A SMALL NOTE.

privacy.

Controller: Luca Bastanzetti, operating as buildinothing. Privacy contact: lucabuildstudio@gmail.com. Updated 2 October 2026.

No account is needed. A signed, essential browser cookie remembers participation for up to one year and helps reject duplicate clicks. An essential request identifier in browser storage keeps retries idempotent, including across reloads. Clearing both, using another browser or blocking storage can defeat best-effort duplicate protection. This is not proof of one unique person.

The backend records accepted click numbers, timestamps and pseudonymous browser identifiers. Network addresses are hashed with a server secret and a daily rotation before storage. Raw addresses are not stored in the experiment database. Hosting providers may process addresses in their own security logs.

Optional PostHog analytics stays off until you allow it. It measures visits, clicks and share actions using an anonymous identifier in browser storage, retained until you revoke consent or clear storage. Session replay and automatic interaction capture are disabled. Analytics respects Do Not Track and Global Privacy Control. You can withdraw consent using the footer control; this deletes the local analytics identifier. Previously collected events remain subject to the provider’s project retention settings.

Click numbers are counts of accepted actions, not a claim about unique humans. Share counts record clicks on a share link, not confirmed X posts.

Claiming a click is optional. If you confirm publication, your chosen alias and/or X handle is displayed beside the click number in the public archive and public number lookup. These are self-declared and unverified. Browser identifiers, request identifiers and network hashes are never published. You can edit or remove your public claim from the original browser; contact the privacy address if you no longer have its cookie. No login, X authorization or private profile is collected.

Network rate-limit buckets expire after 48 hours. Persistent participation identifiers and public claims remain while the permanent experiment archive is available, unless a removal request applies. No payments or marketing emails are collected in this version.

Participation and abuse prevention support the requested experiment and our legitimate interest in keeping its counter reliable. Publication of optional aliases and X handles uses your explicit choice and can be withdrawn by removing the claim. Optional analytics uses your consent; refusing or withdrawing it does not affect participation.

Providers: Vercel for hosting, Supabase for the database in Frankfurt, and PostHog EU for optional analytics. Provider security logs and any international processing are covered by their respective Vercel, Supabase and PostHog policies.

Contact us to request access, correction, deletion or restriction of your personal data, to object to processing based on legitimate interests, or to request portability where applicable. You can complain to the Italian data protection authority, Garante per la protezione dei dati personali. We may need enough information to locate and verify a pseudonymous participation record.