Privacy Policy

In short

• No ads, no profiling cookies, no marketing trackers.
• The site does not keep its own log of visits with your IP address.
• I collect personal data only if you send it yourself: by creating an account (to comment, share files or receive the newsletter) or by writing to me through the contact form.
• The online tools work in your browser: what you enter is not saved.

1. Data controller

The data controller is Michele Pelosi, operator of the website https://www.michelepelosi.com, who can be contacted at the email address [email protected].

2. Browsing data

As with any website, showing you the pages requires processing some technical data about the connection (IP address, browser, requested page, date and time). This data is processed by the providers that make the site reachable and secure:

• the hosting provider, which hosts the site and may keep technical logs for the time needed for the service to work and stay secure;
• Cloudflare, which protects the site from attacks and abuse, speeds up its loading and provides the controller with aggregated, anonymous traffic statistics, without tracking cookies;

The controller does not use this data to identify or profile you. Some of these providers may also process data outside the European Union, in compliance with the safeguards provided by the GDPR (for example the EU-US Data Privacy Framework or the standard contractual clauses).

3. Account, comments and newsletter

An account is needed to comment on articles, use file and secret sharing or receive the newsletter. When you create one you provide:

• a public name (it can be a nickname), shown next to your comments;
• your email address, used to confirm the account, to reset the password and, only if you choose to, for the newsletter. It is never published;
• a password, stored only in a non-reversible encrypted form (hash): not even the controller can read it.

The creation date and the date of the last login are also recorded. The comments you publish (text, date and your public name) are visible to everyone. To limit spam and abusive login attempts, the system briefly counts requests, using a code derived (hash) from the IP address or from the account, never the address in clear text.

The newsletter is optional: you receive an email when new articles or tools are published. You can switch it off at any time from your account or with the link included in every email. The emails are sent from the site's mailbox at the hosting provider.

Accounts, comments and subscriptions are stored in the database of the Cloudflare service (Cloudflare D1), which acts as data processor on behalf of the controller.

4. Contact form

If you write to me through the form on the Contact page, the data you enter (name, email address and text of the message) is sent to me by email and is used only to reply to you. It is not published, nor used for newsletters or commercial communications, nor passed on to third parties.

5. Online tools

The tools in the Tools section (for example the QR code generator or the password generator) work directly in your browser: the data you enter is neither sent to nor saved by the controller.

• My IP: shows your IP address and the approximate location derived from it. This data is shown only to you and is not saved. To check whether your connection also uses IPv4/IPv6, the page queries an external service run by Cloudflare (icanhazip.com), which receives your IP address only to send it back to you.
• File and secret sharing: the content is encrypted in your browser before it is sent and the key stays only in the link, so the controller cannot read it. Files and secrets are deleted at the first download or, if the link is never used, within 24 hours of the upload. An account is needed to create a share, with a daily limit of shares. To prevent and counter abuse (legitimate interest of the controller), for each upload the account that made it, the date and time, the name of the original file (not its content) and its size are recorded. This log contains no IP addresses, is kept on the site's server for 30 days and then deleted. No account is needed to open a link you have received. Please do not upload third parties' personal data.

6. Donations

Anyone who wants to support the hosting costs and the development of the site can make a donation from the Support the project page, through the external platform Ko-fi. The payment takes place entirely on Ko-fi and its payment providers: this site neither receives nor stores card or account data. The controller may receive from Ko-fi the name, the email address and any message of the donor, used only to handle the donation and possibly to thank you. Ko-fi's own privacy policy applies to the processing carried out by Ko-fi.

7. Purposes and legal basis

• Operation and security of the site (browsing data, limits against spam and abuse, account management): legitimate interest of the controller in ensuring a working site protected from abuse (Art. 6(1)(f) GDPR).
• Account and publication of comments: performance of the service you request by creating the account (Art. 6(1)(b) GDPR).
• Newsletter: consent, which you can withdraw at any time (Art. 6(1)(a) GDPR).
• Replies to messages sent through the contact form: request of the data subject and legitimate interest in replying (Art. 6(1)(b) and (f) GDPR).
• Handling of donations: performance of the donation requested by the data subject (Art. 6(1)(b) GDPR) and any legal obligations (Art. 6(1)(c) GDPR).

8. Data retention

The account and its data remain until you delete it: you can do so yourself from the Account page, and your comments and newsletter subscription are deleted along with it. You can delete individual comments whenever you want. The controller may remove inappropriate comments, spam or comments in breach of the rules and suspend accounts that misuse the service. The anti-abuse counters delete themselves after 24 hours at most. The filesharing upload log is kept for 30 days, even if you delete your account in the meantime.

Donation data is kept for the time required by legal obligations. Messages received through the contact form are kept in the controller's mailbox for the time needed to handle the request. Data is not passed on to third parties, unless required by law.

9. Cookies and local storage

The site does not use profiling, marketing or analytics cookies. The only ones that may be present are:

• technical security cookies set by Cloudflare to tell real visitors apart from automated bots;
• the account session cookie (__Host-sessione), set only when you log in and valid for 30 days at most, to recognise you while you browse;
• preferences saved in your browser (for example the light/dark theme), which stay on your device and are not sent to anyone.

No consent is required for these technical tools. The links to social profiles (LinkedIn, Telegram, Mastodon) are simple links: this site does not load content from those services, which apply their own privacy rules only if you decide to visit them.

10. Rights of the data subject

Under Articles 15-22 of the GDPR, you have the right to:

• Access your personal data
• Ask for it to be corrected or updated
• Ask for it to be erased ("right to be forgotten")
• Object to the processing or ask for it to be restricted
• Receive your data in a readable format (portability)
• Withdraw your consent at any time, without affecting processing already carried out

11. Right to lodge a complaint

You have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la Protezione dei Dati Personali (www.garanteprivacy.it), if you believe that the processing of your data breaches the law in force.

12. Data security

The controller adopts appropriate technical measures (encrypted HTTPS connection, input validation, protection of storage folders, rate limiting, protection from attacks through Cloudflare) to protect data from unauthorised access, loss or improper disclosure.

13. Changes to this policy

The controller may change this Privacy Policy at any time. Changes are published on this page together with the date of the last update.