Cookie notice

On the published site checked on 28 October 2026:

• no cookie managed by the website application was identified;
• in that check, localStorage, sessionStorage, and IndexedDB were empty;
• language choice does not use a cookie: Italian is served without a prefix and English is served under /en;
• no audience-analytics tool is installed;
• there is no cookie-preference panel;
• the responses that were checked did not include an instruction to set a cookie.

The same day, the site was checked in a browser on a desktop layout and on a phone layout, including the home page, both contact pages, and the language switch. After the page scripts had run, no cookie was observed, the browser storage used by the site was empty, and the reCAPTCHA script was not loaded. Page requests stayed on www.fourtyozone.dev.

On 29 October 2026, after an update that showed the contact form while sending stayed off, the published site was checked again on the home page and both contact pages. No cookie was observed. localStorage and sessionStorage were empty. The reCAPTCHA script was not loaded. Requests stayed on www.fourtyozone.dev. This pass did not recheck IndexedDB. That check covered the site while sending was off. The contact page can write the Google-check choice in localStorage, as described below. That entry is not a cookie of this website.

On 3 November 2026 the canonical homepage response did not include an instruction to set a cookie. The application source does not set a cookie and does not enable a language cookie. It writes browser storage only for the reCAPTCHA choice, and only on the contact page after an explicit choice when a site key is present.

On 4 November 2026 a clean request to the published home page, both language homes, the operations archive, one published case study, capabilities, protocol, the operator page, both contact pages, and both legal notices returned no instruction to set a cookie. A missing instruction does not show that the browser holds no storage. Before a consent choice, the home page and the Italian contact page, after their scripts had run in a browser already used on the site, loaded no reCAPTCHA script and requested only www.fourtyozone.dev. That browser’s localStorage for the site already held a key named _grecaptcha. The site’s key fz.recaptcha-consent was not set. The visit did not show the home page creating the Google key. No lifetime for a Google cookie was established. Google Analytics, Google Tag Manager, Google Ads, the Meta Pixel, Vercel Web Analytics, and Vercel Speed Insights were not active.

These checks do not cover every later visit. A script that loads later, or a hosting setting that was not visible in the check, could still write a cookie.

In that check, the site did not set its own cookie for language, a session, or a consent choice.

Language is part of the page address. Switching language opens another address. The application does not store a language preference in the browser.

reCAPTCHA v3 is the abuse check for the contact form. Google’s script loads only after an explicit choice to allow the check. On 29 October 2026, while sending was off, the script was not loaded and submission did not start.

The behavior of the check is:

• Google’s script loads on the contact pages only, and only after an explicit choice to allow the check;
• before that choice, no request is sent to Google and no token is created;
• refusing the check removes the submit control and does not send the form. The person can write to the email address in this notice. That message is still handled by the mail provider. Direct email is not a way to avoid every third party;
• the choice is stored in localStorage, under the key fz.recaptcha-consent, with only the values granted and denied. It is not a cookie set by this website. Neither value is selected in advance. It is separate from storage Google manages, including a cookie named _GRECAPTCHA and a localStorage key named _grecaptcha;
• the choice can be changed on the contact page. Reconsidering a refusal clears it. Withdrawing an allowance clears the site’s key fz.recaptcha-consent, removes the submit control, and leaves the text already entered on the page. The page is not reloaded. Withdrawal does not delete data already sent to Google, a cookie Google has already set, or Google-managed storage such as _grecaptcha. A Google script already loaded on that page may remain until the person leaves the page;
• the token is created on submission. Google’s guide says it expires after two minutes and can be verified only once. That lifetime is the token’s, not the cookie’s;
• the server verifies the token with Google.

The reCAPTCHA FAQ, updated by Google on 2 April 2026, says reCAPTCHA sets a cookie named _GRECAPTCHA when the check is executed, for risk analysis, and describes that cookie as necessary for the service. That description does not decide whether Italian law requires consent before the script loads. Another Google document writes the same name as _grecaptcha. Neither states how long the cookie lasts. The same page says the www.google.com domain may set other cookies, without listing them, and names www.recaptcha.net as an alternative. The integration uses www.google.com. Those other cookies were not observed on 29 October 2026, because the script was not loaded.

