosts the Redis cache (login codes, rate limits, and tier).
  • X handles sign-in and the follow and subscription checks.

How long we keep it

Session cookies last about 30 days unless you sign out sooner. Signing out of one site clears that site's cookie. Redis entries expire on their own. Search history, DomainDex finds, guesses, and solves stay while the sites are running, because your DomainDex and the leaderboards are the point of those features. A ban, if one is applied, is kept so it still works. Email us if you want the account data deleted.

Your rights

If GDPR applies to you, you can ask for access, correction, deletion, restriction, or a copy of your data, and you can object to a use of it. Write to the email above. You can also complain to Datatilsynet, the Norwegian Data Protection Authority. We will not make you create an account just to send that email.

Children

These sites are not made for children. The bjelke.christmas contest, if it runs, will have its own terms. See the Terms of Service.

Changes

If this policy changes, the date at the top changes with it.