Privacy & Cookies

This site sets no cookies and does not track you. It counts page views with Umami, which is cookieless and anonymous: it cannot tell who you are, cannot follow you to another site and builds no profile of you.

The only place personal data is collected is the contact form, and only what you type into it. Everything below is the detail behind those two sentences.

When you send a message from the contact page, three things are submitted: your name, your email address and your message, plus the reason you picked (Project, Collaboration or Hello).

That is the whole list. There is no phone field, no company field and no newsletter opt-in. Nothing about you is inferred or added.

The form is delivered by Resend, an email provider, straight to my inbox. It is not stored in a database, a CRM or a spreadsheet: it exists as an email, and it is kept as long as the conversation is useful. Ask me to delete it and it goes.

Three things guard the form against bots. A hidden field no human ever sees, which is discarded server-side if filled; a rate limit on repeated submissions; and Cloudflare Turnstile, a privacy-focused alternative to reCAPTCHA.

Turnstile is the only one that involves another company. It runs on the contact page, sets no cookie, and does not track you across sites or build an advertising profile: it looks at signals from the browser session to decide whether you are a bot, and most people are waved through without clicking anything. Your browser does talk to Cloudflare while it happens, so Cloudflare can see the request. It runs only on the contact page, nowhere else on the site.

There are none. Not for analytics, not for advertising, not for preferences, not for sessions. The analytics described below work without them, which is the reason there is no consent banner on this site.

The site does write one value to your browser's session storage on the home page: a flag remembering that you have already seen the opening animation, so it does not replay when you navigate back. It stays on your device, is never sent anywhere, and disappears when you close the tab.

One, and it is the lightest one I could find: Umami, running on Umami Cloud. It tells me how many people visit and which pages they read, and nothing else.

It sets no cookie, stores nothing on your device and assigns you no persistent identifier. It records the page you are on, where you arrived from, and coarse details your browser sends to every server anyway: country, browser, operating system, screen size. Your IP address is used to derive the country and is not stored. There is no fingerprinting, no session recording, no heatmap, no cross-site tracking, and the data is never sold or shared.

The practical consequence: I can see that a case study was read fifty times. I cannot see that you read it, and no amount of digging in that dashboard would tell me.

The aggregate counts are kept indefinitely, because there is nothing in them to expire: no identifier, no individual, nothing that could be linked back to a person later.

There is no Google Analytics, no advertising pixel and no Vercel Analytics.

If you would rather not be counted at all, any content blocker or a browser's Do Not Track setting stops it, and nothing on the site breaks when it is blocked.

A few parts of the site reach outside my own domain, and each is worth naming precisely because they are the only points at which another company can see that you are here.

Analytics. The Umami script described above is served by Umami Cloud on every page, so their servers see the request. It is cookieless and anonymous, but it is still a third party and belongs on this list.

The showreel. The video on the home page is a still image until you click it. Nothing from YouTube loads before that: no script, no frame, no request. When you do press play it opens through youtube-nocookie.com, YouTube's privacy-enhanced mode, and from that moment Google can see the request. If you never press play, YouTube never learns you existed.

The cover art on the About page. The "currently playing / watching" covers are images served by RAWG and TVmaze. They load with the page, which means your browser asks those two servers for a file and they can see your IP address and browser while doing it. Nothing else is sent, and the titles themselves are chosen by me, not read from any account of mine.

The contact form. Cloudflare Turnstile, described above, is the fourth. It loads only on the contact page.

Each of these companies has its own privacy policy, and I have no control over what they do with a request once it reaches them.

The site is hosted by Vercel. Like every web host, their infrastructure keeps short-lived technical logs of requests, which include IP addresses. That is how a server works rather than a choice I made, and I do not read, export or analyse those logs.

Traffic is encrypted over HTTPS end to end.

I do not sell, rent or trade your information. I do not run advertising or share anything with ad networks. I do not add you to a mailing list because you wrote to me. I do not build a profile of you, and the analytics I do run are incapable of building one.

If a law ever compelled disclosure I would have almost nothing to hand over, which is the point of collecting so little.

Under the GDPR you can ask me to show you what I hold about you, correct it, delete it, or send it to you in a portable format. In practice this means the emails you have sent me, because there is nothing else.

Write to the address below and I will answer within 30 days, usually the same week.

You also have the right to complain to your national data protection authority. In Italy that is the Garante per la protezione dei dati personali.

If what the site does changes, this page changes with it, and the date at the top moves. There is no mailing list to notify, so the date is the honest signal: if it has not moved, nothing has.

Questions about any of this, or a request about your data, go to the address on the contact page. It reaches me directly.