Privacy policy

This site does not install profiling or analytics cookies, and does not use localStorage, sessionStorage, or other technologies that store information on your device.

The only possible exception is a Cloudflare security cookie (see below), which appears only when Cloudflare detects suspicious traffic. It is strictly necessary for the site’s security and exempt from consent: that’s why you won’t find the usual banner.

To understand how many people visit the site and which pages they read, we use Umami, an open-source web analytics tool that we host ourselves on our own servers (self-hosted), not a service run by Google or any other third party.

Umami does not use cookies, does not fingerprint your device, and does not follow you from site to site. It records only generic data: page visited, referring site, browser type, operating system and device, language and country.

Your IP address is used only to derive the country and to count several pages of the same visit as one. It is not stored: no data that identifies you remains in the Umami database.

• Why: to understand which content interests readers and to improve the site. Legal basis: legitimate interest (Art. 6.1.f GDPR).
• What we DON’T do: no Google Analytics, no Facebook or other social media pixels, no profiling, no advertising audiences.

What we see are counts, not people.

Every element of this page — text, images, fonts, styles — comes only from our server. There are no fonts loaded from Google, no libraries from external CDNs, no embedded videos or maps.

This is a deliberate technical choice: a site security rule (Content Security Policy) prevents the browser from contacting other domains while you browse here. The only intermediary is Cloudflare, described below.

Traffic to the site passes through the Cloudflare network, which protects it from attacks and automated traffic. To do so, Cloudflare processes your IP address and the technical data of the request, as a data processor on our behalf.

Only when it detects suspicious traffic, Cloudflare may set a technical security cookie.

Cloudflare, Inc. is based in the United States, so some data may be transferred outside the European Union. The transfer relies on the EU-US Data Privacy Framework, in which Cloudflare participates, and on the Standard Contractual Clauses approved by the European Commission. Details are in Cloudflare’s privacy policy.

Like any website, the server hosting these pages automatically records access in a technical log file. Each line contains the IP address of the connecting device, date and time, the requested page, the browser type, and the request outcome.

The IP address is considered personal data, so we’re telling you clearly even though we do nothing with it:

• Why: site security and malfunction diagnostics. Legal basis: legitimate interest (Art. 6.1.f GDPR).
• How long: the copies on the server are deleted after 1 day. One copy goes to our security monitoring system (also on our own server), which keeps it for 30 days; only alerts about attack attempts are kept up to 90 days. Server backups also contain this data and are overwritten on rotation within about 3 months.
• What we DON’T do: we don’t link logs to identified individuals, we don’t use them for statistics or marketing, we don’t share them with anyone.

The only external provider that processes data on our behalf is Cloudflare, for traffic protection and delivery (see above).

We do not share data with anyone else.

The book pages and the Where to buy section contain links to external platforms (Amazon, IBS, Apple Books, Mondadori, Feltrinelli, and others).

As long as you stay here, those sites know nothing about you. But the moment you click, you enter their domain and their rules apply: those platforms will most likely use their own cookies and tracking tools, over which we have no control. If you’re interested in what they collect, their privacy policy is the one to read.

The GDPR (Arts. 15-22) grants you the right to access your personal data, to request rectification or erasure, to restrict or object to processing, to receive it in a machine-readable format to take it elsewhere (portability, Art. 20), and to lodge a complaint with the Italian Data Protection Authority.

In practice, there’s little to exercise here: the only data that passes before us are the server technical logs, which are not linked to your identity and which we don’t consult to find out who you are. Having collected nothing about you, we have nothing to show you, correct, or delete.