This page explains which personal data the site processes, why, for how long and what your rights are (Article 13 of EU Regulation 2016/679, the “GDPR”). The site shows no ads and sells no data to anyone.
Data controller. The controller is Andrea Coppetta. For any question about your data you can write to privacy@andreacoppetta.it.
Visit statistics. To understand which pages are read and to improve the site, for every page opened the site records the address of the page, the date and, for the first page of a visit, the site you came from. Once per visitor it also records the browser language, the screen resolution, the time zone, the browser, the operating system, the kind of device (phone, tablet or computer) and the country. To find the country, the first time a visitor opens the site the server sends their IP address to the external service ip-api.com, which answers with the country and an approximate location (usually the city or the area): the site stores these two items, not the address. The IP address is not stored in the site’s database: in its place there is a pseudonymised fingerprint, computed from the address with a secret key, which is used to count people without keeping their address. It is still personal data, because whoever holds the key can link it back to the address. Legal basis: the controller’s legitimate interest in knowing how the site is used (Article 6(1)(f) GDPR). Retention: there is no automatic expiry, the data stay until the controller deletes them.
Web server log. Like almost every site, the server notes in a technical log every request it receives: IP address, date and time, address requested, browser and referring site. The log is needed to run the site and to defend it from abuse and attacks. Legal basis: the legitimate interest in the security of the site (Article 6(1)(f) GDPR). Retention: up to 15 days, then the log is deleted automatically.
Sign-in to the private area. Every attempt to enter the private area of the site is kept in the access log with the pseudonymised fingerprint of the IP address, the email typed, the date and the outcome, to protect the area from unauthorised access. Legal basis: the legitimate interest in security (Article 6(1)(f) GDPR). Retention: there is no automatic expiry, the data stay until the controller deletes them.
Contact form. When you write through the form, the site receives your name, your email, your message and the language of the page, and uses them only to answer you. Writing is optional, but without a valid email it is not possible to answer you. Legal basis: replying to your request (Article 6(1)(b) GDPR). Messages stay in the private area of the site. Retention: there is no automatic expiry, the data stay until the controller deletes them. A deleted message stays in the bin until the controller empties it. Each message is forwarded by email to the controller through an email service (ionos.it); the copy received stays in their mailbox until they delete it.
In your browser. The site uses no cookies for its visitors: only whoever enters the private area receives a technical session cookie. In the storage of your browser, and not on the server, the site keeps only the theme and the language you choose, a copy of the public contents of the site (to open it faster on your next visit), the Breach Protocol badge if you win the hidden game and, while the tab stays open, a mark that tells whether the visit has just begun; after an update of the site one more may be added, which avoids reloading the page more than once. None of these data tells who you are, and you can delete them whenever you like from the settings of your browser. Fonts, icons and map are served by the site itself, without contacting other servers.
Who receives the data. The data stay on the server of the site, run by a hosting provider that processes them on behalf of the controller. Messages from the form also pass through the email service that forwards them (ionos.it). To estimate the country of visits, the IP address is sent to ip-api.com. The data are neither sold nor handed over to anyone else.
Your rights. At any time you can ask to access your data, to have them corrected or erased, to restrict their processing and to receive them in a commonly used format (portability). You can also object to the processing based on legitimate interest, such as the statistics. To do so, write to privacy@andreacoppetta.it. If you believe your data are processed unlawfully, you can lodge a complaint with a supervisory authority: in Italy, where the site is run, the Garante per la protezione dei dati personali (https://www.garanteprivacy.it), or the authority of the EU country where you live. The site makes no automated decisions about you and does no profiling.
Last updated: October 3, 2026.