Privacy

Unpolished is published by Eraldo Federico Acchiappati, who is the data controller for this site and the person to write to through the contact form.

This notice covers this website. It does not cover the other properties in the network, which publish their own, nor anything you reach by following a link away from here.

The short version

There is no account to make, no newsletter to join, and no comment box. The site is a set of files served as pages, so on an ordinary visit there is nothing for us to collect and nowhere for us to put it.

Three measurement tools are wired into the site, and none of them load until you accept them. Decline, or ignore the banner, and no analytics script is fetched, no analytics cookie is set, and nothing about your visit reaches Google, Microsoft, or Cloudflare from this page.

What is collected without your consent

A consent record. When you answer the cookie banner, your answer is stored on your own device so the banner does not ask again. It never leaves your browser. Cookies sets out exactly what it holds.

Server logs. Reaching any website means your device tells the server that serves it where to send the page. The server records those requests in the ordinary way a web server does: IP address, time, the page requested, and the browser string your device sent. Those logs exist to serve the site and to keep it standing up under abuse, on the legal basis of our legitimate interest in operating it, and we do not use them to build any picture of an individual reader. They are kept for up to 90 days, longer only while something is being investigated.

What is collected once you accept

Accepting turns on the three tools below. Each is separately switchable in the cookie settings, reachable from the footer of any page.

Google Analytics 4, run by Google. It records which pages were read, how they were reached, roughly where in the world the reader was, and what sort of device was used. It sets cookies to recognise a returning browser across visits. Google acts as our processor for this, and processes the data on its own infrastructure, which includes servers in the United States.

Microsoft Clarity, run by Microsoft. It records how a page was actually used: scrolling, clicks, and a replay of the pointer moving over the page, aggregated into heatmaps. Microsoft acts as our processor, and processes the data on its own infrastructure, which includes servers in the United States.

Cloudflare Web Analytics, run by Cloudflare. It counts page views and where they came from. It sets no cookie and builds no identifier for a returning visitor. It is behind the same consent gate as the other two anyway, because a script that reports your visit to a third party is a script you should get to refuse, cookie or no cookie.

The legal basis for all three is your consent, and consent is the whole of it. Withdraw it in the cookie settings and it stops applying from that moment. That does not undo what was already collected, which is a limit of consent rather than a policy of ours.

Sending data out of the region

Google and Microsoft both process this data in the United States among other places. Those transfers rest on the European Commission's standard contractual clauses together with the EU-US Data Privacy Framework. If that framework is struck down again, the transfers rest on the clauses alone, and we will reconsider whether either tool is worth keeping.

How long it is kept

The consent record: six months, then the banner asks again.

Analytics data: held by each provider under its own retention settings, not ours. Google Analytics keeps event-level data for either 2 or 14 months, depending on how the property is set. Microsoft Clarity and Cloudflare Web Analytics keep what they gather for as long as their own service settings and documentation provide. Aggregated reports that identify nobody may outlast all of these.

Your rights

If you are in the UK or the EEA, the law gives you the right to ask what we hold about you, to have it corrected, to have it deleted, to restrict or object to what we do with it, and to receive it in a portable form. You can withdraw consent at any time without giving a reason, and refusing in the first place costs you nothing here: the site reads exactly the same either way.

Write to us through the contact form and we will answer within one month. In practice the honest answer to most such requests will be that we hold nothing tied to you by name, because we never asked for it. Where the data sits with Google or Microsoft rather than with us, we will tell you so and point you at their own controls.

If you think we have handled this badly, you can complain to your national supervisory authority. Ours is Luxembourg's National Commission for Data Protection, the CNPD, at cnpd.public.lu; you may also complain to the authority where you live. We would rather you told us first, but that is your call, not a condition.

Children

Nothing here is aimed at children under 16, and we do not knowingly collect anything from them.

Changes

We will change this notice when what the site does changes, and the date at the top is the date the current version took effect. Every earlier version is in the site's public commit history, so you can see what changed and when rather than taking our word for it.