Francesco De Giorgio Software engineer · Pisa, Italy
IT EN
Let's talk

Privacy policy, in plain words.

Last updated: 26 August 2026

This page is not a template borrowed from someone else's site. It describes what actually happens when you open degiorgio.dev: which data passes through, who gets to see it, how long it stays and how you can stop all of it. If anything here does not add up, write to me and I will talk you through it.

The short version

  • The site is static: there is no database, and no server of mine that receives or stores what you type.
  • The guided brief never sends anything by itself: it prepares a message that you send, from your own WhatsApp app or your own mail client.
  • Google Analytics only starts if you pick "That's fine" on the banner. Turn it down, or ignore it, and Google's script is never even downloaded.
  • The typefaces are hosted on this domain: no call to Google Fonts or to any other outside network.
  • No advertising, no profiling, no data sold or handed on for commercial purposes.

Who is responsible for your data

The data controller is Francesco De Giorgio, software engineer, based in Pisa, Italy. There is no organisation behind this: I answer personally, from the same address I use to answer quotes.

I have not appointed a data protection officer (DPO): what is described here is the processing of a portfolio site, with no profiling, no login area and no special categories of data.

What this site actually does

It is a static site

The pages you are reading are plain HTML files, served exactly as they are. There is no database, no admin panel, no program of mine listening for your data. Everything that happens while you browse happens inside your own browser.

The guided brief posts nothing to any server

On the contact page there is a form that asks you four questions about your project. It is not a traditional form: as you answer, the site assembles a piece of text and shows it to you as a preview. When you press the button, that text is handed over to your WhatsApp app (through a wa.me link) or to your mail client (through a mailto link). You are the one who presses send, from your own application. Until you do, what you wrote never leaves your device: no copy is sent to me and nothing is stored here.

From that point on the message travels down the channel you chose: WhatsApp under WhatsApp's rules, email under the rules of your mail provider and mine.

The fonts are hosted here

The site's typeface is loaded from this very domain, out of the assets folder. No request goes out to Google Fonts or to any content delivery network: your IP address is never handed to an outside service just to draw the text you are reading.

The data that passes through

1. Technical logs from the server that hosts the site

Like any web server, the provider hosting degiorgio.dev records technical details for every request: IP address, browser and operating system (the user agent), date and time, page requested. They keep the site running, protect it from abuse and explain what went wrong when something breaks. I do not use them to identify people and I do not cross them with anything else.

The site is hosted on Vercel (Vercel Inc.), which acts as a data processor for these logs and retains them under its own policies. Vercel is a US company: any transfer of data outside the European Economic Area happens under the standard contractual clauses approved by the European Commission. Its notice is at vercel.com/legal/privacy-policy.

The degiorgio.dev domain is registered through Aruba (Aruba S.p.A.), which handles DNS resolution for the name.

2. Google Analytics 4, only after you agree

I use Google Analytics 4 (property id G-0NENKMN172) to know how many people visit the site and which pages they read. It is the only measurement tool here, and it works like this:

  • on your first visit a banner appears at the bottom with two buttons, "That's fine" and "No, thanks";
  • Google's script is downloaded and run only if you pick "That's fine". If you decline, or leave without choosing, your browser never contacts Google's servers at all;
  • when it does run, it is configured with IP anonymisation switched on;
  • if you change your mind and pick "No, thanks", the site blocks any further calls to Analytics and clears the cookies already written to your browser.

Google Analytics writes two cookies on your device, _ga and _ga_0NENKMN172: each one is listed, with its purpose and lifetime, in the cookie policy. For this data Google acts as a data processor and also applies its own privacy policy.

3. What you send me when you ask for a quote

If you reach me by email, WhatsApp or phone, I handle the details you choose to give me: your name, your business, a way to reach you and whatever you tell me about the project. I use them to reply, to put together a proposal and, if we end up working together, to run the job. They never end up on a mailing list and they are never passed to anyone for commercial purposes.

