Privacy & Cookie Policy

This policy describes how MarcoFLY Framework collects, uses and protects personal data in accordance with the GDPR (EU Regulation 2016/679). It covers the institutional site marcofly.app; the web app app.marcofly.app is covered by section 8 of this same policy — there is no separate document.

1. Data Controller

The Data Controller is Marco Motta — also known as MarcoFLY Motta or MarcoFLY — author of the MarcoFLY Framework (about the author). For any privacy-related requests: [email protected].

2. Data Collected and Purposes

The site is designed to minimize data collection. Categories collected:

Technical navigation data: IP (anonymized at edge level), browser, OS, country (ISO 2-letter code), city (ZIP level), ISP. Aggregate statistics and security.
Essential events (always, anonymous): recorded as VISITA (visit) and ABBANDONO_PAGINA (page leave) — the event names are in Italian in our first-party system, no Google Analytics. They do not require prior consent per IT Privacy Authority 2024 guidelines.
Detail events (only with explicit consent): scroll, click, CTA, generate prompt, clipboard copy. Linked to the anonymous visit hash and — only with your consent — to mff_visitor_id, which connects visits made on different days from the same device. Revocable at any time.
Voluntary data: name and email in contact / newsletter / review forms. Only used to respond or send updates (opt-in). Contact-form messages are also archived on our side, so a request is not lost if the email fails to send.
Donations: payment happens entirely on Polar.sh (we never see payment data). We do keep the donation record — name, email, amount, billing country — for the Supporters Program, the thank-you email and accounting obligations.
Device preferences (localStorage/technical cookies): language, theme, analytics opt-out. Not transmitted.

3. Third-Party Providers (Data Processors)

Cloudflare (USA) — hosting, CDN, edge, D1, bot detection. Privacy Policy
Resend (USA) — transactional email delivery. Email, subject, message content. Privacy Policy
Cloudflare Turnstile (USA) — invisible anti-spam on forms. Privacy Policy
Clerk (USA) — web app authentication. Email and access provider. Privacy Policy
OpenRouter (USA) — routes AI requests from the web app. Prompts and responses transmitted to the underlying AI provider. Privacy Policy
Polar.sh (USA, sub-processor Stripe) — voluntary donations. Merchant of Record: handles EU VAT and tax receipts. Polar Privacy

4. Cookie Policy

Technical and preference cookies only (no profiling, no advertising third parties):

mff_theme (localStorage) — theme preference · until you change it
mff_lang (cookie) — language preference · 1 year
mff_session_hash (sessionStorage) — anonymous hash of a single visit · session only
mff_visitor_id (localStorage) — only if you accept: random identifier that lets us recognise the same device across different days · 12 months, then renewed · deleted automatically if you withdraw consent
mff_cookie_consent (localStorage) — your consent choice · until you change it
mff_analytics_optout (localStorage) — opt-out flag · until you change it

No cookie profiles the user. No blocking prior consent is required for technical cookies.

Manage your choice here — revocation takes effect immediately on future events; events already sent are anonymous by construction and cannot be traced back to you:

No choice made yet: the minimum applies — essential anonymous events only.

5. Extra-EU Data Transfers (Art. 44–49 GDPR)

Providers operate from US servers. Transfers occur via Standard Contractual Clauses (SCCs) adopted under EU Decision 2021/914. Cloudflare and OpenRouter adhere to the EU-US Data Privacy Framework.

6. Legal Basis for Processing

Art. 6(1)(a) GDPR — Consent: newsletter, contact/review forms, detail analytics events.
Art. 6(1)(f) GDPR — Legitimate interest: technical navigation data and aggregate essential events.
Art. 6(1)(b) GDPR — Contract performance: web app account data and donation management.

6-bis. Data Retention (Art. 13.2.a GDPR)

Contact-form messages: up to 24 months after the last interaction, then deleted.
Newsletter / community: while you stay subscribed; revoking deletes the address — unsubscribe here, no account and no confirmation needed.
Donation records: 10 years (accounting and tax obligations).
Anonymous analytics (always): no expiry. Rows carry a daily fingerprint computed on the server from IP address and browser mixed with a random value that changes every day and is destroyed after 48 hours: the IP address is never written, and once that value is gone the fingerprint cannot be recomputed — not even by us. It exists to count how many people visit, not to know who they are.
Analytics with consent: if you accept, those same rows also carry mff_visitor_id, which lets us recognise the same device across different days and reconstruct a browsing path over time. It lasts 12 months. You can withdraw consent at any time: from that moment the identifier is deleted from your device and no longer sent.
Web app account data: as long as the account exists; deletion is immediate (see section 8).
Technical error logs: 90 days, with pseudonymized user identifier.
Administrative action log: 24 months. It records which member of our staff performed operations on accounts (credits, suspensions, deletions) and why, so that we can be held accountable for them. It contains your user identifier and, when the operation requires it, your email address.
Validation submissions (OpenScience): your email is kept until you request deletion — which also removes your rows from the public dataset at the next update; the IP hash, used only for anti-spam, is cleared after 30 days.
Administrative login log: 24 months. It records access attempts to the admin panel (IP address and outcome) for access security; it concerns our staff only, not users.

7. User Rights (Art. 15–22 GDPR)

You have the right to access, rectification, erasure (Right to be Forgotten) and restriction of processing. Write to [email protected] — we'll respond within 30 days. You can lodge a complaint with the Italian Garante (the Controller's supervisory authority) or with the data protection authority of your country of residence.

8. Web app app.marcofly.app

This policy covers the web app as well: there is no separate document to consult elsewhere.

Account: email and sign-in provider, handled through Clerk, plus a profile (language, detected country, device type) in our database.
Conversations: your questions and the model's answers are kept under your account, so you can find and export them. This includes the epistemic state card, extracted from the labels the model declared in your sessions.
API keys (BYOK): encrypted with AES-256-GCM. The plaintext is never accessible to MFF and never appears in the export: only provider, label and last use remain visible.
Attachments: for a file you send we keep only the metadata (name, type, size), never the content. Generated images are not archived on any storage of ours.
Credits: wallet balance and movements, so what you spent stays verifiable.
Export: from the app you can download a file with all your data at any time (Art. 20 GDPR).
Deletion: deleting your account from the app is immediate and irreversible — conversations, keys, wallet and profile are removed in a single atomic operation.
What deletion does NOT touch: the accounts you hold with AI providers (OpenRouter, OpenAI, Anthropic and others) remain yours and are left untouched. We did not create them and cannot act on them: you generated those keys, on your own account, and they may well be in use elsewhere. Deleting your MFF account removes our encrypted copy of the key; revoking it at the provider is your own action, from their dashboard. If you don't, the key keeps working — we simply no longer hold it.
Public landing: the app's entry page uses the same anonymous analytics as the site (section 2) — random session hash, no link to your account.
Technical logs: app errors are recorded for diagnosis with a pseudonymized user identifier (hash), without conversation content, and deleted within 90 days.

What you send to the model passes through the AI provider you chose and is also subject to that provider's policy.