Privacy Policy
Cittadelle is run by a private individual in Italy, who is the data controller for the personal data described here. An association is being set up to take that role, and this policy will name it as soon as it exists. The controller’s identity and contact details are given on request to anyone entitled to them, and to the supervisory authority.
For anything in this policy — access, correction, deletion, a complaint, or the removal of content that affects someone’s privacy — write to support@cittadelle.com. We answer within one month, as the GDPR requires, and a privacy complaint about published content is acted on straight away (Terms, Section 8).
Necessary to create and run your account: username, email address, and password — stored as a one-way cryptographic hash, which means we cannot read it, and neither can anyone who gains access to the database. Anything optional you choose to add to your profile (bio, photo, banner) is used only to show your profile as you set it. Your username is public by design: it is the signature on everything you contribute.
Sources, posts, verification notes, contestations, Briefs, graph proposals, and anything else you choose to submit. This isn't "collected" in the surveillance sense — it's what you came here to write, visible according to the platform's ordinary rules (publicly, or within the Chambers you belong to). Two things are worth knowing before you write: what you publish carries your username, and it stays in the archive even if you later leave (Section 4). Don't put personal data — your own or anyone else's — in a place built to hold documents.
The text of your Correspondence conversations is stored so you and the other person can see your own message history. It has no public code, cannot be cited, anchored, or surfaced anywhere else on the platform, and we do not read it or use it for anything beyond delivering it to the person you sent it to.
If you use Traces, we store what you choose to follow — and what is traced for you because you created it — together with the level you set for each trace, any private note you add, where you arranged your traces on your map, the suggestions you chose to hide, and when you last opened the page. It is used only to run Traces for you: to show what has changed around the things you follow and how they are linked. It is visible to you alone — not on your profile, not to other members — and no page on the platform shows it to anyone else. The only thing other people can see is an anonymous count of how many members trace something, never who. When you write a code in a public text, the fact that the code appears there is recorded as part of that text, which is public anyway; it is not a record of what you follow.
Images and documents you attach to a source are stored on our cloud storage provider, linked to your account.
We count how much traffic the platform gets, on our own server and only in aggregate: how many visits a day, which pages were opened, which country the visit came from, whether it was a phone or a computer, and which site someone arrived from (the site's name, never the full address). There is no cookie, no identifier, no IP address stored, and no link to your account — a day's tally is a number, and no one, ourselves included, can work backwards from it to a person. The counts are kept separately from one another, so they cannot be combined into a portrait of a single visit. Nothing is sent to any third party: this is why you will not find an analytics company in Section 3.
Cittadelle does not use tracking cookies, advertising pixels, or analytics that profile you. It sets two cookies, both strictly necessary and neither readable by any script on the page: one keeps you signed in (it expires after seven days, or when you sign out), and one recognises a browser you have already signed in from, so that we can email you when your account is signed in from a new one. For that warning we keep, with your account, a short list of the browsers you have signed in from — a generic description such as “Chrome on Windows” and the dates, never the browser's full signature and never an IP address — deleted together with your account. Your browser's local storage is used only to remember, on your own device, your username and a few things for your convenience — which pages you've recently visited, a draft you haven't sent yet, and display choices such as the feed tab you last opened or which layers of your Traces map are switched on. We never see or store that second part ourselves. We do not log IP addresses in our own application code. Honest caveat: the infrastructure providers that host Cittadelle (Section 3) generate standard connection-level logs as a normal part of running any web service, for security and operational reasons — this is outside our direct control and is not used by us to profile you.
Running Cittadelle at all means a small number of outside services handle parts of your data on our behalf, strictly to do the one job we ask of them. None of them may use your data for their own purposes, and none of them are a channel through which we share your data with anyone else.
