---
title: "Privacy Policy"
url: "https://blog.sf-paris.dev/en/privacy-policy/"
lang: "en"
translations:
  it: "https://blog.sf-paris.dev/informativa-privacy/"
author: "Simone Flavio"
published: "2023-08-15T14:42:31+00:00"
updated: "2026-11-13T02:37:46+00:00"
categories: []
tags: []
summary: "Last updated: November 12, 2026. This page explains what personal data Espresso Code (this blog) processes, why, for how long, and what your rights are. The short version: there is no advertising, no tracking across websites, and no content loaded…"
reading_time_minutes: 12
word_count: 2725
---

# Privacy Policy

Last updated: November 12, 2026.

This page explains what personal data Espresso Code (this blog) processes, why, for how long, and what your rights are. The short version: there is no advertising, no tracking across websites, and no content loaded from other websites. Visits are counted on this same server, without cookies and with a shortened IP address. Personal data is processed only to deliver and protect the site, to understand which articles are useful, to publish comments, and to answer your emails.

## Who is responsible

The data controller is Simone Flavio Paris, a private individual who writes this blog, based in Rome, Italy.

Contact for anything about your data: [simone@sf-paris.dev](mailto:simone@sf-paris.dev).

There is no Data Protection Officer: the law does not require one for a blog like this.

## What data, why, and for how long

### When you visit a page

Like every web server, the server that hosts this blog records each request:

- your IP address;
- date and time;
- the address you asked for, including anything after the "?" (for example a search term);
- the result code and the size of the response;
- the page you came from (referrer), if your browser sends it;
- your browser's identification string (user agent).

Requests for images, styles, scripts and fonts are recorded too.

- **Why:** to deliver the pages, to find and fix errors, and to protect the site from abuse and attacks.
- **Legal basis:** legitimate interest (art. 6(1)(f) GDPR) in keeping the site working and secure (recital 49 GDPR).
- **How long:** up to 90 days, then they are deleted automatically.

### Visit statistics

To understand which articles and formats are useful to readers, to improve them and to find broken links, the site counts visits with Umami, an open-source analytics program that I install and run on the same server as the blog. Every page loads a small script from this site that, when you open the page or take one of the actions listed below, sends a request to this same site.

How the data is handled:

- **No cookies.** The script stores nothing on your device, except your choice if you ask not to be measured (the [Cookie Policy](https://blog.sf-paris.dev/cookie-policy-eu/) describes it).
- **Shortened IP address.** Before the request reaches the analytics program, the server shortens your IP address: for IPv4 addresses the last number becomes 0 (for example 203.0.113.0), for IPv6 addresses only the first three groups are kept. The program sees only the shortened address, uses it in memory to work out country, region and city and for the fingerprint described below, and does not store it. The web server's log, on the other hand, records statistics requests with the full IP address, like any other request (see "When you visit a page").
- **Visits on the same day.** To count distinct visitors, the program computes a fingerprint (a hash) from the site, the shortened IP address, the browser's user agent and a secret value that changes every day. The fingerprint tells that several pages were viewed on the same day by the same browser; from the next day the same person can no longer be linked to earlier visits, and the IP address cannot be recovered from the fingerprint.
- **Bots.** Visits from automated programs recognised by their user agent are discarded.

Data stored for each page view:

- the address of the page, without anything after the "?" or the "#" and, for a search, without the search term;
- the page title;
- the page you came from (referrer), if your browser sends it, with the same cuts when it is a page of this site;
- the type of page (for example `home`, `archivio` or `pagina`) or, for an article, its format based on reading time (`ristretto`, `espresso`, `lungo`, `doppio`, `moka`);
- browser, operating system and device type, derived from the user agent (which is not stored in full);
- screen size and browser language;
- country, region and city, derived from the shortened IP address;
- date and time, and the fingerprint of the day.

The site also counts a few actions (events). Each one is stored with the same data as a page view of the page where it happens (on searches and 404 errors without the page title), plus only the information listed below, under the names the statistics use. "The page details" means the type of page (`tipo`), the language (`lingua`) and, for an article, format (`formato`), reading time in minutes (`minuti`), category (`categoria`) and months since publication (`mesi`).

