Privacy and cookies
Plain and clear, like everything else. This notice applies to the website comeoggi.com, to the iPhone app «Com'è oggi?» and to the Telegram bot @ComeOggiMeteoBot.
Data controller: Matteo Alemani · hello@madebywx.tech
This is a translation of the Italian privacy notice. In case of doubt, the Italian text prevails.
In short
- No sign-up needed: there are no accounts.
- We show no ads, we do not sell or hand over your data, and we do not profile you.
- No tracking cookies and no third-party analytics or advertising tools, on the website or in the app.
- We only use the data needed to give you the weather and the alerts you ask for, and below we state how long we keep it.
1. Who the data controller is
The data controller is Matteo Alemani, who runs the website and the app «Com'è oggi?» (a Made by WX project). For any privacy question or to exercise your rights, write to hello@madebywx.tech.
We have not appointed a Data Protection Officer (DPO): for a service like this one it is not required.
2. What data we use, why, on what legal basis and for how long
2.1 Forecasts for a place (website, app, bot)
- Data: the coordinates of the point you are looking at, or the name of the municipality or address you search for. Coordinates are only sent if you choose a place or tap «use my location» (your phone or browser asks for your permission).
- Precision (iPhone app): for the forecast, the app sends coordinates with 5 decimal places (about 1 metre); for the «now» radar and official warnings, with 4 decimal places (about 10 metres). The widget uses the coordinates of the chosen municipality, not GPS.
- Why: to calculate and show you the weather for that point. We do not link coordinates to a name or an account.
- Legal basis: providing the service you request (Art. 6(1)(b) GDPR).
- How long: coordinates are not stored in any archive. They only remain in the web server's log for the current day, for about 24 hours at most, and are then removed (section 2.2).
- To find a municipality or an address, our server may forward the search text or the coordinates to Open-Meteo (Switzerland) or to OpenStreetMap/Nominatim. They receive the request from our server, not your IP address.
2.2 Server technical logs
- Data: IP address, date and time, requested address (URL), referring page (referer), browser or app type (user agent), outcome of the request. In the current day's log the IP is complete and, for forecasts, the URL may contain the precise coordinates of the requested point (down to about 1 metre). At the nightly rotation, so after about 24 hours at most, the log is anonymised: the IP is truncated (the last part is zeroed) and the coordinates are removed.
- Why: to run the service, protect it against attacks and abuse, and find and fix errors.
- Legal basis: our legitimate interest in the security and proper functioning of the service (Art. 6(1)(f) GDPR).
- How long: web server logs are rotated daily and deleted after 7 days. System logs are kept for 7 days. The server's access and system logs (auth/syslog) are kept for about 5 weeks and only contain the IP addresses of those who try to log in for administration (SSH), not those of website visitors. The application's internal logs contain neither your IP address nor the requested coordinates: they only record the time, the page called (without parameters) and the outcome. They are reset at every restart and are capped at 3 files of 10 MB.
2.3 Notifications and Live Activities in the iPhone app
- Data: the code Apple assigns to your device for notifications (token), the alerts you chose, the alert location (name and coordinates: the app sends the centre of a cell of about 1.7 km, not your exact position, and the server saves it rounded to about 100 metres), the app type and version (user agent), the date of activation and of the last update, and whether you joined the «beta» alerts trial. The token is not linked to a name.
- Why: to send you weather alerts and Dynamic Island updates for the area you chose.
- Legal basis: providing the service you switch on (Art. 6(1)(b) GDPR), with the notification permission you give on your phone and can withdraw at any time.
- How long: as long as notifications stay on. We delete them when you switch them off or when Apple tells us the device no longer receives them. We remove the subscription after 12 months without use. Technical backup copies of the list are overwritten on rotation and are kept for at most 7 days.
- Notifications go through Apple's push service (APNs): see section 3.
- The diary of alerts sent, described in section 2.4, may also contain the location of app alerts, with the subscription's coordinates.
2.4 Website notifications (browser)
- Data: your browser's push subscription (a technical address of the push service and the keys used to encrypt messages), the alerts you chose, the alert location, the browser type (user agent) and the dates of activation and update. If you use «my location», the website rounds the coordinates to about 100 metres before sending them. If you choose a municipality, we use the municipality's coordinates. The server saves the location rounded to about 100 metres.
- Why: to send you the weather alerts you asked for.
- Legal basis: providing the service you switch on (Art. 6(1)(b) GDPR), with the notification permission you give to your browser.
