Updated 21 August 2026
This policy explains how cookies are used on ciannavei.dev (the “Site”), the personal portfolio of
Francesco Ciannavei. Questions? Write to francesco@ciannavei.dev.
01 What are cookies?
Cookies are small text files a website stores on your device when you visit. They let the Site remember things between page
loads — for example, whether you agreed to be counted in the visitor statistics. The same rules described here apply to
any similar technology that stores or reads information on your device.
02 How I ask for your consent
On your first visit this panel appears with two equally weighted choices: Accept all and
Reject all. Nothing is measured until you choose Accept all. If you choose
Reject all, no analytics cookie is set and no visit is recorded.
Your answer is remembered so you are not asked again on every page. You can change it at any time — see section 07.
03 The cookies this Site uses
There are no advertising cookies, no third-party trackers and no social or embedded-content cookies. Both cookies below are
first-party. I do not sell or share any data.
tracking
Strictly necessary
- Purpose
- Stores your answer (
true or false) so this panel does not reappear on every page.
- Set when
- You choose Accept all or Reject all
- Duration
- 12 months
tracking_session
Analytics
- Purpose
- Ties the pages you open in one sitting to a single visit, so repeat page views are not counted as separate visitors.
- Set when
- Only after you choose Accept all
- Duration
- Until you close your browser
The tracking cookie holds nothing but true or false. The
tracking_session cookie is a random identifier with no meaning outside my own statistics, and is readable only by
the server, never by scripts in the page.
04 What the analytics collect
If — and only if — you accept, my own analytics record, for each page view:
- the address of the page you opened on the Site;
- the page you arrived from, when your browser sends one;
- your browser identification (the user agent: browser, version, operating system);
- your IP address, used to work out an approximate location (country level);
- the session identifier described above, and the date and time of the visit.
I use this only to see which parts of my portfolio people read. There is no profiling, no advertising and no automated
decision-making.
The analytics run on my own server: nothing is sent to Google Analytics or any other third-party service, and no third-party
cookie is involved. The Site is delivered through Cloudflare’s network, which serves pages from the location closest to
you; my image CDN is my own code and sets no cookies.
05 Legal basis and retention
Under the GDPR and the ePrivacy Directive:
-
the analytics — the
tracking_session cookie and the data above — rely on your
consent, which you give by choosing Accept all and can withdraw at any time;
-
the
tracking cookie is strictly necessary to record and respect your answer, so it does not
require consent.
Retention: visit data is kept for a maximum of 12 months, after which it is deleted.
06 Your rights
Under the GDPR you have the right to access the data relating to you, to have it corrected or erased, to restrict its
processing and to receive a copy in a portable format. In practice I cannot act on any of those, because I have no way
of telling which visits are yours. There is no account and no name here, and the session identifier — the only
handle a visit has — is never shown to you and is gone the moment you close your browser. Article 11 of the GDPR covers
exactly this: where a controller genuinely cannot identify the person, those rights do not apply, provided the controller says
so. This paragraph is me saying so.
The exception is if you can identify your own records for me. While the browsing session is still open, your browser’s
developer tools will show you the value of the tracking_session cookie; send it, with a rough idea of when you
visited, to francesco@ciannavei.dev and I will act on your request. I will not
match a request to an IP address instead: I cannot verify that an address belongs to whoever is asking, and answering on that
basis would mean handing over somebody else’s data.
Two rights are unaffected, because neither of them needs me to know who you are:
-
withdrawing your consent at any time — the cookie button on any page stops all further recording, and
does not affect what was lawfully collected before (see section 07);
- lodging a complaint with your data protection authority.
07 Changing or withdrawing your consent
You can change your mind whenever you like:
- use the cookie button in the bottom corner of any page to reopen this panel and answer again; or
-
delete the
tracking and tracking_session cookies in your browser settings — this panel then
reappears on your next visit.
Most browsers also let you block or delete cookies entirely from their own settings.
08 Changes to this policy
I may update this policy if the Site or the law changes. The date at the top always reflects the current version.
