Privacy Policy

Stormberry AS respects your privacy. This page explains, in plain language, what information we hold about you, why we hold it, and what your rights are. We do not use cookies. We run no analytics scripts. We do not sell or monetise your data. Ever. We share it only with the providers named in section 4.

1. Who we are

Stormberry AS is a Norwegian limited company (aksjeselskap) registered in Askøy, Norway. Organisation number: NO 937 751 249. We are the data controller for any personal data processed through this website and our Labs apps. You can reach us at .

2. What information we collect

Through the contact form on this site, we receive what you choose to send us:

• Your name
• Your email address
• The service area you are interested in
• How you heard about us, if you choose to answer
• The message you write to us
• Whether you ask us to email you a confirmation

When you submit the form, the service that receives it also uses your IP address to limit repeated submissions, and passes it to Cloudflare Turnstile for its check. If you ask for a confirmation, it also uses your email address to limit how often confirmations can be sent to the same address. We do not store your IP address with your enquiry; see section 5 for the short-lived technical logs.

You can also email us, or message us on Signal, Telegram or WhatsApp. If you do, we receive what you send and your email address or phone number. Email reaches the same Proton inbox as the form (section 4). Signal, Telegram and WhatsApp carry your messages under their own terms, not on our behalf.

AI assistants. We use AI assistants, including Anthropic's Claude, to help us sort, summarise and answer the email and messages we receive. When you write to us, your name, email address and message, and our notes about our contact with you, can be processed by them. Our setting that lets Anthropic train its models on our conversations is off, so Anthropic does not use what you send us for training, apart from the two exceptions in its terms (section 4). Each evening, a short summary reaches our phones through our own notification server. It lists the sender and subject of new emails, and our tasks and appointments, which can mention you. It is put together on our own computer, partly by a language model running there, and it shows enquiries from the contact form only as a number, without your name or message. The evening before a meeting, a short preparation note reaches us the same way. It is written on our own computer by the same local language model, from the calendar entry, our notes about our earlier contact with you, the public company register (Enhetsregisteret) and recent news from a web search for the company that we run through our own search server, and it can mention you. On their way to us, the summary and the preparation notes pass through Cloudflare, which carries the connection to our notification server (section 4). We also talk to our own AI assistant through Signal, which is end-to-end encrypted, and its answers can include details of your email when we ask it about our inbox. We decide how to handle your message; the assistants make no decisions about you (section 8). You have the right to object to this use of your data (section 7).

We run no analytics scripts on this site. We do not track your browsing behaviour, and we do not place advertising or marketing pixels. We do read aggregate totals, with no script on the page and no tracking of individuals: the traffic totals Cloudflare derives from its connection logs (Cloudflare delivers our pages), and the search-query totals that search engines report to us through their tools for site owners. We do not fingerprint your device to identify or follow you. On our contact pages and in the CheapBeer app, once you start using a form, Cloudflare Turnstile checks signals from your browser and connection to tell people from automated abuse (see section 6).

3. Why we use it, and on what legal basis

We use personal data only for the purposes below. Each purpose has one legal basis under the EU General Data Protection Regulation (GDPR):

• Answering your enquiry, and following up about working together if that is what you asked about: our legitimate interest in replying to the people who write to us (Article 6(1)(f)).
• Using AI assistants to help sort, summarise and answer our correspondence, including the evening summary, the meeting preparation notes and our assistant's answers (section 2): our legitimate interest in handling our correspondence efficiently (Article 6(1)(f)).
• Knowing how you heard about us, if you choose to answer: our legitimate interest in knowing which channels bring enquiries, so we know where to put our effort (Article 6(1)(f)).
• Protecting the contact form from automated abuse with Cloudflare Turnstile and limits on repeated submissions, which use your IP address and, for confirmations, your email address: our legitimate interest in keeping the form usable and stopping it being used to send spam (Article 6(1)(f)).
• Delivering the site and keeping it secure, which involves the connection logs described in section 4: our legitimate interest in running a secure website (Article 6(1)(f)).
• Knowing roughly how much traffic the site gets, from aggregate totals only (section 2): our legitimate interest in understanding how the site is used overall (Article 6(1)(f)).
• Running the CheapBeer price list, including checking submissions for spam and reviewing them before anything is published: our legitimate interest in offering an accurate, crowd-sourced price list (Article 6(1)(f)); see section 11.
• Keeping records of a commercial relationship where bookkeeping law requires it: our legal obligation (Article 6(1)(c)); see section 5.

You can object at any time to processing based on legitimate interest (see section 7).

