Cookie Policy
Last updated: 10 October 2026 · Draft — pending legal review
This site sets one cookie, and it exists so that signing in works. Beyond that, we count visits with a statistics tool that sets no cookie at all, and the only tracker that can ever run here is the Meta advertising pixel, which stays off unless you say yes in the banner or below.
What a cookie is
A small piece of text a site asks your browser to keep and send back on your next visit. It is how a site can tell that two requests came from the same person — which is what makes staying signed in possible. The same rules cover other storage in your browser, such as localStorage, so those are listed here too.
What we store, in full
| Name | Type | Purpose | Duration | Category |
|---|---|---|---|---|
| db_session | Cookie (first-party) | Keeps you signed in after you use a sign-in code or an emailed link. It holds a random token, not your identity; the server stores only a hash of it. Marked httpOnly, so no script can read it, and Secure, so it never travels unencrypted. | 90 days | Strictly necessary |
| dailybrief:sid | Browser storage | Remembers that somebody is signed in on this browser, so a returning reader sees their brief instead of the signup page while the real check completes. It holds a subscriber number and nothing else, and it is never trusted for access — the cookie above is the only authority. | Until you sign out or clear your browser | Strictly necessary |
| dailybrief:admin | Browser storage | Holds the operator’s administration token on the site owner’s own device. Never set for readers. | Until cleared | Strictly necessary |
What we do not use
No advertising or profiling cookies without your consent. No Google Analytics, tag manager or comparable third-party tracking tool. No social-network buttons or embedded players. The fonts are served from this site, not from an external provider, so until you accept the pixel described above, loading a page contacts nobody but us.
Visit statistics (Vercel Web Analytics)
We count visits with Vercel Web Analytics, provided by Vercel Inc., the company that also hosts this site. It sets no cookie and writes nothing to your device: a visit is recognised by a one-way hash of the request, which Vercel discards after 24 hours. What we see is aggregate only — which pages are read, the site you came from, approximate location, device type and browser — plus how many people sign up, open the checkout and subscribe, by plan. Before anything is sent, your subscriber number is removed from the address and so is every query parameter except campaign tags (utm_…). It cannot tell us who you are, it is not combined with other data and it is never used for advertising. Because it serves only our own aggregate statistics, it does not require your consent.
Advertising measurement (Meta Pixel)
If you accept, we load the Meta Pixel from Meta Platforms Ireland Ltd. It sets the cookie _fbp (about 90 days), keeps the address of the site you came from in this browser’s storage (lastExternalReferrer and lastExternalReferrerTime), and tells Meta which pages you visit and when you sign up or start a paid subscription (with its price, never your email), so we can measure and improve our advertising on Facebook and Instagram. Nothing is loaded and no cookie is set before you accept. Refusing costs you nothing, and you can change your mind at any time below; withdrawing deletes the cookie and those two stored items.
Email measurement
This one is not a cookie, but it belongs in the same conversation. If you agreed to it, the daily brief contains a small invisible image that tells us the message was opened, and its links tell us which stories you read. We use that to rank tomorrow’s edition for you. It is off unless you turned it on, you can turn it off at any time from your account page or from the link in the footer of any brief, and turning it off does not stop the brief.
Staying in control
Signing out removes the session cookie and ends the session on our side as well. You can also delete cookies and site data for this site in your browser settings at any time — nothing will break, you will simply be signed out.
Your rights
The strictly necessary items above do not require your consent, but you are entitled to know about them, which is what this page is for. For access, deletion or any other request, and for the legal basis behind each purpose, see the Privacy Policy. You also have the right to complain to the Italian Data Protection Authority (Garante per la protezione dei dati personali).