- How long: as long as notifications stay on. You can switch them off from the «Notifiche» panel and the subscription is deleted. Subscriptions that the browser's push service reports as no longer valid are removed automatically. We remove the subscription after 12 months without use. The backup copies are the same as in section 2.3.
- To measure whether alerts work, we keep a log with no direct identifiers: the alert type, the time, the area rounded to about 1 km and a short, non-reversible code of the subscription. We keep each entry for at most 90 days: the log started on 3 September 2026.
- We also keep a diary of the alerts sent, with the alert type, the time and the alert location, rounded to about 100 metres. We use it for the alerts and for the weather news. At the moment this diary has no automatic expiry: we will add one and update this page.
2.5 Weather reports (/segnala, website and app)
- Data: the phenomenon, the hail size if any, damage yes/no, the time, the place name and the location rounded to about 1 km, and the channel used (website or app). To limit abuse we store a pseudonymous identifier calculated from the IP address and the day: it changes every day and cannot be used to recover the IP.
- If you answer «still there?», we only store the answer, the time and the same daily identifier. Your location is only used to check that you are within 10 km and is not stored.
- Why: to show reports confirmed by radar or lightning anonymously on the map, and to measure how reliable our alerts are.
- Legal basis: providing the service you use by sending the report (Art. 6(1)(b) GDPR). For the anti-abuse identifier: our legitimate interest in protecting the service (Art. 6(1)(f) GDPR).
- How long: 30 days. On the map, reports appear without free text, without photos and without any data about who sent them.
2.6 Telegram bot (@ComeOggiMeteoBot)
- Data: if you write to the bot, Telegram delivers to us the message, the chat number and, if you send it, your location.
- Why: only to reply to you.
- Legal basis: providing the service you request by writing to the bot (Art. 6(1)(b) GDPR).
- How long: message text, name, username and location are not stored. The location is only used to find the nearest municipality. The chat number stays only in the program's memory to limit requests (one every 5 seconds, 60 per day) and is erased every night or at restart. We only keep anonymous counters (how many requests of each type, per day) for 60 days. To stop, just block the bot or delete the chat.
- The Telegram channel @comeoggimeteo only publishes weather content: we cannot see who follows it.
2.7 Data that stays on your device (app)
- Last place viewed: the app remembers it on your phone (name and coordinates) to answer the Siri command «Piove qui adesso?» («Is it raining here now?»). It does not leave your phone.
- Calendar (optional): if you allow it, the app reads your events for the next 7 days to show you the weather for each one. Titles, notes and invitees do not leave your phone. The event address goes to Apple's location service, and our server only receives the coordinates, just like a manual search.
- Diagnostics and crashes: the app contains no analytics or crash-reporting tools and sends no diagnostic data to us or anyone else. If in your iPhone Settings you chose to share analytics with app developers, Apple may send us crash reports according to its own rules.
- You can withdraw these permissions at any time in your iPhone Settings.
2.8 Requests you send us
- Data: your email address and what you write to hello@madebywx.tech.
- Why: to reply to you and, if you exercise a right, to handle the request.
- Legal basis: answering your request (Art. 6(1)(b) GDPR) and, for privacy rights, a legal obligation (Art. 6(1)(c) GDPR).
- How long: 12 months after the request is closed.
3. Who receives the data
We do not sell or hand over data to anyone for commercial purposes. Data only reaches those we need to run the service:
| Who | Role | What data | Where |
|---|---|---|---|
| Hostinger International Ltd | hosts the server (processor) | everything on the server: logs, push subscriptions, reports | server in Manchester, United Kingdom |
| CARTO (CartoDB Inc.) | provides the map background on /mappa (processor) | when you open the map, your browser downloads the images directly from CARTO, which receives your IP (truncated on arrival), browser and the map area viewed. CARTO keeps this data for 30 days | United States |
| Apple | APNs push service, location lookup for calendar addresses in the app, App Store | device token and notification text; calendar event addresses (from your phone) | for European users the controller is Apple Distribution International Ltd (Ireland); data may be stored by Apple Inc. in the United States |
| Browser push services (Google for Chrome, Mozilla for Firefox, Apple for Safari, Microsoft for Edge) | deliver website notifications | the technical address of the subscription and the message, encrypted so that only your browser can read it | depends on the browser: Google LLC, Mozilla Corporation, Apple and Microsoft Corporation are based or have servers in the United States |
| Telegram Messenger Inc. | platform for the bot and the channel (independent controller, not our processor) | what you write or send to the bot, under Telegram's privacy policy | company outside the European Economic Area; for users who signed up from the EU, data is stored in data centres in the Netherlands |
| Open-Meteo, OpenStreetMap/Nominatim | forecasts and address search | only the search text or coordinates, sent by our server (not your IP) | Switzerland / EU |
The other weather data sources (Italian Civil Protection, EUMETSAT, MET Norway, regional networks and the others listed under Fonti e licenze) send data to us: they receive none of your data from us.
