Damiano Cerrone

Privacy.

This page explains what this website records about visitors, why, and what you can ask me. Last updated 7 November 2026.

Who is responsible

Damiano Cerrone, Helsinki, Finland. damianocerrone@gmail.com

Write to this address for anything on this page.

Visit statistics

I count visits with a small script of my own, to see which pages are read and where readers come from. It sets no cookies and does not store your IP address.

For each page view I store:

  • the page address (without anything after a “?”) and whether the page was found
  • the site that linked to the page, if any
  • campaign tags in the address (utm_source, utm_medium, utm_campaign)
  • country, region and city, as estimated by my host from the connection
  • the kind of device, browser and operating system
  • screen width and browser language
  • how long the page was open (up to 30 minutes) and how far it was scrolled
  • which file you downloaded or which outside link you followed (its address only)

To count visitors within a day, the script makes a code from the date, the site, your IP address and your browser’s description, using a secret key. The code changes every day, so I cannot tell that two visits on different days were the same person. The IP address and the browser description are not stored.

Automated traffic (search robots, test browsers) is not counted. The statistics are stored by Cloudflare in the European Union and deleted after 25 months.

To opt out, add #notrack to the address of any page, for example https://damianocerrone.com/#notrack. Your browser then remembers not to send statistics to this site. Add #track to undo it.

Hosting and security

Cloudflare, Inc. hosts this site. To deliver pages and protect them from attacks, Cloudflare processes your IP address and the details of each request, and keeps request logs for a short time. Cloudflare acts on my behalf and is certified under the EU–U.S. Data Privacy Framework.

Content from other services

The pages of damianocerrone.com load their fonts, scripts and images from this site, not from other services.

Some working pages I publish under /dashboard/, such as maps and presentations, load map tiles, fonts or code libraries from other services, for example OpenStreetMap or jsDelivr. Those services receive your IP address when such a page loads.

Things stored in your browser
  • Password-protected pages. After you enter a page’s password, a cookie (cpw_…) keeps you signed in to that page for 30 days. It holds proof of the password, not who you are.
  • Opt-out. If you used #notrack, your browser keeps that choice (_notrack).
Comments on the dissertation

The reading edition of my dissertation at damianocerrone.com/dashboard/phd lets anyone with the link comment on a passage. Search engines are told not to index it.

When you comment, I keep your name, your words, the passage you selected and the time. They are shown with the passage to anyone who opens the page, and stored by Cloudflare in the European Union. Your browser keeps a random code so that it alone can delete what you wrote; I keep only a scrambled copy of that code. The page also remembers your name in your browser, so you do not have to type it again.

To limit unwanted comments, the page counts comments per day with a code made from the date, your IP address and a secret key. The code cannot be turned back into your IP address, and it is deleted the next day. Your IP address is not stored.

Comments stay until their writer or I delete them, or until the reading edition is taken down. You can delete your own from the browser you wrote them in; if others have replied, your name and words go and the replies stay. To have any comment changed or removed, write to the address above. A deleted comment can remain in my backup copies for up to 30 days.

Why this is allowed: you choose to publish your comment (GDPR Article 6(1)(a)) and can take it back at any time; limiting abuse is my legitimate interest (Article 6(1)(f)).

Private tools

damianocerrone.com/food is a private recipe tool behind a password. To stop password guessing, it keeps the IP address of failed sign-in attempts for up to 24 hours. A signed-in session lasts 90 days.

If you write

I use your email to answer you and keep it as long as the exchange is useful for my work.

Why this is allowed
  • Statistics, hosting and security: my legitimate interest in running the site safely and knowing what is read (GDPR Article 6(1)(f)).
  • Password cookies: they are needed to show the page you asked to open.
  • Email: my legitimate interest in answering you, or the steps you asked for before an agreement.

I do not sell data, show advertising or build profiles of visitors.

What you can ask

You can ask to see, correct or delete data about you, to restrict its use, or object to it. Because the visitor code changes daily and no IP address is kept, I usually cannot find statistics that belong to one person; write to me and I will check what I hold.

You can also complain to the data protection authority: Office of the Data Protection Ombudsman, Finland.