We do not use your information for marketing. We do not add you to a mailing list. We do not share, sell, rent, or otherwise transfer your information to third parties for their own use, except as described in section 4.

4. Who processes your data

We use a small number of carefully chosen providers strictly for the technical operation of this site, our Labs apps and the contact form, and for handling our correspondence. Cloudflare, Resend and Proton process your data on our behalf under their data processing terms, only for the purposes described here. The one exception is Cloudflare's own use of Turnstile signals, described below. GitHub is different: it keeps its own server logs for its own security purposes, under its own privacy statement, not on our behalf. Anthropic also acts under its own terms and privacy policies, not on our behalf.

• Anthropic Ireland, Limited (Claude) provides the Claude models our AI assistants use (section 2). It receives the email and messages the assistants work on, lists of the sender and subject of new emails, and our notes, calendar entries and tasks, which can mention you. These can include your name, email address, and the subject and content of your message. Anthropic handles this under its own terms and privacy policies, not on our behalf. For people who live outside the EEA, the UK and Switzerland, Anthropic names Anthropic PBC, in the United States, as responsible. Anthropic's Non-User Privacy Policy explains how it treats personal data about people who do not use its services, and the rights you have towards it. Our setting that lets Anthropic train its models on our conversations is off. Its terms still let it train its models on conversations flagged for safety review, and on material we send it as feedback.
• Cloudflare, Inc. sits in front of the site and the Labs apps as their content delivery network and security layer, runs the small services that receive the contact form and CheapBeer submissions, and provides Cloudflare Turnstile on our contact pages and in the CheapBeer app. It processes connection data such as your IP address to deliver pages and to block abuse. Cloudflare states that it also uses Turnstile signals to improve its own bot detection, which it does on its own account. Cloudflare also carries the connection to our own notification server, so the evening summary and the meeting preparation notes described in section 2, with the sender and subject of new emails, pass through Cloudflare on their way to us.
• GitHub, Inc. (GitHub Pages) stores the site and our Labs apps, and serves their pages to Cloudflare. It also hosts the public repository where approved CheapBeer prices are published (section 11). GitHub states that it logs visitor IP addresses on GitHub Pages for security purposes. It keeps those logs for its own purposes, under its own privacy statement, not on our behalf, and we have no access to them.
• Proton AG (Switzerland) hosts our company email inbox, where messages from the form and emails you send us are received and stored.
• Resend, Inc. delivers the contact-form email to us and, if you ask for one, a short confirmation to you.

GitHub, Cloudflare and Resend are based in the United States. Where Cloudflare or Resend transfer personal data outside the European Economic Area on our behalf, the transfer relies on the EU-US Data Privacy Framework where the provider is certified under it, and on the European Commission's Standard Contractual Clauses otherwise. Switzerland, where Proton is based, has an adequacy decision from the European Commission. GitHub transfers its own server logs under its own privacy statement. Anthropic Ireland, Limited is based in Ireland, inside the EEA. Anthropic states that personal data is transferred to its servers in the United States and to other countries outside the EEA, and that it relies on adequacy decisions, the European Commission's Standard Contractual Clauses and, in certain situations, the exceptions (derogations) that data protection law allows. Anthropic makes these transfers under its own privacy policies.

5. How long we keep it

Messages you send us, whether through the form, by email or by messenger, are kept for as long as is reasonably necessary to handle the enquiry and any resulting engagement, after which they are archived or deleted. If a message does not lead to an engagement, we typically delete it within twelve months. Where Norwegian bookkeeping law (bokføringsloven § 13) requires us to retain documentation related to commercial relationships, we keep those records for the legally required five years.

Our providers also keep short-lived technical records. Cloudflare keeps the logs of the service that receives the form for up to seven days, and these can include your IP address. Resend keeps a record of each email it delivers, including its content, for a limited period under its own retention terms. If an email we send you cannot be delivered, or is marked as spam, Resend tells us, and a notice of the failure with your email address may reach our inbox. Anthropic keeps what our assistants send it for 30 days while our training setting is off, and longer if it is flagged for safety review or sent as feedback. Our notification server keeps each evening summary and preparation note for 12 hours, long enough for our phones to collect it; after that, they are kept only on our own devices until we delete them. Our assistant's answers stay in our Signal chat until we delete them.

6. Cookies and similar technologies

We do not set cookies on this site. We do not use local storage to track you. We do not use device fingerprinting to identify or follow you.

Cloudflare Turnstile protects the forms on our contact pages and in the CheapBeer app (beer.stormberry.as) from automated abuse. It starts only when you begin using a form, for example when you click into a field or start typing; if you only read the page, it does not run. To tell people from bots, it checks signals from your browser and connection, such as your IP address, the information your browser sends with each request, and technical characteristics of your browser and the connection. Cloudflare also uses these signals for its own bot detection (section 4).

