Skip to content
Legal Codes

Privacy policy

Last updated:

In brief

The app does not collect or send personal data to the developer. All data (bookmarks, notes, preferences, chosen country) is saved only on your device and stays under your control. You can export it at any time as a JSON file and import it on another device.

The app contains the legal texts of several countries (currently Italy, Spain, Poland and France). To suggest a country, it reads the device's language, region and time zone, only on the device, without location and without sending them to anyone.

1Data controller

The Legal Codes app (Android, iPhone and iPad, web version) and the website codicigiuridici.pages.dev are developed and run by a private individual. For any question about privacy you can write to: inprogrammazione@gmail.com

2Data collected

The app does not collect or send personal data to the developer. There are no proprietary analytics, no data is sent to the developer's servers and no authentication is required: the app can be used without creating an account or logging in. This applies to all countries and to all sources of the texts.

When the app downloads or updates the legal texts from the CDN (section 5), your IP address is necessarily disclosed to Cloudflare, the CDN provider, not to the developer. See sections 6 and 8 for details on this processing.

In the Android and iOS app, the app update and review request functions go through Google Play and the App Store (section 6): on iOS the check for a new version is a request sent directly to Apple's servers, which receive the device's IP address. In this case too, the developer does not receive personal data.

3Data saved locally

The following information is saved only on your device and is never sent:

  • the country chosen for the legal texts (section 4)
  • display preferences (theme, text size)
  • bookmarks and notes on articles, kept separate for each country
  • reading history, kept separate for each country
  • favourite codes, kept separate for each country
  • content update settings
  • counters for the review request: date of first launch, number of launches, date and number of requests already shown

Users can, at any time, manually export favourites, bookmarks and notes to a JSON file saved on their own device (Settings → Backup → Export backup) and reload it later, including on another device, using the import function (Settings → Backup → Import backup). The file also contains the code of the country it refers to (for example “it” or “es”), so that a backup of one country cannot be imported into another by mistake. The file remains under the user's exclusive control: it is not uploaded to any cloud service or sent to the developer.

4Choosing the country without location

The app contains the legal texts of several countries, each with its own source (section 7). At first launch it suggests a country by reading, only on the device, three pieces of information that the system makes available to every app: the device's language, region and time zone (in the web version, those of the browser). If they agree, the country is chosen without asking; otherwise you are asked to choose it. The device language also decides which of the available languages the interface is shown in: this too happens locally and the language is not saved.

  • no permission: the app does not ask for access to your location and does not use GPS, mobile network, SIM or other location services; it does not even read the store's country
  • nothing is sent: language, region and time zone are not saved or sent to the developer or to third parties; they are only used to decide at that moment
  • choice saved only locally: the chosen country remains among the device preferences and you can change it at any time from Settings

A technical consequence: the app downloads the texts from the CDN of the chosen country (section 5). Cloudflare, which runs the CDNs of all countries, therefore sees the IP address and the name of the CDN contacted, as with any download. The app does not add any parameter about the country or the user to the requests.

5Internet connection

The app accesses the Internet only to:

  • download the texts of the codes from the CDN of the chosen country at first launch and when you change country
  • check for and download content updates, always from the CDN of the country in use
  • check whether a new version of the app is available: on Android through Google Play, on iOS through the App Store (section 6)
  • on Android and iOS, show the store's window to rate the app (section 6)
  • open in the browser a link that you tap: the official source of a text, the reuse conditions, the app's website (section 7)

The legal texts are downloaded from the Cloudflare CDNs, one for each country, and saved locally on the device:

  • Italy: codicigiuridici-cdn.pages.dev
  • Spain: codicigiuridici-cdn-es.pages.dev
  • Poland: codicigiuridici-cdn-pol.pages.dev
  • France: codicigiuridici-cdn-fra.pages.dev

The CDNs are all on Cloudflare Pages and receive the same treatment (sections 6 and 8). This involves sending your IP address to Cloudflare.

The app does not show advertising, does not use third-party ad networks, does not integrate authentication services (Google Sign-In, Apple Sign-In, etc.) and does not collect the device's advertising identifiers.

6Third-party services

Cloudflare Pages hosting and CDN

The website, the web version of the app and the CDNs with the legal texts of all countries are delivered through Cloudflare Pages. For the normal operation of the service, Cloudflare processes the IP address of the connection and the HTTP metadata of the request (URL, user agent) and may keep them in its operational logs for security, anti-DDoS and bot management purposes. Cloudflare may also set the technical cookie __cf_bm (duration 30 minutes) to distinguish legitimate traffic from automated traffic; it is a strictly necessary cookie under Article 122 of the Italian Privacy Code, Article 22 of the Spanish LSSI, Article 399 of the Polish Prawo komunikacji elektronicznej, Article 82 of the French “Informatique et Libertés” law and the ePrivacy Directive, and does not require prior consent.