- `letto`, an article read: when you reach the end of the text and the page has been visible for at least 15 seconds, with the seconds it was visible (`secondi`, rounded to tens) and the page details; not for password-protected articles;
- `copia-codice`, copying a code block, with its programming language (`linguaggio`); `copia-link`, copying the link to the page;
- `link-esterno`, a click on a link to another website: only the name of the destination site (`host`, for example `github.com`), not the full address;
- `lingua`, switching to another language of the site: the language you left (`da`) and the one you chose (`verso`);
- `commento`, sending a comment: only the fact that it was sent, with the page details, never its text, your name or your email address;
- `ricerca`, a search on the site, instead of the view of the results page: the language (`lingua`), the number of results (`risultati`) and the search term (`termine`), in lower case, only if it is 60 characters at most and does not have the form of an email address, a web address, a long number (such as a phone number) or a code mixing letters and digits (such as a tax code or an IBAN); otherwise only the fact that the term was left out (`escluso`). The filter cannot recognise everything: a person's name you search for, for example, is stored, so do not use the search for personal data;
- `404`, a page not found, instead of the page view: the language (`lingua`) and the address requested (`path`), without anything after the "?".

Apart from the search term described above, the statistics do not collect your name, email address, comment text or anything else you type into forms, and I do not combine them with the server logs, the comments or any other data.

- **Why:** to understand which articles and formats are useful to readers, to improve them, and to find broken links and missing pages.
- **Legal basis:** legitimate interest (art. 6(1)(f) GDPR) in knowing how the blog is read in order to improve it. I balanced it against your rights as follows: data kept to a minimum, IP address shortened before it reaches the analytics program, which does not store it, no cookies, no third-party trackers (the data is collected and stored only on this server), a fingerprint that changes every day, no profiling and no combination with other data, and the option not to be measured with one click.
- **Where:** on the same server as the blog, at OVH in the European Union (Germany). The program runs there: its authors (Umami Software, Inc.) receive no data. The dashboard where the statistics are consulted is reached through Cloudflare (see "Who receives the data").
- **Who sees the statistics:** only me and the software agents I authorise, through a dashboard that is not public, reachable only from an authorised network and protected by a password login (agents use a personal key).
- **How long:** 25 months, then they are deleted automatically.
- **How not to be measured:** use the button in the [Cookie Policy](https://blog.sf-paris.dev/cookie-policy-eu/), which applies to the browser where you press it. If your browser sends the Do Not Track or Global Privacy Control signal, or does not let the site store data, the site does not even load the statistics script (and the button does not appear, because it is not needed). Without JavaScript nothing is measured, and visits by people signed in as authors are never measured.
- **Your rights:** you can object at any time with the button or by writing to me. The statistics contain neither your IP address nor an identifier that lasts more than a day. As long as the server logs are kept (see "When you visit a page"), a visit could in theory be traced back to an IP address by comparing date, time and page with those logs: I do not do that, and once the logs are deleted it is no longer possible. So I cannot find, show you or delete the visits of a single person, and I am not required to keep or combine other data just to identify you (art. 11 GDPR); if you give me information that makes it possible to find them (for example the exact time of a visit and the page), you can exercise your rights as for any other data.

### Protection of the login page

The login page is for authors only. Login attempts above a fixed rate are refused, and an address that sends too many failed attempts is blocked for one hour.

- **Data:** IP address and the related log lines.
- **Legal basis:** legitimate interest in security (art. 6(1)(f) GDPR).
- **How long:** the list of blocked addresses is kept for about five weeks; the copies of the log lines that triggered a block are kept for about one day.

### When you leave a comment

The comment form asks for your name and email address (required) and your website (optional). WordPress also stores your IP address, your browser's user agent and the date.

- **What is public:** your name, your website if you gave one, the comment text and its date. Your email address is never published.
- **Why:** to publish the comment you asked to publish, to moderate the discussion, and to fight spam and abuse.
- **Legal basis:** publishing your comment is the service you ask for (art. 6(1)(b) GDPR); moderation and the storage of IP address and user agent rely on legitimate interest in a safe discussion free of spam (art. 6(1)(f) GDPR).
- **Required data:** without a name and an email address you cannot comment.
- **How long:** published comments stay as long as the article is online, or until you ask for their removal. The IP address and user agent are removed from the comment after 6 months (the comment stays). Comments moved to the trash are deleted for good after 30 days. Comments marked as spam are not published and are deleted for good after 30 days.
- **Moderation:** your first comment waits for approval; after that, comments with the same name and email address are usually published straight away. I am the one who approves, unapproves, marks as spam or deletes comments.
- **Blocking:** someone who repeatedly ignores the comment policy may be blocked from commenting: in that case their email address or IP address is added to a block list, which rejects their comments. The list is kept as long as it is needed to keep abuse away, and I review it at least every 12 months, removing entries that are no longer needed.
- **Emails:** the site does not send emails, so you will not receive notifications about your comment.