In our own test on 2 October 2026 (headless Chromium, 23 pages across our sites, with Turnstile running), no cookies were set. Turnstile does store one entry in your browser's local storage: cf.turnstile.u, written by challenges.cloudflare.com. As far as we can tell, it lets Turnstile recognise a browser it has already checked. It has no expiry date, keeps the same value on later visits and between our contact pages and the CheapBeer app, and stays until you clear your browser's data for stormberry.as. We consider Turnstile's checks and this entry strictly necessary to provide the form you have started to use (Norwegian Electronic Communications Act (ekomloven) section 3-15, second paragraph, point b).

7. Your rights

Under the GDPR and the Norwegian Personal Data Act (personopplysningsloven), you have the right to:

• access the personal data we hold about you;
• ask us to correct inaccurate data;
• ask us to delete your data;
• ask us to restrict how we process your data;
• object to processing carried out on the basis of legitimate interest.

On request, we will also give you a copy of what you sent us, in a portable format. To exercise any of these rights, write to us at . We will respond within thirty days. If you believe your rights have been infringed, you also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no).

8. Automated decision-making

We do not subject you to any automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (GDPR Article 22).

9. Minors

Stormberry AS is a business-to-business service. We have no commercial reason to collect personal data from anyone below the Norwegian age of majority (18). We do not knowingly do so. If you believe a minor has submitted information to us, please contact us and we will delete it.

10. Changes to this policy

We may update this policy from time to time. The date at the top of this page reflects the most recent change. Material changes will be highlighted on the site for a reasonable period after they take effect.

11. Stormberry Labs apps

Our Stormberry Labs apps each run at their own address under stormberry.as, such as beer.stormberry.as. They are delivered the same way as this site, by GitHub and Cloudflare (section 4), and your rights in section 7 apply to them too.

In your browser. The apps do their work in your browser. Apart from CheapBeer's price form, described below, nothing you enter in them is sent to us or to anyone else. Some apps keep a little data in your browser's local storage, so that they remember it on your next visit: that you accepted an app's disclaimer, and when; your difficulty setting, high score and recently seen questions in AstroQuiz; and the evening screen-time log you keep in NightModeScheduler, which is encrypted with a key that stays in your browser. This data never leaves your device, and we cannot see it. It stays until you clear your browser's data for that app.

CheapBeer price submissions. If you submit a price in CheapBeer, the app sends what you enter in the form, which is the bar's name, city and address, its website if you give one, and the glass size and price, to a small service we run on Cloudflare. That service uses your IP address to limit repeated submissions and passes it to Cloudflare Turnstile, which checks the submission for spam as on our contact pages (section 6). We do not store your IP address with the submission. Each submission is held out of public view until we have reviewed it, and nothing is published before that. Prices we approve are published in the app and in its public source repository on GitHub, where they stay for as long as the price list exists; the repository's history keeps earlier versions. Submissions we do not approve are deleted, and a submission nobody has reviewed deletes itself after 90 days. The form asks about bars, not people: please do not include personal details, such as a name or a phone number.

Our legal basis is our legitimate interest in running an accurate, crowd-sourced price list and keeping it free of abuse (Article 6(1)(f)).

Human dignity, ethics, and our commitments

Stormberry AS holds, with the founders of free societies, that every human being is created in the image and likeness of God, and is therefore endowed with an inherent and inviolable dignity that no government, employer, or marketplace may rightfully remove.

We hold these truths to be self-evident, that all men are created equal, that they are endowed by their Creator with certain unalienable Rights, that among these are Life, Liberty and the pursuit of Happiness.

From this foundation, our commercial conduct follows. In our own operations and across our supply chain, we will not tolerate:

• child labour, in any form;
• forced labour, debt bondage, or any form of modern slavery;
• human trafficking, or any work undertaken without informed and freely given consent;
• discrimination on the basis of ethnicity, religion, sex, age, sexual orientation, disability, nationality, or political opinion;
• retaliation against anyone who raises a concern in good faith about any of the above.

We choose suppliers and partners on the same basis. Where we identify a credible concern about practices in our supply chain, we will investigate, raise it directly, and where necessary end the commercial relationship. Concerns may be raised confidentially by writing to .

Stormberry AS is below the size thresholds at which the Norwegian Transparency Act (Åpenhetsloven) imposes formal due-diligence obligations. As Stormberry grows and crosses those thresholds, we will publish a formal due-diligence assessment (aktsomhetsvurdering) in line with section 5 of the Act.