Privacy Notice

Data Controller

The data controller is:

For any question regarding the processing of your personal data, you can contact me directly at the above e-mail address.

Collected Data

Collect various categories of data based on the features you use on this site:

User Account Data

When you log in through Google or GitHub, we receive from the authentication provider:

• Display Name
• Email address
• Profile photo URL
• Unique identifier of the account (UID)
• Authentication provider used (Google/GitHub)

Community Data

When interacting with the site's community we collect:

• Comments posted on articles
• Article reactions (Like, useful, etc.)
• Bookmarks and saved articles
• Reading History
• Gamification data (XP, badges, streaks)

Analytical Data

Through Google Analytics (GA4), we collect anonymously:

• Visited pages and session duration
• Device type, Browser and Operating System
• Country and city (anonymized IP address)
• Traffic source (referrer, organic search, direct)
• Interaction events (click, scroll, download)

Local Data (Browser)

Some data is saved locally in your browser through localStorage and sessionStorage, never transmitted to our servers:

• Language and theme preferences
• Cookie consent
• Recent tools used
• Reading articles progress
• Local article view statistics

Legal Basis of the Treatment

The processing of your personal data is based on the following legal bases in accordance with Regulation (EU) 2016/679 (GDPR).

Purpose of the Treatment

We use the collected data for the following purposes:

• Improvement and enhancement of the website services (blog, tools, community).
• User account authentication and management
• Comment moderation and prevention of inappropriate content
• Gamification system (XP assignment, badges, streak calculation)
• Aggregate statistical analysis to improve content
• User experience customization (language, theme)
• Site security and abuse prevention

Data Conservation

Account and community data are stored on a Hetzner VPS server located in Nuremberg (Germany), EU, within our own hosted PostgreSQL database to ensure compliance with the European Union's Data Residency requirements.

Local data (preferences, reading history) is stored exclusively in the user's browser through localStorage and sessionStorage and never transits through our servers.

Google Analytics processes data on the servers of Google. We use anonymization of your IP address to ensure that no complete IP addresses are stored.

Conservation period

Third-Party Services

The site uses the following third-party services:

JWT Authentication (Self-Hosted)

Authentication occurs through JWT HS256 managed by the self-hosted Spring Boot backend on Hetzner VPS in Nuremberg, DE. No third-party authentication services are used. The data processed is as follows: e-mail address, displayed name and hashed passwords with BCrypt hash.

PostgreSQL Database (Self-Hosted)

Database used to store comments, reactions, bookmarks, user profiles and game data. Data is stored on the Hetzner VPS in Nuremberg, Germany, EU.

Google Analytics (GA4)

Used for anonymous statistical analysis of site traffic. The property ID is G-S3TS9T66B6. IP anonymization is active. Analytic cookies are enabled only after user consent. Privacy Policy: https://policies.google.com/privacy

Local Font Files

Fonts used (Inter, JetBrains Mono) are hosted directly on our own servers (self-hosted). No request is made to the Google servers for loading fonts, ensuring full compliance with GDPR for this feature.

Cookies and Similar Technologies

For detailed information on the use of cookies, consult our dedicated Cookie Policy.

In summary we use:

• Essential cookies: session management, language preference, authentication token
• Analytical cookies: Google Analytics (_ga, _gid) - activated only with consent
• Preferred cookies: theme, recently used tools, reading progress (localStorage)

Developer tools for Federico Calo's projects on GitHub, built with Angular and Spring Boot.

The chronologies and results generated by the tools can be saved temporarily to the user's web storage for convenience of use, but remain completely under the user's control and may be deleted at any time from their browser settings.

User Rights (EU GDPR Articles 15–22)

As a data subject under the GDPR, you have these rights:

• Right to Access (Article 15): You can request a copy of all the personal data that concerns you.
• Right to rectification (Article 16): You can request the correction of inaccurate or incomplete personal data.
• Right to erasure (Article 17): You can request the deletion of your personal data (“right to be forgotten”).
• Right to limitation of processing (Article 18): You can request the restriction on your data treatment.
• Right to Portability (Article 20): You can request your data in a structured, commonly used and machine-readable format from device.
• Right to object (Article 21): You can oppose the processing of your data based on legitimate interest.
• Right to withdraw consent (Article 7): You can revoke the processing of your data at any time without affecting the lawfulness of previous processing based on that consent.

To exercise any of these rights, send an email to info@federicocalo.dev with the subject line ".". We will respond within thirty days from receipt of your request.

You also have the right to lodge a complaint with the Personal Data Protection Authority ( www.garanteprivacy.it . )

Children's privacy

This website is not intended for users under the age of 16. We do not knowingly collect personally identifiable information from minors under the age of 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at info@federicocalo.dev.

Changes to the Privacy Policy

We reserve the right to update this Privacy Notice at any time, with or without notice. Significant changes will be communicated via an on-site banner. The date of last revision is indicated above.

We invite you to check this page periodically for updates on our data protection practices.

AI Trust and Accountability Registry

In accordance with Article 50 of the EU Regulation 2024/1689 (AI Act), this site publishes a transparent register of interactions with artificial intelligence systems used to generate or support content production (articles, tools, AI responses).

What are we recording?

• Hash SHA-256 of the : cryptographic fingerprint of the prompt, not plain text. Allows independent verification that a given prompt produced a certain output without exposing sensitive data or confidential inputs.
• SHA-256 hash of the final published content fingerprint: ; .
• Generation timestamp, human review and publication date.
• Provider AI e versione modello (es. Cloudflare Workers AI, Ollama locale) + percentuale generata da AI vs. revisione umana.
• Entry Hash, , and the previous entry hash,: a linear Merkle tree that makes logs tamper evident.

What we don't record

• No user data is collected or stored by the application.
• No clear input or output (# only).
• No user identification data, no IPs or devices.

The ledger is publicly accessible on federicocalo.dev/transparency/how-it-works and, for each individual content item via endpoint /api/v1/transparency/<contentType>/<contentId>. No registration is required to read it.

Legal basis: Art. 6.1(f) GDPR (legitimate interest in editorial transparency) + compliance with art. 50 AI Act. You can request the removal of an entry related to your content (e.g., comment) by writing to info@federicocalo.dev.

Contacts