Policy
Privacy notice
Version 1 · 2 November 2026
In short
- The person who decides how your data is used (the “controller”) is Fabio Guzzon, an individual, not a company, in Italy. For any question, write to redazione@uapgrade.com.
- You don't have to give us anything to read the site: no account, no ads, no cookies that build a profile of you. We run our own statistics, counting visits day by day without storing your IP address.
- We only ask for your email if you want to write to us, comment, propose a scenario, send a contribution or get the newsletter. We never publish it and never pass it to the AI.
- Questions to Vega, comments, proposals and contributions go through Anthropic's AI, in the United States. The site's server (Contabo) is in the United States too, covered by the European Commission's standard contractual clauses.
- We don't sell your data and don't use it for advertising.
- You can see, correct or delete your data by writing to us: we reply within one month. You can also complain to the Italian Data Protection Authority (Garante per la protezione dei dati personali).
- You must be at least 14 to comment, propose, contribute, subscribe to the newsletter or use Vega.
- Who is responsible
- What data, why and on what legal basis
- When you read the site
- When you write to us or take part
- Automated moderation and human review
- Vega and artificial intelligence
- People mentioned in the archive
- Social media and donations
- Who receives the data
- Data outside Europe
- How long we keep data
- Your rights
- Complaints
- Minimum age
- Security
- Changes to this notice
Who is responsible
The data controller is Fabio Guzzon, an individual based in Italy. He decides why and how the data collected by UAPgrade (uapgrade.com) is used. On this page, “we” means him.
For privacy questions and anything else, write to redazione@uapgrade.com, in English or Italian.
The project also carries the Adattica brand, but Adattica is not a separate controller: the controller is Fabio Guzzon.
What data, why and on what legal basis
The law requires every use of personal data to rest on a legal basis: one of the grounds listed in Article 6 of the EU General Data Protection Regulation (GDPR). We rely on these:
- A service you ask for (Art. 6(1)(b)): we need the data to do something you asked us to do, such as publishing your comment.
- Consent (Art. 6(1)(a)): we only use the data if you say yes, and you can change your mind at any time.
- Legitimate interest (Art. 6(1)(f)): a real interest of ours, such as protecting the site from abuse, which we have weighed against your rights. You can object.
- Legal obligation (Art. 6(1)(c)): when the law requires us to do something.
The archive and the news deal with people and facts of public interest, so the rules on freedom of information also apply to them (Art. 85 GDPR and Articles 136-137 of the Italian Privacy Code).
| What we do | Which data | Why · legal basis |
|---|---|---|
| Show you the site and protect it from abuse | Your IP address, used on the spot and kept for a few days in the server's access log; in the database, only if you send us something, a fingerprint that changes every day (for scenario votes, a fixed one: see Votes on scenarios) | Running the site and stopping repeated submissions and attacks · legitimate interest (6(1)(f)) |
| Keep statistics without cookies | Section viewed, language, domain you came from, device type; in bands: time on the page, scrolling, pages per visit; domains of external links opened; campaign tags in links | Understanding what readers find useful and improving the site · legitimate interest (6(1)(f)). We only store daily totals. |
| Count returning visitors | A random code that stays in your browser; the server only receives “new” or “returning” | Knowing how many readers come back · consent (6(1)(a)), given in the cookie banner |
| Remember your preferences | Language, stopped animations, investigator name, cases already shown in the case box | Remembering your choices · a service you ask for (6(1)(b)). They stay in your browser. |
| Remember your cookie choice | Choices made in the banner, policy version, date | Respecting your choice and being able to prove it · legal obligation (6(1)(c)) and legitimate interest (6(1)(f)) |
| Confirm submissions by email | Email, the text of the pending submission, daily IP fingerprint | Checking the address is yours before accepting the submission · a service you ask for (6(1)(b)) |
| Answer messages from the Contact page | Name, email, reason, text | Replying to you · a service you ask for (6(1)(b)) or, if the message isn't about a service, our legitimate interest in replying (6(1)(f)) |
| Handle reports of illegal content and send statements of reasons for our decisions | From the person reporting: name, email and the text of the report. From the author of the content: email, the content and the reason for the decision | Complying with the EU Digital Services Act (DSA) · legal obligation (6(1)(c)) |
| Publish comments on the news | Alias and text (public); email (private); daily IP fingerprint | Publishing the comment after moderation · a service you ask for (6(1)(b)) |
| Publish scenario proposals and put them to the vote | Alias, title, text, links and people named (public); email (private); the code in the osv_v cookie; for votes, an IP fingerprint | Publishing the proposal and counting one vote per browser and per connection · a service you ask for (6(1)(b)) |
| Assess contributions to the Investigations Unit | Investigator name (public on the roster and in the contribution log, with verdicts, points, rank and reliability), title, text, links; email (private) | Checking the material, awarding points, keeping the investigators' roster · a service you ask for (6(1)(b)) |
| Send the newsletter | Email, language, dates of subscription and confirmation | Sending you the daily news · consent (6(1)(a)), with double opt-in |
| Answer questions to Vega | Question (400 characters at most), the page you are on, daily IP fingerprint | Answering you and counting the day's questions · a service you ask for (6(1)(b)) |
| Update the archive and write the daily news | Contributions and proposals, without emails; public sources | Keeping the archive checked and informing the public · legitimate interest (6(1)(f)), under the freedom of information rules (Art. 85 GDPR) |
| Mention people in the archive | Names, roles, public statements, documented links, authority index, freely licensed portraits; for David Grusch and Luis Elizondo, in the comparison between the two, portraits created with artificial intelligence and labeled as such | Informing the public and checking claims of public interest · freedom of information (Art. 85 GDPR, Arts. 136-137 Italian Privacy Code) |
| Run the site from the Redazione, Fabio's private editorial area | The editorial email address, fingerprints of login links and sessions, uapg_red cookie, action log (numbers, never emails) | Running the site and keeping track of decisions · legitimate interest (6(1)(f)) |
| Communicate on social media | What you do on our profiles, such as comments and messages; platform statistics | Making the site known and talking with our followers · legitimate interest (6(1)(f)) |
We don't use your data to profile you, we don't sell it and we don't use it for advertising.
