Privacy, without the fog.

Data controller

The data controller is Gabriele Cogni, operating under the name Project Lunas.

Data we process

Technical and browsing data

When the site is visited, Cloudflare may process technical information required to deliver and protect it, including IP address, requested URL, date and time, routing information, system configuration and security signals.

Public GitHub data

The site asks GitHub's public API for information about the LunasProject repositories. The request is made by the visitor's browser, so GitHub may receive technical request information such as the IP address, device details and request time. The site only displays public repository information.

Enquiries, project submissions and applications

When a visitor submits a commission enquiry, community project or team application, the site sends the fields shown in that form to Project Lunas. These may include the sender's name or handle, email address, project requirements, authorization statements, skills, a project link and an optional portfolio link. The email fallback remains available as a separate contact method.

To limit automated abuse, the submission service creates a one-way keyed fingerprint from the connecting IP address. The raw address is not stored in the Project Lunas submissions database; the fingerprint is used only for rate limiting and is deleted automatically after 24 hours. Hosting providers may separately process technical logs under their own retention settings.

The forms use Cloudflare Turnstile to distinguish legitimate interactions from automated abuse. Cloudflare receives the technical and interaction signals needed to perform this security check; Project Lunas validates the short-lived result on the server and does not use it for advertising or profiling.

Please do not send special-category data, confidential credentials or personal data about third parties unless it is strictly necessary and lawful to do so.

For each accepted form, a transactional notification containing only the submission type and reference code is sent to the Project Lunas mailbox. Names, reply addresses and complete form contents remain in Supabase and are not copied into the notification.

A receipt is also sent to the address entered in the form. It contains the sender's name or handle, request type, reference code and expected response time. If Project Lunas responds from the internal workspace, Resend processes the destination address, subject and response text needed to deliver that message.

Restricted operator accounts

The internal request workspace uses Supabase Auth. For authorized operators this may process the designated email address, authentication method, session identifiers, hashed temporary-code challenges and security or audit events. Temporary codes are single-use, expire after 10 minutes and are not stored in readable form. Network addresses associated with second-factor checks are stored only as one-way keyed fingerprints in the internal log.

Purposes and legal bases

• Site delivery and security: our legitimate interest in providing a reliable and secure website.
• Enquiries and quotations: steps taken at the visitor's request before entering into an agreement.
• Team applications: evaluating a voluntary application and taking requested pre-contractual steps.
• Community submissions: reviewing a voluntary request for feedback, collaboration or possible publication on the public board.
• Form security and abuse prevention: our legitimate interest in protecting the service and limiting automated or excessive submissions.
• Internal access control: our legitimate interest in restricting request-management data to specifically authorized Project Lunas operators and recording administrative changes.
• Legal and administrative records: compliance with applicable obligations and the establishment or defence of legal claims where necessary.

Providers and external services

Data may be processed through the following services:

• Cloudflare — hosting, delivery, Turnstile anti-abuse verification and securityPolicy
• Tuta Mail — email communicationsPolicy
• Supabase — protected form processing, operator authentication and database hosting in the EUPolicy
• Resend — transactional notifications, submission receipts, administrator responses and temporary access codesPolicy
• GitHub — public repository dataPolicy

GitHub and Discord links lead to external platforms governed by their own terms and privacy notices. Cloudflare and GitHub may process data outside the European Economic Area using the safeguards described in their respective privacy documentation.

How long data is kept

• Commission enquiries submitted through the site: automatically deleted from the submissions database after 12 months.
• Team applications submitted through the site: automatically deleted from the submissions database after 6 months.
• Community project submissions sent through the site: automatically deleted from the submissions database after12 months.
• Pseudonymous rate-limit records: automatically deleted after24 hours.
• Restricted operator accounts and their security records: while access remains authorized and afterwards for the period needed for security, audit and legal purposes.
• Records relating to completed work, payments, legal obligations or disputes: for the period required or permitted by applicable law.
• Infrastructure and security data: according to the Cloudflare service configuration and applicable provider retention rules.

Data may be removed earlier when it is no longer needed and no legal reason requires its retention.

Cookies, local storage and analytics

Project Lunas does not currently use Google Analytics, advertising trackers or profiling cookies. The Projects page uses the browser's local storage to cache public GitHub repository data and a timestamp for up to 15 minutes. The restricted operator area also uses browser storage required by Supabase to maintain and refresh an authenticated session, plus the opaque identifier of an in-progress temporary-code challenge. Public visitors do not receive an operator session. The repository cache is used only to improve performance, does not identify the visitor and is removed when it expires.

No non-essential analytics or advertising technology is currently active. If that changes, this notice and any required consent controls will be updated before the technology is enabled.

Your data protection rights

Where the GDPR applies, you may request access, correction, deletion, restriction or portability of your personal data, and may object to processing in the cases provided by law. Where a processing activity relies on consent, consent may be withdrawn at any time without affecting earlier lawful processing.

Send a request to projectlunas@tutamail.com. You may also lodge a complaint with the Italian Data Protection Authority or another competent supervisory authority.