Cookies

This site sets no advertising cookies and no tracking cookies from social platforms. The notice you see once asks permission for Google Analytics, the only tool here that waits for your consent before loading at all.

What the site stores by itself is small and functional: your own choices, kept in your own browser so the site stops asking, three counters that measure one visit inside one tab, and the two session cookies of Microsoft Clarity, the recording and heatmap tool described on the Privacy page. Everything is listed below by its real name, so you can find it and delete it.

The cookieless counter (Umami) is the one exception to the “only with your consent” rule, and it earns it by writing nothing at all: no cookie, no local storage, no session value, no identifier on your device. That is why it starts on the first page view and why the notice does not mention it.

Microsoft Clarity records how pages are used (clicks, scrolls, rage clicks, heatmaps) and keeps two cookies of its own. It runs from the first page view, without asking, because the legal basis is legitimate interest and the identifiers are not used to follow you anywhere else. Everything typed into a field is masked and never leaves the browser. You can read the full description on the Privacy Policy page.

• _clck · Microsoft Clarity session cookie: it ties the recordings of one visit together and remembers that this browser was seen before, so returning visits are not counted as new users. 12 months.
• _clsk · Microsoft Clarity session cookie: it connects consecutive page views inside the same visit into one session recording. 30 minutes, renewed on activity.
• mattia-ciuni-newsletter-subscribed · remembers that you already subscribed, so the newsletter section shows the confirmation instead of the form again. Local storage, no expiry, removed when you use “Use another email” or clear site data.
• mattia-ciuni-analytics-consent · your answer to the Google Analytics notice. Local storage, no expiry, deleted when you clear site data, after which the notice appears again.
• mattia-ciuni-consent-event-v1 · a session marker that prevents the analytics consent choice from being counted twice in one visit. Session storage, deleted when you close the tab.
• mattia-ciuni-page-enter · the moment the page you are reading was opened, so its duration can be written when you move on. Session storage: it disappears when you close the tab and it is empty in a new one.
• mattia-ciuni-session-pages · how many pages this visit has touched, used to read a visit as a path instead of isolated pages. Session storage, deleted with the tab.
• mattia-ciuni-session-start · when this visit began, so the length of the whole visit can be measured when you leave. Session storage, deleted with the tab.

The last three exist because the duration of a page cannot be measured after the fact: they are numbers on a clock, not facts about you, and they never leave your browser as anything but totals attached to a page.

These appear after you choose “Allow” and disappear if you clear your choice. Declining means none of them is ever created and no Analytics script is loaded: the count of visits continues, without any of this.

• _ga, _ga_G-YQS0R94ZQP · Google Analytics cookies, set by Google, used to tell a returning visit from a new one and to group one visit together. Up to 13 months.
• mattia-ciuni-attribution-session-v2 · the current, first and last campaign snapshot for this tab: normalized source, medium, campaign, content, term, campaign ID, landing path, referrer domain and supported click IDs. Session storage, deleted with the tab.
• mattia-ciuni-first-touch-v2 / mattia-ciuni-last-touch-v2 · first and last campaign snapshots. The first-touch persistent copy is created only after Google Analytics consent; the session copy exists for the anonymous first-party measurement. No raw query string is stored.
• mattia-ciuni-first-touch · legacy first-touch key from the previous implementation. It is no longer written and disappears when site data is cleared.
• mattia-ciuni-traffic-source-sent-v2 · a session value that stops the same source event from being counted twice while you browse. Deleted when you close the tab.
• mattia-ciuni-page-view-sent-v2 · a session value that prevents duplicate page-view events during one visit. Deleted when you close the tab.

Nothing here follows you to other websites: there are no advertising identifiers, no pixels, no cross-site profiles, and every key above is readable and deletable from your browser.

The feedback review dashboard at /admin/feedback/ is mine, not a public page. When I log in there, Cloudflare sets one session cookie, __Host-mattia_feedback_admin — HttpOnly, Secure, SameSite=Strict, and it carries a random session id, not the long-lived admin secret. It expires after 12 hours and logging out deletes it on the server. Normal visitors never receive it. Neither counter measures anything inside `/admin`.

Your answer lives in this browser: clear this site's local storage (in every major browser: site settings → cookies and site data → delete) and reload the page, and the notice will ask again. The same clearing removes the newsletter state and the first-touch record, and closing the tab empties the visit counters. The site works perfectly without any of them. Declining stops Google Analytics only: the cookieless count of visits is not something you can switch off from the browser, so it is described in full on the Privacy Policy page instead.

The third-party code that can set something in your browser is Google Analytics, and only with your consent, and Microsoft Clarity, which keeps the two cookies listed above. Umami is loaded too, and it is the reason nothing of it appears in the lists above: it receives the page you are on and a signature of your browser, and returns nothing to your device. The copy of the measurement in my own database is not in those lists either, and for the same reason: the page sends it on its way out and nothing is written here or read back. Everything else runs on this site's own domain or on Cloudflare, which serves the pages. There are no pixels, no social embeds, no advertising identifiers. What each provider does with the data is described in the Privacy Policy.

If a new technology is added, it appears on this page first, with its real name and its purpose. Questions can go to [email protected].