The developer does not access Cloudflare's individual logs and does not receive visitors' IP addresses: only aggregate statistics are visible in the Cloudflare dashboard (number of requests, bandwidth used, status codes). The processing carried out by Cloudflare is subject to Cloudflare's Privacy Policy.

Legal basis: legitimate interest (Article 6(1)(f), GDPR) in the security and proper functioning of the service. Retention: logs are kept by Cloudflare according to its own retention policy; the developer does not determine how long. For this processing (hosting, security, anti-DDoS) Cloudflare acts as an independent controller.

Cloudflare Web Analytics anonymous measurement

To measure the site's traffic in an aggregate and anonymous way (visits per page, country, browser, referrer), the site and the web version of the app use Cloudflare Web Analytics. The service:

  • does not use cookies or persistent identifiers
  • does not profile users
  • does not store the IP address (used only in real time to derive the country)
  • does not allow any cross-site tracking

For this reason no prior consent is required (ePrivacy Directive, Article 122 of the Privacy Code, Article 22 of the LSSI, Article 399 of the Prawo komunikacji elektronicznej, Article 82 of the “Informatique et Libertés” law). The developer sees only aggregate and anonymous data. More details in the specific privacy policy of Cloudflare Web Analytics.

Legal basis: legitimate interest (Article 6(1)(f), GDPR) in measuring the use of the site in aggregate form, with minimal impact on privacy given the absence of persistent identifiers. For this processing, enabled and configured by the developer, Cloudflare acts as processor (Article 28 GDPR) under its own Data Processing Addendum. This service is active only on the site and the web version, not in the Android and iOS app or on the text CDNs.

Google Play and App Store updates and reviews

In the Android app, at launch the in-app update function of Google Play is used to find out whether a new version is available and, if the user agrees, to download it without leaving the app. The check is carried out by the Google Play Store installed on the device.

In the iOS app, at launch (at most once per session) the app asks the App Store's public lookup service (itunes.apple.com) which is the latest published version. The request contains only the app identifier and a fixed store country code, the same for all users and independent of the country chosen in the app: no user data. Apple receives the device's IP address, as with any connection. The comparison with the installed version happens on the device: if a newer one exists the app reports it only once and, if the user taps “Update”, opens the App Store page. The update is installed from the App Store, not from the app.

In the Android and iOS app, after at least 7 days from first launch and 5 launches, the app may ask the store to show its official window to rate the app (Google Play In-App Review API, the App Store's rating request). The request is made at most once every 90 days and no more than 3 times in total; it is the store that decides whether and when to show it. The developer does not know whether the user has rated the app and receives no data about the request: any reviews left are published and managed by the store, like any review written directly in the store.

This processing is carried out by Google and Apple through their services (the store installed on the device, linked to the account with which the app was downloaded, and, for the version check on iOS, the App Store servers). For it Google and Apple act as independent controllers according to Google's Privacy Policy and Apple's Privacy Policy. The developer receives no identifiers or personal data from these functions. They are not present on the site or in the web version.

Legal basis: legitimate interest (Article 6(1)(f), GDPR) in distributing app updates and collecting public ratings on the store.

7Sources of the texts and external sites

The legal texts come from the official sources of each country, but the app does not download them from those sites: it takes them from its own CDNs (section 5). The sources are contacted only if you tap a link that leads to their site, which opens in the browser. Each source processes its visitors' data according to its own privacy notice, of which it is an independent controller; the developer receives nothing.

Italy Normattiva

The texts are not downloaded from Normattiva but from the app's CDN (section 5): the app does not contact Normattiva on its own. Only if you tap a link to Normattiva.it (for example “Open on Normattiva” or a reference to another law) does the site open in your browser. From that moment the Normattiva privacy and cookie policy applies, and its controller is the Istituto Poligrafico e Zecca dello Stato. The developer does not receive any data.

Spain BOE

The texts are not downloaded from the BOE but from the app's CDN (section 5): the app does not contact the BOE on its own. Only if you tap a link to the BOE (for example “Open on the BOE” or the link to the reuse conditions) does the site open in your browser. From that moment the BOE data protection information applies, and the party responsible for it is the Agencia Estatal Boletín Oficial del Estado. The developer does not receive any data.

