Privacy statement — Nordic Settlers

Who we are

Nordic Settlers is a product of Crypted AS, a company registered in Norway. We decide what happens to your data. Under the GDPR that makes us the controller.

Crypted AS
Nestestogvegen 23
3880 Dalen
Norway
Org. no. 937 893 485

Questions about your data go to [email protected]. That address reaches the two of us, not a customer service department.

This website

This site sets no tracking cookies. There is no cookie banner either, because there is nothing to accept. That is not a statement of principle, it is simply how the site is built.

We do want to know which pages get read, so we know what to keep up to date. We measure that with Umami, which we run on our own server. Umami counts page views without setting a cookie and without following you to other sites. No profile is built about you and nothing goes to an advertising network. If the measurement is not configured, the script is not shipped at all, so there is nothing in the page to switch off.

One thing is stored in your browser: your choice of the light or dark theme. It sits in localStorage under the name ns-theme. It is not a cookie, it is never sent to our server with a request, and it does not leave your device. Clear your browser data and it is gone, and the site goes back to following your system setting.

The platform

You find the platform at app.nordicsettlers.com, with its own login. For your timeline and your login, the platform keeps the adults’ email addresses, the names of the people in your household, what each of you has ticked off, the month and year of birth of children (not the exact date), the date you plan to move, the kommune you are moving to, a short description of your situation, the expiry dates of documents you want to be reminded about, and the public key of a passkey, if you set one up. Nothing is kept because it might come in handy one day.

Item by item, and why:

The adults’ email addresses. A household has room for two adults, each with their own login on their own address. It is how you log in, with a code or a link we email you, and how we send the reminders. There is no password.
The names of the people in your household. So the timeline can say who does what and the letters already carry your names, and so you are not looking at a list of ‘person 1’ and ‘person 2’.
What each of you has ticked off. The timeline keeps track, per person, of what is done.
For children: the month and year of birth. Not the exact date. Month and year are enough to work out the application deadlines for barnehage and school, so we do not ask for more.
The date you plan to move. Almost the whole timeline hangs off it. If it shifts, everything else shifts with it.
The kommune you are moving to, if you already know it. Where you arrange things, and how long it takes, differs per kommune.
A short description of your situation. Employment, your own business or study: that decides which steps you do and do not see.
Expiry dates of documents. Per person, for the documents you want to be reminded about, such as a passport or a driving licence. The date only and no number, so a nudge can arrive in time.
The public key of a passkey, if you set one up. A passkey is an extra way to log in, next to the code or the link. There is no password to it, and your fingerprint or face never reaches us.

The platform keeps no Dutch burgerservicenummer, no D-number and no fødselsnummer, no passport number or document number, no copies or scans of documents, and no bank details or card numbers.

That is not a promise for later, it is how the thing is built: there is no field to put them in. We have no use for those numbers either. You enter them yourself at Skatteetaten, at UDI and at your gemeente, not with us. And data you do not hold cannot leak. That is the safest way to store it.

Payment runs through Stripe once payment opens, not through us. Your card details go straight to Stripe and never touch Nordic Settlers, and neither does your bank account number. Stripe receives your name, your email address and the amount. We see whether a purchase went through, which product it was and what the amount was.

The app

The app for iPhone and Android belongs to the platform and talks only to our own server. It has no ads, no trackers and no measuring software from anyone else.

So that it also works without signal, the app keeps on your phone itself:

The guide. The articles, tasks, checklists, letter templates and the glossary, as our server sends them, with a search index over them.
Your timeline. With, per person, what has been ticked off and when.
Your account. The last copy as the server sent it: the household’s name; everyone in the household with first and last name, month and year of birth and nationality, the children too; the adults’ email addresses; and the details of your move and your situation, such as the dates, the kommune, work, housing, car and pets.
The reminders coming up. With their dates. For a document that is the expiry date, with the kind of document and whose it is.
What you tick off on a checklist. That stays on your phone and does not come to us.
What still has to be sent. Ticks on your timeline and reports made with Report as out of date while you had no connection, until they are sent.
Your phone’s own settings. The theme, the language, the filter on your timeline and whether notifications are on.

This sits in the app’s database on your phone, the settings in a small file beside it. The reminders the app schedules are held by your phone’s notification system, with only codes in them. The key that keeps the app signed in is kept apart, in your phone’s secure storage: the Keychain on an iPhone, the Keystore on Android. A backup never carries that key to another device. The database and the settings can end up in a backup of your phone.

What you fill in on a letter is kept nowhere by the app and is not sent to us. It is gone as soon as you leave the letter, or when the app has been in the background for more than a minute. If you copy a letter, it sits on your phone’s clipboard, and the app does not empty that. A search runs on your phone first and, with a connection, on our server too, which does not keep what you searched for.

Reminders on your phone

The app gets no push messages from a server. If you switch on Notifications on this device in the app, your phone first asks for permission. Once you give it, the app schedules the reminders on your phone itself, from the dates it fetched from the platform. A notification arrives at 9 in the morning and says only that something is due, with no names or dates in it. Nothing goes from your phone to us for this, and there is no push token with which we send your phone messages.

The reminders by email are separate. The platform sends those, and you switch them on or off with Reminders by email.

