PlainSpecs

Privacy policy

Affiliate links: if you buy through links on this page we may earn a commission, at no extra cost to you.

Last updated: October 29, 2026

The short version

  • PlainSpecs sets no cookies of its own for readers. We run no ads and no third-party analytics.
  • We count visits to articles, and clicks on our affiliate links, with our own counter. It uses no cookies and does not store your IP address. After 48 hours only daily totals remain, apart from copies in our encrypted backups. You can opt out at any time, free of charge.
  • Cloudflare delivers and protects the site. It may set a security cookie.
  • Our web server keeps standard access logs, including IP addresses, for security and troubleshooting. They are deleted after about 10 days.
  • If you click an affiliate link, the store you land on, and any affiliate network the link passes through, may set their own cookies. That is how the store knows we sent you.

Who is responsible for your data

PlainSpecs (plainspecs.com) is run by Stefano Mastria. Under data protection law, he is the controller of the personal data described on this page.

Address: Via Romolo Murri 1, Casoria (NA), Italy.

Email: steve@plainspecs.com.

What we collect and why

Server logs

Like most websites, our web server records each request in a log file: the IP address, the date and time, the site and page requested, the request method, the response code, the size of the response, the referring page (when your browser sends it), the time taken to answer and the browser’s user agent string. Cloudflare sits in front of the server, and the server records the visitor’s IP address as Cloudflare passes it on.

We use these logs to keep the site secure, to investigate errors and to stop abuse. We manage the server ourselves, on infrastructure provided by Amazon Web Services (AWS) in its Europe (Milan) region, in Italy.

Cloudflare

All traffic to plainspecs.com passes through Cloudflare, Inc., which provides our network, caching and security services. To do that, Cloudflare processes your IP address and the details of each request. It uses them to deliver pages quickly, to block attacks and automated abuse, and to keep the site available. Cloudflare gives us aggregated statistics about traffic and threats.

Cloudflare may set strictly necessary security cookies, such as __cf_bm or cf_clearance, to tell people from bots or to remember that your browser passed a security check. The __cf_bm cookie expires after 30 minutes of inactivity. Cloudflare’s responses also ask your browser to remember, for 7 days, where to report network errors (Network Error Logging). Cloudflare handles this data under its data processing terms with us and its privacy policy (opens in a new tab).

Our visit and click counter

This site counts visits to its articles, and clicks on the affiliate links in them (the links to the stores and affiliate networks we work with), with an internal counter that uses no cookies and stores nothing on the visitor’s device. The IP address is not stored. For at most 48 hours the site keeps a pseudonymous identifier for each visitor and article, and one for each visitor and link, calculated with a random code that changes every day. They are used only to avoid counting reloads and repeated clicks twice and to estimate the number of unique visitors in a day. They cannot be linked across different articles or links. Once the site has deleted the daily code, the identifiers left on the site can no longer be traced back to a visitor. Our encrypted backups, kept for up to about six months, may also contain these pseudonymous identifiers and the daily code.

For the same period the site keeps pseudonymous counters for each IP address and network, without the address itself, so that repeated or automated requests don’t inflate the counts. After that, only aggregate counts remain. For visits: by day, article, traffic source (for example a search engine, social media or email) and market (United States, United Kingdom, other countries). For clicks: by day, article, link, store or affiliate network, and market.

How it works: on article pages, a small script served from our own domain sends one request per visit to our server, with the page, the referring page and any utm_source and utm_medium values in the link. On article pages that contain affiliate links, a second small script, also served from our own domain, sends one request to our server when you click an affiliate link (or open it in a new tab with the middle mouse button), with the page, the address of the link and our own reference for it. It doesn’t delay or change the link. The daily identifier is calculated from your IP address (for IPv6, your network) and your browser’s user agent string. The market comes from the country that Cloudflare derives from your IP address, and we keep it only as United States, United Kingdom or other.

Counting a click doesn’t tell us who you are or whether you buy anything. Stores and affiliate networks report sales to us separately (see Affiliate links), and we combine those reports with our click totals only as totals, to estimate how much each article and each link earns.

Because the scripts read information in your browser (the referring page, the address of the page and the affiliate link you click), UK law treats the counter as access to information on your device. We rely on the exception for statistics: the counter is used only to produce statistics on how the site is used, such as which articles are read and which links readers follow, so that we can improve it, and its data is not shared except with the service providers that run the site for us.