Poland ISAP

The texts are not downloaded from the ISAP but from the app's CDN (section 5): the app does not contact the Sejm on its own. Only if you tap a link to the ISAP (for example the link to the source of an act or to the reuse conditions) does the site open in the browser. From that moment the privacy policy of the Sejm website applies, and the party responsible for it is the Kancelaria Sejmu. The developer receives no data.

France Légifrance

The texts are not downloaded from Légifrance or from the DILA servers but from the app's CDN (section 5): the app does not contact the DILA on its own. The site opens in the browser only if you tap a link to Légifrance (for example the link to the source of an article or to the reuse conditions). From that moment the privacy policy of Légifrance applies, and the DILA is the controller. The developer receives no data.

8Data transfers outside the EU

Cloudflare, Inc. is a company based in the United States. The device's IP address (personal data) is inevitably processed by Cloudflare, even if only in real time, without necessarily being stored permanently, to serve content through the CDNs, for the security purposes described in section 6 and, on the site and the web version, for Cloudflare Web Analytics. This involves a transfer of data to a country outside the EU/EEA. The same applies to the CDN of every country.

For the update and review functions of the Android and iOS app (section 6), any transfers of data outside the EU/EEA are handled by Google and Apple as part of their respective services, with the safeguards described in their privacy notices.

Cloudflare adheres to the EU-U.S. Data Privacy Framework and uses the Standard Contractual Clauses approved by the European Commission as a safeguard for international data transfers, as described in Cloudflare's GDPR page and in its Data Processing Addendum.

10Children

The app is not intended for anyone below the minimum age set in their own country for consenting to digital services (14 in Italy and Spain, 15 in France, 16 in Poland) and does not knowingly collect data from children. The thresholds are those of Article 8 GDPR as applied by national law: 14 in Italy (Article 2-quinquies of the Privacy Code, Legislative Decree 196/2003, as amended by Legislative Decree 101/2018), 14 in Spain (Article 7 of Ley Orgánica 3/2018, LOPDGDD), 15 in France (Article 45 of the “Informatique et Libertés” law); in Poland the personal data protection act does not set a lower threshold, so the one in Article 8 GDPR applies, 16 years. The app does not rely on consent and does not collect personal data, so for use the difference between the thresholds changes nothing.

11Data subject rights (GDPR)

All data generated by using the app (bookmarks, notes, preferences, history, chosen country) is saved only on the user's device and is never sent to or kept by the developer. The user has direct and complete control over this data:

  • access and portability: Settings → Backup → Export backup generates a JSON file with all the user's personal data
  • erasure: by clearing the app's data from the device settings or by uninstalling the app

Since the developer does not keep identifiable personal data relating to the use of the app, most of the rights provided for by Articles 15–22 of Regulation (EU) 2016/679 (GDPR), namely access, rectification, erasure, portability, objection, have no concrete object to be exercised against the developer. This does not exclude your rights: you can in any case write at any time to inprogrammazione@gmail.com to request information about the processing, exercise the right to object or report any privacy concern.

The connection data processed by Cloudflare (IP address, user agent) for hosting, security and anti-DDoS purposes (section 6, Cloudflare Pages) is subject to Cloudflare's Privacy Policy, with respect to which Cloudflare acts as an independent controller: to exercise your rights over this data you must contact Cloudflare directly in the manner indicated in its policy. For the processing carried out through Cloudflare Web Analytics, instead, Cloudflare acts as processor on behalf of the developer (Article 28 GDPR): you may also contact the developer on matters relating to this specific processing.

For the data processed by Google and Apple through the app's update and review functions (section 6), rights are exercised against Google and Apple, as independent controllers, according to their privacy notices. The same applies to the sites of the official sources, if you visit them (section 7).

In any case, you always have the right to lodge a complaint with the supervisory authority of your country, for example in Italy with the Garante per la protezione dei dati personali (www.garanteprivacy.it), in Spain with the Agencia Española de Protección de Datos (www.aepd.es), in Poland with the Prezes Urzędu Ochrony Danych Osobowych (uodo.gov.pl) and in France with the Commission nationale de l'informatique et des libertés (CNIL) (www.cnil.fr), if you believe that the processing of your data infringes the applicable law.

12Changes to this privacy policy

Any updates to this policy will be published on this page with the update date. We invite you to check it periodically. If the app adds the texts of another country, the policy will be updated first with the relevant source.

13Contact

For any question or request relating to privacy, write to:

Developer inprogrammazione@gmail.com