If you tick the box that saves your name, email and website in this browser for your next comment, WordPress stores these details in cookies on your device. The [Cookie Policy](https://blog.sf-paris.dev/cookie-policy-eu/) explains them.

### When you write to me

If you email me, I receive your email address, your name if you include it, and what you write.

- **Why:** to answer you.
- **Legal basis:** your request (art. 6(1)(b) GDPR) or my legitimate interest in answering (art. 6(1)(f) GDPR).
- **How long:** as long as needed to handle your request and to be able to show that I handled it, then I delete them.

### Author accounts

There is no public registration. Accounts exist only for me and for people I invite. For each account WordPress stores the username, the email address, a hash of the password, the two-factor authentication settings, and, for each active session, the IP address, the user agent and the login time.

- **Why:** to let authors sign in safely.
- **Legal basis:** legitimate interest in running and protecting the site (art. 6(1)(f) GDPR).
- **How long:** as long as the account exists; sessions end at logout or when they expire.

### Preferences stored on your device

The theme can remember the palette, the light or dark tone and the reading mode you choose, but only in your browser: these choices are never sent to the server. In the same way, your browser remembers if you asked not to be measured by the statistics. The [Cookie Policy](https://blog.sf-paris.dev/cookie-policy-eu/) lists everything the site stores on your device or reads from it.

### Safety copies

I do not make automatic backups. Before updating the site I make a temporary safety copy of the parts that change, which may contain the data above, so that I can go back if something goes wrong. These copies stay on the same server and are deleted within 30 days.

## Who receives the data

- **OVHcloud SAS** (France) hosts the server in its Frankfurt data center, in Germany. It acts as a processor, under the data processing agreement that is part of its terms of service.
- **Apple** hosts the email of the sf-paris.dev domain (iCloud+), so it processes, as a processor, the emails you send me. Apple may also process them in the United States: the transfer relies on the EU-U.S. Data Privacy Framework, under which Apple is certified, and on the European Commission's standard contractual clauses.
- **Cloudflare** provides the DNS for the domain: for the blog it only answers the question "which server is blog.sf-paris.dev?", and your visits to the blog do not pass through Cloudflare. Only the statistics dashboard (stats.sf-paris.dev), used by me and the agents I authorise, is reached through Cloudflare's network, which decrypts and forwards those connections: Cloudflare, Inc. (United States) therefore handles, as a processor, the statistics pages we consult (page addresses, search terms, referrers, countries and cities, never readers' IP addresses) and our logins. The transfer to the United States relies on the EU-U.S. Data Privacy Framework, under which Cloudflare is certified, and on Cloudflare's data processing addendum, which is part of its terms of service.
- **Readers of the blog** see the public parts of your comment.
- **The software agents I authorise** can read the visit statistics, which contain no IP addresses.
- **Visit statistics:** collected and stored only on this server; the program's authors (Umami) receive no data. Consulting them passes through Cloudflare, as described above.
- **Avatars:** the site, dashboard included, does not load Gravatar or any other avatar service.
- **Authorities**, only when the law requires it.

Your data is never sold, rented or used for advertising.

## Transfers outside the European Union

The server is in the European Union. A transfer outside the EU can happen only through the services listed above that are based in the United States (Cloudflare for the statistics dashboard, Apple for email); where it happens, it relies on the EU-U.S. Data Privacy Framework or on the European Commission's standard contractual clauses.

## Your rights

You can ask me, at any time and free of charge:

- to access your data and get a copy of it;
- to correct it;
- to delete it (for example a comment of yours);
- to restrict its use;
- to receive the data you gave me in a common, machine-readable format.

**Right to object.** When I process your data on the basis of legitimate interest, you can object at any time, for reasons related to your particular situation. I will then stop, unless I have compelling legitimate grounds or need the data to establish, exercise or defend legal claims.

Write to [simone@sf-paris.dev](mailto:simone@sf-paris.dev). I will answer within one month. I may ask you for information to confirm that the data is yours (for example, to send the request from the email address used in the comment).

For the visit statistics, how to object and what can be requested is explained in their section.

You also have the right to lodge a complaint with the Italian data protection authority, the [Garante per la protezione dei dati personali](https://www.garanteprivacy.it/), or with the authority of the EU country where you live or work.

## Automated decisions

No decision with legal or similarly significant effects on you is taken by automated means, and there is no profiling.

## Changes

If this policy changes, the new version is published on this page with a new date. This page is also available in [Italian](https://blog.sf-paris.dev/it/informativa-privacy/). If the two versions differ, the Italian version prevails.