Privacy

Last updated 10 August 2026. This explains what SeasonStamp collects, why, and what we deliberately don’t keep.

Who is responsible

SeasonStamp is run by Branislav Lelák in Slovakia, as one person rather than a company. That makes him the person responsible for everything described on this page. For anything here, or to exercise any right below, email support@seasonstamp.com. We answer within 30 days, usually much sooner.

What we collect

When you make an account: your email address, a display name, and optionally your home country. Your password is never stored. Only a scrambled version that cannot be turned back into your password.

When you write a review: whatever you type: rating, pay, hours, housing, season, and your comments. This is published. Your display name appears; your email never does.

When you verify a placement: this is the part worth reading carefully.

Verification: what happens to your email

You give us the sponsor email that names where you worked. We check the signature your sponsor attached to it, take four facts, and throw the message away. It is never written to disk or to our database.

What we keep instead:

• · A fingerprint of the message. A one-way scramble that stops the same email verifying two accounts. It cannot be turned back into anything readable.
• · A fingerprint of the address your sponsor wrote to, and whether it matched your account. Again one-way. We can compare, but we cannot read it back.
• · Your sponsor’s domain (for example interexchange.org) and the year.
• · The subject line, and only while the employer it names isn’t listed on SeasonStamp yet. It lets you add that employer without uploading anything again. It is deleted the moment that’s done.

If your sponsor wrote to a different address than your account uses, we email a code there. That address is held in readable form only while the code is valid, which is 30 minutes, and is deleted as soon as you use it or it expires.

We also log each verification attempt and whether it succeeded, so the system can spot abuse.

We never ask for your passport, and we never ask you to send us a document. There is a second way to verify, described next, for people who have no computer.

Verifying with a photo of your DS-2019

Some students only have a phone, and a phone cannot produce the signed email described above. For them we accept a photograph of the DS-2019. and the important part is what happens to it: the photo never leaves your device.

Your browser reads the text off the picture on your own phone, using software that runs there rather than on our servers. Only that text is sent to us. We never receive the image, so we cannot store it, lose it, or be compelled to hand it over.

From the text we keep:

• · A fingerprint of your SEVIS number: one-way, so we can tell that one form has been used twice without holding the number itself. It is scrambled with a different secret from the one used for emails, so a single leak cannot expose both.
• · Your sponsor, employer, season and programme type: the facts your review is about.

We do not keep your name, your date of birth, your programme number, or the SEVIS number itself. The software that reads the picture is fetched from a public code repository (jsDelivr), which will see that your browser requested it, but never the picture or anything on it.

Why we’re allowed to do this

Your account and reviews: to provide the service you asked for. Your verification: your consent, which you can withdraw at any time by deleting the verification or your account. Keeping the site free of spam and fake reviews: our legitimate interest in a review site that is worth reading.

How long we keep it

• · Account and reviews: until you delete them.
• · Verification fingerprints: until you delete your account.
• · Subject line: until the employer is added, then deleted.
• · Verification codes and the address they were sent to: 30 minutes.
• · Password reset links: 1 hour, or until you use one.
• · DS-2019 photos: never received, so never kept.
• · SEVIS fingerprints: until you delete your account.
• · Attempt logs: 12 months.

Who else sees it

Three companies help us run the site and can technically access data in the course of that: Supabase (our database, hosted in Frankfurt, Germany), Vercel (hosting), and Resend (sending the emails above). We don’t sell data, share it with advertisers, or send it to anyone else.

Vercel also measures how fast pages load for you: which page, roughly where in the world you are, what kind of device and connection, and how long things took to appear. It sets no cookie, gives you no identifier, and cannot link one visit to the next or to your account. It can tell us the site is slow in Poland. It cannot tell us what you read.

Cookies

One, and only when you sign in: a cookie that keeps you signed in. No advertising cookies, nothing shared with advertisers. The page-speed measurement above sets no cookie either, which is why this site still has no cookie banner. There is nothing stored on your device to ask you about.

Your reviews and your anonymity

Your real name is never published. Only your display name. But be aware of something we can’t protect you from: if only a few students worked somewhere in a given season, that employer may be able to work out who wrote a review. Choose a display name that isn’t your full name if that concerns you.

Your rights

Under GDPR you can ask us for a copy of your data, correct it, delete it, object to how we use it, or take it elsewhere. Email the address above. You can also complain to your national data protection authority. In Slovakia, the Úrad na ochranu osobných údajov.

Under 16

SeasonStamp is for people on a J-1 Summer Work Travel, Intern or Trainee programme, all of which require university enrolment or a degree. Don’t use it if you are under 16.

Changes

If we change what we collect, we’ll change this page and update the date at the top. Anything significant, we’ll tell account holders by email.

See also our terms.