Privacy notice
Last updated: 1 November 2026
This notice explains how personal data is processed when you visit scripta.poppi.cc. The Scripta desktop and mobile apps are local-first and do not send data to us.
1. Data controller
The data controller is Nicola Rizzo, contactable at [email protected]. Scripta is a personal open-source project; no Data Protection Officer (DPO) has been appointed because the conditions in Art. 37 GDPR do not apply.
2. What data we process
2.1 Browsing and security data
The site is a static site delivered through Cloudflare Pages. Like any CDN, Cloudflare processes the technical data needed to serve pages and protect the service: IP address, User-Agent, requested URL, date and time, response code and security information. Cloudflare acts as our hosting provider and data processor; it does not provide us with a list of visitors, and we do not keep named logs. We therefore cannot identify an individual from browsing data, and we do not use it for profiling.
We do not use analytics, advertising pixels, social plugins or profiling. We do not sell personal data.
2.2 Website local storage
The site does not set its own cookies. It uses the browser's local storage (localStorage) to remember your choices:
| Key | Purpose | Type | Duration |
|---|---|---|---|
sc_lang | Selected or automatic language | Necessary | Until cleared |
sc_theme | Dark, light, high-contrast or system theme | Necessary | Until cleared |
sc_consent | Remembers your choice in the banner | Necessary | Until cleared |
sc_opt | Optional cache preference | Necessary | Until cleared |
sc_cache | Release information cache | Optional, consent only | 1 hour |
You can clear this data at any time from your browser settings. Clearing it does not affect your use of the site.
2.3 Release information
The download page reads /releases.json from this same site. Only if that file is unavailable does the browser query the public GitHub API: in that case GitHub receives your IP address and the technical data of the request. The same applies when you open a link to GitHub.
2.4 Email
If you write to [email protected], we process your email address and the content of the message to reply to your request. We do not use the address for newsletters or marketing.
3. Legal basis
- Legitimate interest (Art. 6.1.f GDPR): site security, abuse prevention and technical operation.
- Consent (Art. 6.1.a GDPR): optional release cache. You can withdraw it from the banner or the site settings.
- Performance of a contract or pre-contractual steps (Art. 6.1.b GDPR) and/or legitimate interest: replying to emails you send us.
4. Recipients and transfers
Data may be processed by:
- Cloudflare, Inc. — CDN, DNS and site protection. Cloudflare may process data outside the EU; transfers rely on standard contractual clauses and/or EU-US Data Privacy Framework certification, where applicable.
- GitHub, Inc. — only for release API requests and external links. GitHub may process data in the USA; standard contractual clauses and/or the Data Privacy Framework apply, where applicable.
We do not share data with advertisers, data brokers or other third parties for marketing purposes.
5. Retention
We do not keep logs of our own. Technical and security logs are handled by Cloudflare under the service configuration and its policies, for the time needed to ensure security and continuity; they are not provided to us in a form that identifies individual visitors. Local storage remains in your browser until you clear it. Emails are kept for as long as needed to handle the request and then deleted, unless the law requires otherwise.
6. Your rights
You can exercise the rights under Arts. 15–22 GDPR: access, rectification, erasure, restriction, objection, portability and withdrawal of consent. Write to [email protected]; we will reply within the time limits set by law.
What this means in practice. We have no accounts, user database or server-side archive linked to visitors. Website data stays on your device: you can delete it yourself in your browser settings (“Clear site data”). If you write to us, we will explain how. For technical logs handled by Cloudflare, which do not allow us to identify you, we can explain the processing and, if needed, contact the provider; we cannot erase data we cannot link to you. We delete emails once your request has been handled.
If you believe the processing infringes the GDPR, you can lodge a complaint with the Italian Data Protection Authority or with the supervisory authority in your country.
7. Cookies
This site does not use profiling cookies. Cloudflare may set technical security cookies (for example __cf_bm) when bot protection features are active; they are necessary for the security of the service and do not require consent. The banner you see collects consent for the optional release cache and informs you about local storage.
8. Minors
The site is not intended for children under 14. We do not knowingly collect data from minors. If you believe a minor has sent us data by email, contact us and we will delete the message.
9. Licenses
The code of this website is released under the MIT license. The Scripta app is released under GPL-3.0. Third-party libraries keep their respective licenses.
10. Changes
We may update this notice to reflect technical or legal changes. The current version is always published on this page, with the last-updated date at the top.
Any questions? [email protected].