The application and the database run in Amsterdam, and the nightly backups sit in a private repository. The companies behind the services above are based in the United States, so some processing — support access, storage replication, email delivery — can happen outside the European Economic Area. Where it does, the transfer relies on the European Commission’s standard contractual clauses or the EU–US Data Privacy Framework, under each provider’s own data processing terms. Your data goes nowhere else, to no one else, for no other reason.
We do not sell your data. We do not share it with advertisers or data brokers. We do not use it for advertising, and there is no advertising on Cittadelle. This isn't a policy we might quietly change later — it's the reason the platform doesn't have trackers or ad infrastructure in the first place.
One exception, kept indefinitely on purpose: if you change your username, the previous one is stored, linked to your account, and never released to anyone else — otherwise a stranger could register a name you had signed work with, and links shared before the change would stop working. The same applies to the username of a deleted account, which is retired without being linked to anyone.
For everything else: for as long as your account exists, plus a short period afterwards for security and legal purposes. If you delete your account (Settings → Danger zone), your login credentials and profile are removed. Your source submissions, verification notes and Brief contributions remain in the archive, reattributed to [Departed] — a deliberate design choice, not an oversight: the archive is a documentary record, and losing evidence because a contributor left would undermine the reason it exists. Your private conversations are deleted with your account, for both people in them: the other person will no longer see the conversation, including the messages they wrote in it. What you traced — the list, its levels, your private notes and your map — is deleted with your account too; nothing of it remains in the archive. Backup copies made before the deletion still contain your account until they expire, at most 90 days later; they are used only to restore the platform after a failure, and if that ever happens, any account deleted after the copy was made is deleted again.
Covered in Section 2: no tracking or advertising cookies, and no consent banner, because the only cookies and browser storage we use are strictly necessary or functional — keeping you signed in, warning you when your account is signed in from a new browser, and remembering your own recent activity and display choices on your own device — not tracking or advertising. The aggregate visit count described in Section 2 stores nothing in your browser either: the page tells Cittadelle that a page was opened, and that is the end of it.
Pages load nothing from third parties: fonts and code are served by Cittadelle itself, so opening a page tells no one else that you visited. The one exception is a YouTube video in an audiovisual source, and only if you choose to play it: nothing is loaded from YouTube until you press play. The player then comes from YouTube's privacy-enhanced mode (youtube-nocookie.com), and YouTube's own privacy policy applies to that video.
Under the GDPR, you have the right to:
- Access the personal data we hold about you;
- Correct it if inaccurate — most of this you can already do yourself in Settings;
- Delete it — Settings → Danger zone deletes your account; see Section 4 for what happens to your published contributions and why;
- Export your data in a portable format — Settings → Data & Export already lets you download your sources, notes and Briefs as JSON, CSV or Markdown, or your full archive as a ZIP, whenever you want, without asking us first;
- Object to or restrict certain processing.
To exercise any of these beyond what Settings already gives you directly, contact support@cittadelle.com.
No automated decisions are made about you. Your grade is calculated automatically from how many contributions you have made, but it confers no powers, gives no advantage, and produces no legal or similarly significant effect — and nothing here profiles you or decides anything about you without a person involved.
If a breach ever puts your personal data at risk, we will notify the supervisory authority, and you directly where the risk to you is high, within the deadlines the GDPR sets.
Passwords are hashed, never stored in plain text. Access to the underlying database is restricted to the person operating Cittadelle. No system is perfectly secure and we can't guarantee against every possible breach — but we don't collect more than we need, which limits what there is to lose.
Cittadelle is not intended for anyone under 18, and we do not knowingly collect data from anyone under that age — consistent with the eligibility requirement in the Terms of Service.
If we materially change how we handle your data, we'll show you the updated policy and, where required, ask you to accept it again — recorded the same way as the Terms of Service.
Questions, requests, or concerns about your data: support@cittadelle.com.
You also have the right to lodge a complaint with the Garante per la protezione dei dati personali (the Italian data protection authority), or with the data protection authority of your own EU country of residence if different.