Cookie policy

Browse the public site and nothing is stored on your device. No cookie is set, by us or by anyone else.

Log in to the demo and you get one thing: a session cookie, so the next page knows it is still you. That is it.

On login, our authentication layer sets:

• A session cookie (better-auth.session_token, carrying a __Secure- prefix when served over HTTPS). It holds a signed session identifier — not your name, not your email, not your password. It lasts up to 30 days, or until you log out.
• A short-lived companion cookie that caches the signed session for five minutes, so that most page loads do not have to ask the database who you are. It expires on its own after five minutes.

Both are first-party, both are set by us, and both exist for one reason: to keep you logged in. Log out and they are cleared.

Nothing on this site is loaded from a third party that could set a cookie. In particular, the video on the home page is a file we serve ourselves — it is not embedded from a video service, so no video service learns that you watched it.

There is no analytics, no tag manager, no advertising script, no social button, and no tracking pixel anywhere on this site.

This is the part worth reading, because it is a conclusion and not a preference.

Article 5(3) of the ePrivacy Directive (2002/58/EC) says that storing information on a user's device requires consent — but it carves out storage that is strictly necessary in order to provide a service the user has explicitly asked for. The Garante's cookie guidelines of 10 June 2021 say the same in Italian practice: technical cookies need an information notice, not consent, and session cookies that keep a login alive are the textbook example.

Our session cookie is exactly that. You asked to log in; the cookie is what makes being logged in possible; without it the service you requested does not work. It is strictly necessary, so it needs no consent — and since there is nothing else on this site to ask you about, a banner would have nothing to ask.

So this site has a cookie page, which is required, and no cookie banner, which is not. A banner offering a choice that does not exist is not compliance; it is noise.

The reasoning above holds only while the list above stays as short as it is. If anything is ever added to this site that stores or reads information on your device beyond what is strictly necessary, consent becomes mandatory and a banner has to appear before that thing loads.

That includes analytics — all of it, and specifically including Vercel Analytics and Vercel Speed Insights, which are one configuration switch away and are easy to turn on without thinking about this page. It also includes embedded video, embedded maps, social buttons, chat widgets, advertising and any measurement pixel.

Whoever adds one of those is the person who has to add the banner, update this page, and stop the new thing from loading until consent is given. Please treat this paragraph as part of the definition of done.

The straightforward way is not to log in — no login, no cookie. If you are logged in, logging out clears it.

Every browser also lets you see, block and delete cookies from its settings, and you can do that here at any time. Fair warning: block this one and the login stops working, because it is the mechanism by which the login works. That is not a penalty for refusing, it is the same fact stated from the other side.

The session cookie is personal data, so the privacy policy applies to it: who the controller is, how long we keep it, and your rights over it are all set out there.

Questions about this page go to [EMAIL PRIVACY].