Privacy

Who is responsible

I am: Luca Zanussi, a private person in Italy. I run this site on my own, on a server I rent from Contabo, a German hosting company, and manage myself, for no money and on no one else's behalf. Anything about your data goes to the address at the top of this page.

What happens when you visit

Everything travels encrypted. Every connection to this site uses HTTPS, and your browser is told never to use anything else. What you read here and what your browser asks for are encrypted between you and my server: anyone along the way can see that you visited the site, but not which pages.

The server keeps a short log. Like any web server, mine notes each request it answers: your IP address, the description your browser gives of itself, the page asked for, and the time. A collector, Vector, adds the approximate city and network provider that address belongs to, and stores the log in my own monitoring system, Grafana Loki. I use it only to keep the site running and to find what went wrong when it does not. All of it is deleted after a month.

Attacks are blocked, and reported. CrowdSec, an open-source security tool, reads the same log to recognise automated attacks, and blocks the address they come from for a day. When it does, it reports that address and the kind of attack to CrowdSec, the French company behind it, which shares a blocklist with other servers. Ordinary visits are never reported, and its own records are deleted after 7 days.

Visits are counted, not visitors. I run my own copy of Umami, an open-source analytics tool. It sets no cookies and stores no IP address. It turns your address and browser into an anonymous code that changes every day, so it cannot recognise you tomorrow or follow you to any other site. What I see are totals: which pages are read, from which country and city, on what kind of device, and which site linked here. Because nothing in them points back to you, I keep these counts for as long as the site exists, and they never leave machines I control.

One cookie, and only if you ask for it. If you switch language, the site remembers your choice in a cookie called NEXT_LOCALE, which disappears when you close the browser. Your light or dark preference is kept in your browser's own storage and never leaves your device. Neither needs your consent, which is why this site has no cookie banner.

Your browser's privacy signal is honoured. If your browser sends Global Privacy Control, it is asking sites not to sell or share your data. This one does neither, for anyone, so there is nothing extra to switch off. The site says as much in its GPC declaration.

Who else sees anything

Contabo always does, in the narrow sense that the site runs on a server I rent from it: everything passes through its machines, but it only keeps them running and does not look at what runs on them.

Beyond that, very little, and only in these cases.

• CrowdSec receives the address of anything that attacks the site, as described above.

• When you open a full-screen map, your browser loads the map tiles from OpenFreeMap, run by Hyperknot in Hungary, inside the EU. It receives your IP address as any web server would, and says it keeps no access logs.

• When you follow a link to another site, that site's own rules apply.

Everything else comes from my own server. That includes the fonts, the photographs and the pictures in link previews: a video still or a website's icon is fetched by my server and handed to you as its own, so your browser never contacts YouTube, Vimeo or the site being cited. There are no ads, no social buttons, no trackers, no comment forms and no newsletter. I do not sell, share or profile anything.

Your rights

The GDPR gives you the right to ask what I hold about you, to have it corrected or deleted, to limit or object to its use, and to receive it in a portable form. In practice I hold almost nothing that could identify you, but write to the address at the top and I will answer within a month. The legal basis for the log, the attack protection and the visit counts is my legitimate interest in running a working, secure site (Article 6(1)(f) GDPR).

If you think I have got something wrong, you can complain to the Garante per la protezione dei dati personali, or to the data protection authority where you live.

Why this matters to me

Privacy is not something I bolted on at the end. I think reading should not mean being watched, and a personal site is a good place to practise that: it can tell you everything it does, and do very little.

If you want to look after your privacy elsewhere, the Electronic Frontier Foundation's Surveillance Self-Defense guide and its Privacy Badger browser extension are good places to start. Closer to home, EDRi, the network of European digital-rights organisations, and the Hermes Center, its Italian member, defend these rights in the EU and in Italy, from protecting encryption to opposing the scanning of private messages.