You can object at any time, free of charge, with the button below. Your choice is kept in your browser’s local storage as ps_counter_optout, and our counter then sends nothing from this browser, for visits or for clicks. The choice applies to this browser only, so use the button again on other browsers and devices. If you clear the site data in your browser, the choice is deleted too. If your browser sends a Global Privacy Control signal, the counter sends nothing either, for visits or for clicks.

The opt-out button needs JavaScript. With JavaScript turned off, our counter cannot run either, so your visits and clicks are not counted.

Many of our links are affiliate links. Each one carries a code that tells the store the visit came from PlainSpecs and, with some affiliate networks, from which page. When you follow one, the link may pass through an affiliate network before it reaches the store. The store’s website and the network may set or read their own cookies, or use web beacons and similar technologies, to credit us with a sale. They may collect information such as your IP address, browser type and operating system, and use it under their own privacy policies. We don’t control these cookies, and our pages don’t set them.

The reports we receive from stores and affiliate networks tell us which product led to a sale (with some networks, also which page), and the commission due. We don’t receive your payment details, and we don’t ask stores for your name or contact details. Our own counter also counts clicks on these links, without cookies (see Our visit and click counter). More in our affiliate disclosure.

Amazon Associates

As an Amazon Associate we earn from qualifying purchases. Third parties, including Amazon and other advertisers, may serve content and advertisements, collect information directly from visitors, and place or recognize cookies on visitors’ browsers. On PlainSpecs this happens only on their own websites, after you follow a link: our pages do not load Amazon scripts, images or widgets.

If you email us

If you write to us, we receive your email address, your message and anything you attach. We use them to reply to you. Our mailbox is on a mail server that we run ourselves, on the same AWS infrastructure in Italy as the site. The emails we send are delivered through Amazon Simple Email Service (Amazon SES).

Search data

We use Google Search Console to see which searches lead to our pages. Google provides these reports as aggregated data. Search Console adds nothing to our pages and sets no cookies on them.

What we don’t do

  • No advertising, and no third-party analytics such as Google Analytics.
  • No social media buttons or tracking scripts from other companies on our pages.
  • No comments, reader accounts or newsletter.
  • We don’t sell personal data.

Cookies and similar technologies

PlainSpecs sets no cookies of its own for readers. These are the cookies and similar technologies used when you read the site:

  • Our cookie notice. When you close it, your browser’s local storage keeps one entry, ps_cookie_notice, so the notice doesn’t come back on every page. It contains only the version of the notice you closed. It never leaves your browser and has no expiry date. You can delete it by clearing the site data in your browser.
  • Your choice about the counter. If you use the button in Our visit and click counter, your browser’s local storage keeps one entry, ps_counter_optout, so the counter sends nothing, for visits or for clicks. It never leaves your browser and has no expiry date. You can delete it with the same button or by clearing the site data in your browser.
  • Our visit and click counter. It sets no cookies and stores nothing in your browser, but its scripts read the referring page and the address of the page and, on pages with affiliate links, note which affiliate link you click, as described in Our visit and click counter.
  • Cloudflare security cookies. Strictly necessary security cookies, as described above. __cf_bm expires after 30 minutes of inactivity.
  • Cloudflare network error reporting. Cloudflare’s responses ask your browser to remember for 7 days where to report connection failures (Network Error Logging).
  • HTTPS only. Our server asks your browser to remember for one year to use only HTTPS on plainspecs.com (HTTP Strict Transport Security).
  • Stores and affiliate networks you visit through our links. Their own cookies, set on their websites after you follow a link, for as long as their own policies say.
  • Site editors. WordPress sets login cookies only for the people who sign in to manage the site. Readers never need to sign in.

In the UK, the Privacy and Electronic Communications Regulations (PECR) require consent before a website stores or reads information on your device, unless an exception applies: when it is strictly necessary for the service you asked for, or, since February 5, 2026, when it only produces statistics to improve the site and you are told clearly and can object simply and free of charge. Our visit and click counter relies on this statistics exception (see Our visit and click counter). We consider everything else listed above either strictly necessary or set by another website, so we show a notice instead of asking for consent. If we ever add analytics, advertising or embedded videos that need your consent, we will ask for it before they load.

