Skip to content
GearLibrary

Website privacy policy

Last updated: 6 November 2026

This policy covers the GearLibrary website and the activation key request. For data processed by the app on your device, the app’s own privacy policy applies (Settings → Legal notices), which remains separate. Pursuant to articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).

1. Data controller

Controller: Giorgio Ascoli. Contact: medialibapp@gmail.com.

2. What data and why

  • Key request: email address, date and time of the request, chosen language (Italian or English) and renewal number (how many keys you have already requested with that email). They are used to generate the key bound to your email, to send it to you with the link to download the app and to manage renewals (up to 2). If the author grants you unlimited renewals, your address is noted in a separate list for as long as that permission stays active. Legal basis: performance of your request (art. 6(1)(b) GDPR).
  • The key contains only a cryptographic fingerprint of the email, not the email itself, and is verified by the app on your computer without contacting the website.
  • Abuse protection: to limit repeated requests the website keeps, instead of the IP address, a non-reversible fingerprint (HMAC with a server secret) with a counter, deleted after 48 hours. Legal basis: legitimate interest in protecting the service (art. 6(1)(f) GDPR).
  • Bot check: the form uses Cloudflare Turnstile, which analyses technical browser signals to tell people from automated programs. Legal basis: legitimate interest (art. 6(1)(f) GDPR).
  • Technical logs: the website logs only the outcome of requests (for example “sent” or “limit reached”), without email or IP. The hosting provider may keep access logs under its own privacy policy.

We do not use the data for newsletters, advertising or profiling and do not pass it on to anyone. We only write to you to send the key you requested.

3. Cookies and browser storage

The website sets no cookies and uses no analytics, advertising or profiling tools; fonts are served by the website itself. For this reason no cookie banner is shown.

Cloudflare Turnstile, loaded only on the download page, analyses technical browser data for the bot check and returns a verification code that the server checks once and does not keep. In the configuration used by this site (without “pre-clearance”) Turnstile does not set the cf_clearance cookie; the data it processes is covered by Cloudflare’s Turnstile privacy addendum (cloudflare.com/turnstile-privacy-policy), which states it is used only against bots and not for profiling.

The administration area, reserved to the controller, uses a technical authentication cookie from Cloudflare Access.

4. Providers processing data on our behalf

  • Cloudflare, Inc. — website hosting, request database, bot check (Turnstile) and protection of the administration area (Access).
  • Plus Five Five, Inc., operator of the Resend service (United States) — sending the email with the key, from servers in Ireland (EU).

These providers are based in the United States: both are certified under the EU-US Data Privacy Framework, and their data processing agreements also include the European Commission’s standard contractual clauses.

5. How long

  • Key requests (email, date, language, renewal number): 1 year from the last request made with that address, after which they are deleted automatically.
  • List of addresses with unlimited renewals: as long as the permission stays active or until you ask for erasure.
  • IP fingerprints for rate limiting: 48 hours.
  • Emails sent: Resend’s log (recipient, subject, delivery result) is kept for the period of the plan in use, currently 30 days, then deleted by the provider.

6. Your rights

You can at any time request access to your data, rectification, erasure, restriction, portability, or object to processing (articles 15–22 GDPR) by writing to medialibapp@gmail.com. Deleting your email from the request register does not invalidate a key you have already received, which stays valid until it expires. You have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or the supervisory authority of your country.

7. Minors

The service is not intended for children under 14.

8. Changes

This policy may change if the service or the providers change; the version in force is always on this page, with its update date.

Licence · Disclaimer