The contact form is operational. Google’s script loads only after an explicit choice to allow the check, and the choice is not selected in advance. Refusal or withdrawal removes the submit control. Withdrawal clears the site’s key fz.recaptcha-consent, does not reload the page, and leaves the text already entered in place. It does not erase data Google has already received, a cookie Google has already set, or Google-managed storage such as _grecaptcha. A script already loaded on the page may remain until the person leaves it. This notice does not treat that control as proof that the law requires it, or that the law does not. Google’s documented cookie name is set by Google when the check runs. It is not a cookie of this website, and no lifetime for it has been verified.

Questions about this notice can be sent to contact@fourtyozone.dev. Direct email remains available at the address above.

Vercel Web Analytics is not running on this website. No measurement script is loaded, and no page view is sent. Mauro Mirra, operating as FOURTYOZONE, decides whether to offer that measurement later. The provider is Vercel Inc. The purpose, if it is offered, is aggregate audience measurement and improvement of the public site. The legal basis is consent, Article 6(1)(a) of Regulation (EU) 2016/679. Measurement does not start unless you allow it. Refusing, or not choosing, does not limit the rest of the site.

When measurement is offered, each page shows Allow and Reject. Neither is selected in advance. The choice is stored in this browser under the key fz.analytics-consent, together with the time it was made and the notice version 2026-11-06. It is kept for 183 days and is then treated as no choice. It is not a cookie, and it is not the contact form’s reCAPTCHA choice. You can change it from Analytics preferences in the footer. If you withdraw an allowance after the measurement script has loaded, the browser opens the page again and later visits are not sent.

Vercel’s Web Analytics documentation, read on 6 November 2026, says the product does not use a third-party cookie and distinguishes a visit with a hash of the request that lasts one day. The same documentation says a stored point can include the time, the page address, the referring page, filtered query parameters, the browser and its version, the operating system, the device type, and a location that can be as specific as a city. Vercel says the stored point is not tied to an IP address. Describing the measurement as cookieless does not mean that no personal data is processed. This website removes the query string, the fragment, and any username or password before a page view is sent. It does not send custom events, the contents of the contact form, or internal review addresses.

Vercel’s data-processing addendum, updated on 17 March 2026 and effective on 31 March 2026, describes Vercel as a processor for customer data of Pro customers and as a controller for service-generated data. It has not been confirmed for this account which of those roles applies to a Web Analytics page view, or that the addendum has been accepted. A support reply is not that acceptance and does not decide the role. The addendum states that the primary processing facilities are in the United States and incorporates the European Commission’s standard contractual clauses (decision 2021/914) where those clauses apply. Whether those clauses cover this account has not been confirmed. A support reply described 12 months as the standard reporting window for Web Analytics on the Pro plan. That reply is not the addendum, and it is not treated as the retention period for every analytics record. The one-day period above is the documented life of the visitor hash.

Google Analytics, Google Tag Manager, Google Ads, the Meta Pixel, and Vercel Speed Insights are not used. Questions and requests about your rights can be sent to contact@fourtyozone.dev.

A browser usually allows cookies to be blocked or deleted in its settings. The path depends on the browser and its version. Blocking all cookies can affect websites other than this one.

The same browser settings can usually clear site data, including localStorage. That can remove the site’s choice, fz.recaptcha-consent, and a Google entry such as _grecaptcha when the browser stores one. Clearing the choice on the contact page does not by itself remove Google’s storage.

The website does not use one banner for every cookie. Audience measurement is not running in this release. If it is offered later, each page shows Allow and Refuse at the same visual weight, with neither selected in advance. The site remains usable if you do not choose and if you refuse. You can reopen the choice later. The contact page offers its own two choices for the Google check, with neither preselected. Direct email remains available on the contact page either way.

This notice may be updated if the website changes or if a later check finds a cookie that is not described here. The contact form is described as it operates.