Legal bases for readers in the UK

The UK GDPR requires a legal basis for each use of personal data. We rely on:

  • Legitimate interests (Article 6(1)(f)) for server logs and Cloudflare: running a secure, fast and available website.
  • Legitimate interests for the visit and click counter: knowing which articles are read, where readers come from and which of our links they follow, using pseudonymous data that is reduced to daily totals after 48 hours.
  • Legitimate interests for emails: replying to you.
  • Legal obligation (Article 6(1)(c)) when the law requires us to keep or disclose data.

You can object to any processing based on legitimate interests (see “Your rights” below). For the visit and click counter, the simplest way is the button in Our visit and click counter: it works at once, and you don’t need to write to us.

Who receives the data

These service providers process data on our behalf:

  • Cloudflare, Inc.: network, caching and security.
  • Amazon Web Services (AWS), Europe (Milan) region, in Italy: the server that runs the site and our mailbox.
  • Amazon Web Services (Amazon S3): encrypted backups of the site.
  • Amazon Web Services (Amazon SES): delivery of the emails we send.

Stores and affiliate networks receive data directly from your browser when you follow a link, and handle it under their own policies. We may disclose data when the law requires it.

International transfers

Our server and our mailbox are in the European Union, in Italy. UK law recognizes the countries of the European Economic Area, including Italy, as providing adequate protection for personal data. Some of our providers, such as Cloudflare and Amazon Web Services, are based in the United States and operate worldwide, so they may also process data there or in other countries. When data goes to a country outside the UK and the European Economic Area, we rely on the provider’s data processing terms, which include the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, or on the EU-US Data Privacy Framework and its UK Extension where the provider is certified under it.

How long we keep data

  • Server logs: about 10 days. The log files are rotated every day and deleted after about 10 days, or sooner if a file grows too large. Copies may also remain in our encrypted backups (see below).
  • Visit and click counter: pseudonymous identifiers and per-address counters for at most 48 hours on the site; after that, daily totals only. Copies of the identifiers and of the daily code may remain in our encrypted backups (see below).
  • Cloudflare: as described in Cloudflare’s privacy policy.
  • Emails: for as long as we need them to answer you and to handle any follow-up, then we delete them.
  • Backups: encrypted backups of the site, which may contain the data above, are kept for up to about six months: one a day for the last 7 days, one a week for the last 4 weeks and one a month for the last 6 months.

Your rights

If you are in the United Kingdom, you have the right to:

  • get a copy of the personal data we hold about you;
  • have inaccurate data corrected;
  • have your data deleted;
  • ask us to restrict how we use it;
  • object to processing based on legitimate interests;
  • receive your data in a portable format, where this right applies.

To use these rights, email steve@plainspecs.com. We aim to reply within one month. We may ask for information to confirm that the request is yours. For server logs, it helps to tell us your IP address and roughly when you visited. Our visit and click counter does not store IP addresses and deletes its identifiers within 48 hours, so we usually cannot link counter data to you. To stop the counter, use the button in Our visit and click counter.

You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint (opens in a new tab). We would appreciate the chance to fix the problem first.

PlainSpecs is run from Italy, so the EU General Data Protection Regulation (EU GDPR) also applies to the data described on this page. If you are in the European Union or the European Economic Area, you have the same rights listed above, and we rely on the same legal bases (Article 6(1)(f) and Article 6(1)(c) of the EU GDPR). You can complain to the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it (opens in a new tab)), or to the data protection authority of the EU country where you live, where you work or where you believe the problem occurred.

Readers in the United States

We don’t sell personal information, and we don’t share it for cross-context behavioral advertising. We don’t track you across other websites. If your browser sends a Global Privacy Control signal, our visit and click counter sends nothing, as if you had used the opt-out button. Nothing else on the site changes with a Do Not Track or Global Privacy Control signal, because nothing else on the site tracks you.

Children

PlainSpecs is written for adults. It is not directed to children under 13, and we don’t knowingly collect personal information from children.

Security

Every page is served over HTTPS. Access to the server, its logs and its backups is limited to the people who run the site, and backups are encrypted.

Changes to this policy

When we change how we handle data, for example by adding analytics, embedded videos or a newsletter, we update this page before the change goes live and change the date at the top.

Contact

Questions about this policy: steve@plainspecs.com. See also Affiliate disclosure and How we verify.