Data may be disclosed to authorities only where required by law.
4. Data outside the European Union
Some of the recipients above are located in, or may process data in, the United States. In these cases transfers are covered by:
- the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023), for certified companies: CARTO (CartoDB Inc.), Google LLC and Microsoft Corporation are listed as certified and active;
- Standard contractual clauses approved by the European Commission: used by Apple (for European users the controller is Apple Distribution International Ltd, in Ireland, and transfers to Apple Inc. in the US are governed by these clauses) and by Mozilla Corporation (which states that it uses them for transfers from the EU). CARTO provides for them in addition to the Data Privacy Framework.
The server is located in Manchester, in the United Kingdom. The United Kingdom is covered by a European Commission adequacy decision (Implementing Decision (EU) 2021/1772, renewed on 19 December 2025 and valid until 27 December 2031): data can be transferred there without further safeguards.
Telegram: you use Telegram by your own choice, and Telegram processes your data as an independent controller under its privacy policy. For European users the controller is Telegram Messenger Inc., which is based outside the European Economic Area and has appointed the European Data Protection Office (EDPO, Brussels) as its EU representative. For users who signed up from the EU or the UK, Telegram stores data in data centres in the Netherlands. Telegram states that it may share data with its group companies (in the British Virgin Islands and in Dubai) using the European Commission's standard contractual clauses. From Telegram's servers we only receive what you send to the bot (section 2.6).
5. Cookies and data stored in the browser
The website does not use profiling or tracking cookies, nor third-party analytics or advertising tools. Fonts and libraries are hosted on our own server. That is why you see no consent banner: it is not required for the technical tools below (Art. 122 of the Italian Privacy Code and the Italian Data Protection Authority's Guidelines of 10 June 2021).
Cookies
| Name | Purpose | Duration |
|---|---|---|
wx_report_session |
technical session cookie that protects report submission against automated sending. Only created on /segnala | 30 minutes |
Data stored in the browser (localStorage and sessionStorage) It stays on your device and is not sent to our server. You can delete it at any time from your browser settings.
| Name | Purpose | Duration |
|---|---|---|
theme |
remembers whether you chose the light or dark theme | until you delete it |
cities_v1 |
the places you saved, to show them on the home page | until you delete it |
comeoggi.push |
the location and choices for website notifications | until you delete it |
co-sg-mie |
your recent reports, to tell you whether they were confirmed (at most 10, from the last 6 hours) | until you delete it |
co-sg-voti |
the reports you already answered «still there?» for, so we don't ask twice | until you delete it |
co-sg-confermate |
how many of your reports have been confirmed | until you delete it |
co-sg-pos (sessionStorage) |
the location used on /segnala during the visit | erased when you close the tab |
The website can be installed as a web app: in that case the browser keeps a local copy of the pages (cache comeoggi-v…) to open them faster. It contains no personal data.
6. What we do NOT do
No accounts, no profiling, no advertising, no selling or handing over of data, no tracking cookies, no third-party advertising or analytics tools in the app or on the website. We do not take automated decisions that have legal effects on you (Art. 22 GDPR): weather alerts depend on the place chosen, not on the person.
7. Your rights
At any time you can ask, by writing to hello@madebywx.tech, for:
- access: to know whether we process your data and get a copy (Art. 15);
- rectification of inaccurate data (Art. 16);
- erasure (Art. 17);
- restriction of processing (Art. 18);
- portability: to receive the data you gave us in a machine-readable format (Art. 20);
- objection to processing based on our legitimate interest (Art. 21);
- not to be subject to solely automated decisions (Art. 22): we don't take any.
Where processing is based on your permission, you can withdraw it at any time, without affecting what was done before: just switch off notifications or location on your phone or browser, or turn off notifications from the «Notifiche» panel.
We reply within one month (Art. 12). Since you have no account and the data is not linked to a name, we may ask you for a little more information to find it, for example the alert location or the time of the report (Art. 11).
You always have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it) or with the authority of the EU country where you live or work.
8. Security
The website only works over HTTPS. Data on the server is accessible only to those who run the service. The IP is never stored in clear in reports, and locations shown publicly are always rounded.
9. Changes
This notice may be updated: changes are published on this page, with the date below.
Last updated: 22 October 2026.