4. Browser storage: two technical keys

The site saves two small things in your browser's own storage. They are not cookies, they never travel over the network and no server receives them:

  • fdg-consent (localStorage): holds the value "yes" or "no" and remembers the choice you made on the banner, so I do not ask you again on every page. It stays until you clear the site's data in your browser.
  • fdg-scroll-target (sessionStorage): holds the name of the section you are heading to when you click a link that leads to another page. Its only job is to land you in the right place after the page changes, and it is deleted immediately afterwards.

Why I am allowed to process this data

  • Consent (art. 6.1.a GDPR): Google Analytics and its cookies. No consent, no measurement.
  • Legitimate interest (art. 6.1.f GDPR): the technical logs from the hosting provider, for the security, stability and diagnostics of the site. The interest is keeping a site online that works and is not abused; the impact on you is minimal, because that data is never used to profile you.
  • Pre-contractual steps (art. 6.1.b GDPR): quote requests and the conversations that follow, because that is precisely what you are asking for when you write to me.

How long I keep it

  • Conversations and material tied to a quote: for as long as the discussion needs and, if it turns into a job, for as long as the law requires, starting with tax and accounting obligations.
  • Google Analytics data: for the retention period set on the Analytics property, after which Google deletes it.
  • Technical logs: for the period the hosting provider keeps them for security and diagnostics.
  • fdg-consent: until you clear the site's data in your browser. fdg-scroll-target: the single browsing session.

Who else sees it

Nothing is sold, nothing is passed on for advertising, nothing is profiled. Besides me, this data may be handled by:

  • the hosting provider, to deliver the pages and to keep the technical logs;
  • Google, for Analytics data only, and only if you gave your consent;
  • the services you pick yourself to write to me, meaning WhatsApp or your own mail provider, each under their own terms;
  • the professionals who assist me, my accountant for instance, when a job creates accounting or tax obligations.

Google is a US company and may process data outside the European Union, under the safeguards set out in its own policy. If that does not sit well with you, the fix is one click away: decline on the banner and no data of yours will ever reach Google.

Links to other people's sites

These pages link out to WhatsApp, LinkedIn, GitHub, the App Store, Bandcamp and the sites of the projects I have built. Follow one of them and you leave degiorgio.dev: from that moment the privacy policy of that service applies, not this one. None of those services is loaded inside my pages: they are links, not embedded content, so while you are here they cannot watch you.

Security

The pages travel over an encrypted connection (HTTPS). The exposed surface is kept to a minimum by design: with no database, no login and no admin panel, there is not much left to break into. It is one of the reasons I reach for a static site whenever a project allows it.

Your rights

Articles 15 to 22 of the GDPR give you the right to:

  • access the data concerning you and ask for a copy (art. 15);
  • have it corrected if it is wrong or incomplete (art. 16);
  • ask for it to be erased (art. 17);
  • ask for the processing to be restricted (art. 18);
  • receive it in a readable format and take it elsewhere (art. 20);
  • object to processing based on legitimate interest (art. 21);
  • not be subject to automated decisions (art. 22): there are none here, no algorithm decides anything about you.

You can also withdraw your consent to Google Analytics whenever you like, without explaining why and without making what was measured before unlawful: the "Cookie preferences" button at the bottom of every page is all it takes.

For the other rights an email to info@degiorgio.dev is enough: I reply myself, within the deadlines the law sets. If you believe the processing breaches the regulation, you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

If this page changes

If the way the site works changes, this text changes with it, along with the date at the top. There is no archive of older versions: the one you are reading now is the one that counts.

Get in touch

For any question about your data, or simply to tell me about a project, the road is the same: the contact page, or an email to info@degiorgio.dev. I answer personally, usually within 24 hours. If what you are after is the line-by-line detail of cookies and browser storage, with the full table, it lives in the cookie policy.

An honest note: this text describes how the site really works, and it is meant to be reviewed by a professional adviser before it is published as final.