Privacy policy

Last updated: 11 October 2026

This page explains what personal data leafranger.dev handles, why, and what you can do about it. The short version: there are no accounts, no ads and no tracking unless you allow analytics, and nothing is sold to anyone.

Who is responsible

The data controller is Mirko Cisternino (Leafranger), a private individual based in Italy. For anything about your data, write to ….

What happens when you visit

Hosting

The site runs on Vercel (Vercel Inc., USA). Like any web server, it receives your IP address, the page you asked for, the time, your browser's user agent and the referring page. These are needed to deliver the page and to keep the site secure, so the legal basis is my legitimate interest (Art. 6(1)(f) GDPR). Vercel keeps these logs only for a short time.

Media

Images, audio and video are served by Cloudinary (Cloudinary Ltd., USA). Your browser downloads them directly from Cloudinary, which sees your IP address and user agent. Legal basis: legitimate interest, to deliver the content you asked for.

Analytics, only if you allow it

If you click Allow in the cookie banner, the site loads Google Analytics 4 (Google Ireland Limited). Before that, nothing from Google is loaded.

What it records: a random identifier, the pages you view, how long you stay, your device and browser, the referring site and an approximate location (country or city). Google Analytics 4 doesn't store IP addresses.
Cookies: _ga and _ga_<ID>, which keep the random identifier for up to two years.
What is off: Google signals and ad personalization are disabled, and the ad-related consent types stay denied.
Why: to see which pages people read, so I know what to improve.
Legal basis: your consent (Art. 6(1)(a) GDPR). Your choice is remembered for six months, then you're asked again.
Retention: reports are kept for the retention period set in Google Analytics, at most 14 months.
Changing your mind: use Cookie settings at the bottom of every page. Withdrawing stops the tracking and deletes the _ga cookies.

Discord status on the contact page

The contact page shows my live Discord status. To do that, your browser connects to Lanyard (api.lanyard.rest, an open-source service) and loads my avatar from Discord's servers (Discord Inc., USA). Both see your IP address. Legal basis: legitimate interest, to show whether I'm around before you write.

Videos

Embedded YouTube videos load from youtube-nocookie.com, and only after you click play. Until then, nothing is requested from YouTube. Once a video plays, Google's privacy policy applies to it.

When you contact me

If you email me, I receive your address and whatever you write, and I use them only to reply. My mailbox is hosted by Google (Gmail). I keep the conversation as long as it's useful to it, and delete it if you ask. Legal basis: your request (Art. 6(1)(b) GDPR) and my legitimate interest in answering.

Donations

The donate button takes you to PayPal's own page, and PayPal handles the payment as an independent controller under its own privacy policy. PayPal shares with me your name, email address and the amount, which I keep only as long as my records and legal obligations require.

Stored on your device

These are technical preferences. They're only read by your own browser, never sent to me, so they don't need consent.

NEXT_LOCALE (cookie, 1 year): your language, so the site opens in it next time.
theme (local storage, until you clear it): light or dark theme.
analytics-consent (local storage, 6 months): your cookie choice and when you made it.
intro-seen (session storage, until you close the tab): skips the intro after the first visit.

Transfers outside the EU

Vercel, Cloudinary, Google and Discord are based in the United States, and Lanyard's servers may be outside the EU too. Transfers to the US rely on the EU-US Data Privacy Framework where the company is certified, and otherwise on the European Commission's Standard Contractual Clauses.

Your rights

Under the GDPR you can ask to access, correct or delete your data, to restrict or object to its processing, and to receive it in a portable format. Where processing is based on consent, you can withdraw it at any time, without affecting what happened before. Write to … and I'll answer within a month.

You can also lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali, or with the authority where you live.

Other things to know

There is no automated decision-making or profiling.
The site isn't aimed at children under 14.
If this policy changes, the new version appears here with a new date.