Report as out of date

If something in the guide is no longer right, you can say so with Report as out of date, in the app and on the platform. What goes to our server is which item it is and the text you type yourself. The server adds which household and which adult the report comes from, and when. In our queue only we see the reports, to improve the text; your household sees them again in the download of its data. So do not put personal or ID numbers in them. A report is kept until your household is deleted for good, thirty days after you close it. Without a connection, it waits on your phone until the app reaches the server again, unless you delete it or sign out first.

Signing out

When you sign out on your phone, the app removes everything of your household from the phone: the guide, your timeline, your household’s details, the reminders and your ticks on the checklists. Reminders already scheduled or delivered go too. Whatever was still waiting to be sent is removed without being sent. Only your phone’s own settings stay. The same happens when your phone is signed out elsewhere or your household is closed, the next time you open the app and it reaches the server. Until then, what is on your phone stays there, including reminders already scheduled.

If you delete the app without signing out, your session keeps working until it has not been used for 90 days, a year at most, or until you sign it out on the platform. That there was a session, with the kind of device and when it was used, we keep until your account is deleted. So sign out first: that also removes the key for signing in from your phone.

The free checklist

If you ask for the free checklist, you hand over two things: your email address and the language you want it in. We ask for no more and we keep no more. No name, no company, no ‘when are you moving’.

It works with double confirmation. First you get one email with one link in it. If you do not click it, we send nothing and the sign-up disappears again. That way nobody can put you on a list using your address.

At the bottom of every email there is an unsubscribe link that works in one click: no logging in, no reason to give, no screen asking whether you are sure. Your address stays on the list until you unsubscribe. We do not sell addresses, we do not trade them and we do not pass them to anyone else to do something with.

If you sign up for the launch, you hand over the same two things and confirm the same way. We only note that it is for the launch, so we can email you once payment opens. You get no newsletter.

Where it is kept

This site, the platform and the mailing list all run on our own server in Norway, inside the European Economic Area. Norway is part of it: it is not an EU member state, but the GDPR applies there through the EEA Agreement and Datatilsynet supervises it.

Your data passes through the following:

Hosting: our own server in Norway, owned by Crypted AS. The site, the platform and the mailing list live there.
Your phone, if you use the app. What is kept there is set out above, under The app.
Network and DNS: Cloudflare. The site is delivered to your browser through Cloudflare. In doing so Cloudflare sees connection data, such as your IP address and which page you ask for, but no account data.
Visitor numbers: Umami, on our own server, without cookies. How that works is above, under This website.
Email: our own mail server, mail.crypted.cloud, also owned by Crypted AS. The confirmation email, the checklist, the emails you log in with and the reminders all go through it.
Payment, once payment opens: Stripe. Your card details never touch Nordic Settlers. Stripe receives your name, your email address and the amount.

Why we are allowed to keep it

The GDPR wants us to say, per type of data, on what ground we process it. In our case there are three.

Performance of the contract. Everything in the platform and the app. You bought access to a timeline built around your situation. Without that data there is no timeline and the purchase gives you nothing.
Consent. The mailing list. You give that consent by clicking the confirmation link, and you withdraw it by unsubscribing. Nothing else is needed.
Legitimate interest. The aggregated, cookie-free visitor numbers. We want to know which pages get read so we check and update the right things. Because no cookie is set and no profile is created, the intrusion on your side is small.

How long we keep it

Your account and your timeline: for as long as your account exists. You can close your household yourself, or ask us to. After thirty days everything is gone and we cannot bring your timeline back, so download whatever you want to keep first. How it works and what stays is on Delete your account.
Reports made with Report as out of date: until your household is deleted for good.
In the app on your phone: until you sign out.
Document expiry dates: for as long as your account exists. When your account is deleted, they go with it.
The mailing list: until you unsubscribe. After that we take your address off the list.
Visitor numbers: in Umami, on our own server, with no cookie and no name or email address.
Invoices and bookkeeping: for as long as Norwegian accounting rules require. That is longer than the rest and we cannot get around it. A deletion request therefore does not cover the bookkeeping.
Backups: every night we make an encrypted copy of the platform. We keep those of the last 30 days and one a month for the last 12 months. What has been deleted can therefore remain in a backup for up to about thirteen months.

Your rights

The GDPR gives you a number of rights. They apply whether or not you bought anything, so also if you are only on the mailing list.

Access. You may ask what we hold about you.
Rectification. If something is wrong, we correct it.
Erasure. You may ask us to throw it away. You can also delete your account yourself: see Delete your account.
Portability. You may have your data in a readable file to take elsewhere.
Objection. You may object to processing that rests on our legitimate interest.
Withdrawing consent. For the mailing list that is the unsubscribe link. An email works too.

Write to [email protected] and say which right you mean. It costs you nothing. We answer within a month; if it is more complicated than usual, we tell you within that month how much longer it will take and why. To stop someone else requesting your data, we send the answer to the email address in your account or on the list.

Complaining to a regulator

If you think we are getting it wrong, tell us first. That is usually the quickest route. But you do not have to wait for us and you do not need our permission: you can go straight to a regulator. To Datatilsynet, because we are based in Norway, or to the Autoriteit Persoonsgegevens if you live in the Netherlands. Either is fine.

Changes to this statement

If something changes about what we keep, why we keep it or where it sits, we update this page and put a new date underneath. If it is something material, such as a new category of data or a new party handling it, we also email everyone with an account. We do not quietly edit this statement to justify something after the fact.

What you buy and on what terms is on another page: the terms and conditions.

Last updated: 19 October 2026.