who is responsible

leandro estrella, an artist based in Italy, is responsible for these websites (the data controller). For questions or requests, write to hello@leandroestrella.com.

visitor statistics

Every site uses PostHog, hosted in the EU (Frankfurt), to count visits and see which parts of the work people use. Your browser sends this through relay.leandroestrella.com, a subdomain that PostHog operates for us.

Nothing is stored on your device: no cookies, no local storage. Your IP address is not kept. Visits are counted with an anonymous code that PostHog computes on its servers and changes every day, so you can't be recognised from one day to the next.

What is recorded:

• the page you open, its title, and the page you came from
• clicks and similar interactions, and JavaScript errors
• how fast the page loads
• your browser, operating system, device type, language, screen size and timezone

No screen recordings are made. PostHog keeps this data for up to one year. The legal basis is legitimate interest in understanding how the work is used (Art. 6(1)(f) GDPR).

server logs

The sites are hosted on a server in the European Union (France). Like any web server, it keeps technical logs of each request (IP address, browser, page requested, time) to keep the sites secure and working. They are kept for a limited period and not used for anything else. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

on your device

Visitor statistics store nothing on your device, which is why there is no cookie banner. A few works store a small technical or preference value that they need to work, such as your language choice; each one is named in the section for its site below.

other services

Some works load content or code from other services, such as YouTube, Google, Tumblr, GIPHY or jsDelivr. When they do, your browser connects to them and they receive your IP address, under their own privacy policies. Some of these companies are based outside the EU, mainly in the United States; those transfers rely on the safeguards the companies provide, such as the EU–US Data Privacy Framework.

site by site

• leandroestrella.com
  The portfolio. Nothing beyond analytics and server logs. The contact page only links to email and social profiles, which open on their own sites.
• assistedselfportrait.leandroestrella.com
  Uses your camera to track your face and compose a portrait from images found online. The camera feed is processed entirely in your browser and never uploaded; a screenshot is only saved or shared if you choose to. Portrait images load from GIPHY, which receives your IP address.
• asiwasbingeingaheadoccasionallyisawbriefglimpsesofbeauty.leandroestrella.com
  Plays YouTube videos in privacy-enhanced mode (youtube-nocookie.com). YouTube receives your IP address when the player loads and applies its own policy once a video plays. The site's server picks the videos and records nothing about you.
• cibetti.leandroestrella.com
  A food companion. Recipes are public and load through Google Apps Script, so Google receives your IP address. Your language choice is saved in your browser (cibetti.lang). Only invited people sign in, with Google; Google's sign-in script, and its g_state cookie, load only after you click "sign in". Once signed in, your Google sign-in token is kept in your browser (cibetti.idToken) so you stay signed in, and it is removed when you sign out. Your email, pantry, shopping list and meal plan are kept in a private Google Sheet.
• dadaplaygnd.leandroestrella.com
  Nothing beyond analytics and server logs.
• dissoma.leandroestrella.com
  Some notes embed YouTube videos in privacy-enhanced mode, and some code loads from jsDelivr (a content delivery network). Both receive your IP address.
• flax.leandroestrella.com
  A private tool used only by its owner. Signed out, you see invented sample data: nothing you do is sent anywhere, and your changes vanish on reload. Your language choice is saved in your browser (i18nextLng). Sign-in uses Google and only works for the owner; Google's sign-in script, and its g_state cookie, load only after you click "sign in".
• georgie.leandroestrella.com
  A home library catalog. Browsing loads the catalog through Google Apps Script, so Google receives your IP address; book covers may load from Open Library or Amazon. Your language choice is saved in your browser (georgie.lang). Only the household's admins sign in, with Google (the script and its g_state cookie load only after clicking "sign in"); their email, loans and edits are kept in a private Google Sheet. The barcode scanner uses the camera in the browser only.
• herostratus.leandroestrella.com
  A video work: a looping video and its presentation (PDF), both served from this site. Nothing beyond analytics and server logs. The vimeo link opens on Vimeo's own site.
• icycoaltons.leandroestrella.com
  A generative sculpture assembled from images retrieved from Tumblr, with sound from YouTube in privacy-enhanced mode. Tumblr and YouTube receive your IP address.
• lab.leandroestrella.com
  An archive of experiments. Some pages embed YouTube videos in privacy-enhanced mode or show images hosted on other sites, which receive your IP address.
• linkulino.leandroestrella.com
  A private expense tracker for two people. Signed out, you get a working demo on invented data that never leaves your browser. Your language choice is saved in your browser (linkulino.lang). Only the two partners can sign in, with Google (the script and its g_state cookie load only after clicking "sign in"); expenses are kept in a private Google Sheet.
• sensebombing.leandroestrella.com
  Nothing beyond analytics and server logs.
• stime.leandroestrella.com
  Keeps the piece in sync between visitors in real time through Google Firebase (Realtime Database, europe-west1): Google receives your IP address, and Firebase saves a connection key in your browser. The video uses YouTube in privacy-enhanced mode, and some code loads from jsDelivr.
• tastescrape.leandroestrella.com
  A private tool that copies music taste between Spotify accounts. Signed out, you get a working demo on invented data: nothing is stored, no cookie is set and nothing is sent to Spotify. Only its owner can sign in, with Google (the script and its g_state cookie load only after clicking "sign in"); signing in sets a session cookie (PHPSESSID) that ends when you sign out.

your rights

You can ask to access, correct or delete your personal data, to restrict or object to its use, and to receive it in a portable format, by writing to hello@leandroestrella.com. Because visitor statistics can't be linked to you, it is usually not possible to find your visits among them. You can also complain to the Italian data protection authority, the Garante per la protezione dei dati personali.