When you read the site
IP address
To send you pages, the server has to use your device's IP address. We never store it in the database. When you send us something (a message, a comment, a proposal, a contribution, a newsletter sign-up or a question to Vega), we only store a “fingerprint”: a code computed from the date, the IP address and a secret key (with the SHA-256 algorithm), which can't be traced back to the address without the key. The fingerprint changes every day and is deleted within a few hours of the end of the day. It lets us set limits, for example on how many messages can arrive from the same connection in one day. If you only read, the fingerprint is used only in the server's memory, for the limits, and never goes into the database. Votes on scenarios use a different fingerprint: see Votes on scenarios.
The server's technical logs, such as error logs, rotate: at most 3 files of 10 MB, after which the oldest are overwritten. The program that routes requests to the sites hosted on the server (Traefik) also keeps an access log: IP address, date and time, page requested, the server's response and the browser used. It is for security and troubleshooting, on the basis of legitimate interest; it rotates the same way (3 files of 10 MB) and today covers a few days.
Statistics
We run our own statistics, on our server, without cookies and without anyone else's services (no Google Analytics or anything like it). After each page, your browser sends us a signal with a few details: the section you opened, the language and, on the first page only, the site you came from (just the domain, for example “google.com”). From the signal we can also tell whether you're on a phone or a computer. Then, in bands: how long you stay on the page, how far you scroll and how many pages you see during the visit. We also count the domain of the external links you open and, if you arrived through a link with a campaign tag (for example one of our posts), that tag.
Only daily totals go into the database, along the lines of “how many times the map was opened on Tuesday”. We don't store your IP address, a row for each visit or the exact name of your browser: the statistics can't be traced back to you.
To count the pages in a visit, your browser keeps a small note in the tab's memory (sessionStorage). It never leaves your browser and disappears when you close the tab: the server only receives the page's position in the visit (first, second, third…).
Returning visitors, only if you accept
If you accept it in the cookie banner, your browser keeps a random code (in localStorage) for up to 13 months. At most once a day it tells the server only “new” or “returning”: the code itself never leaves your browser. If you refuse, nothing is stored, and if you withdraw your consent the code is deleted.
The cookie banner
The banner follows the Garante's guidelines of 10 June 2021. “Accept” and “Refuse” are equally prominent; closing the banner with the X counts as refusing; with “Customize” you choose item by item, and no optional box is ticked in advance. Your choice is kept for 6 months in the technical cookie uapg_consenso, together with the policy version. You can change it at any time from the “Cookie preferences” link at the bottom of the site's pages.
Preferences and technical cookies
Your browser remembers some choices you make: your language, whether you stopped the animations, your investigator name and, until you close the tab, which cases we have already shown you in the box of cases without an official identification. They stay in your browser until you delete them. The technical cookie osv_v is only created if you propose or vote on a scenario: it recognizes your proposals and votes, and lasts one year.
No other services in our pages
Fonts and libraries, such as the ones for the map and the charts, come from our own server: opening the site doesn't make your browser contact anyone else's services.
To see how the site shows up in search results, we use Google Search Console. Google shows us aggregated search data, for example how many times a page appeared in the results, and is an independent controller of that data. There is no Google code on the site.
The names, purposes and durations of all cookies and browser storage are on the Cookies page.
When you write to us or take part
Your email: when we need it
You don't need an email address to read, vote on a scenario or ask Vega a question. We do ask for it for:
- messages from the Contact page;
- comments on the news;
- scenario proposals;
- contributions to the Investigations Unit;
- subscribing to the newsletter.
In these cases the email address is required: without it, the submission can't be sent. We need it to know the address is yours and that a person is behind the submission. We also use it to reply when you write to us, to tell you why if we don't publish a comment or scenario proposal of yours and, for the newsletter, to send you the news.
Confirmation
After you submit, you get an email with a link that is valid for 48 hours. Your submission only goes through when you open the link and press “Confirm”. Until then nobody reads or publishes it; if you don't confirm, it deletes itself.
What stays private and what becomes public
- Your email stays private. We don't publish it, show it to other readers or send it to the AI. We remove it from comments, proposals and contributions after 12 months.
- Comments: we publish the alias, text, date and language.
- Scenario proposals: we publish the alias, title, text, links, people named, votes and translation.
- Contributions to the Investigations Unit: the contribution log shows your investigator name, the date and type of the contribution, a title rewritten in neutral terms, the verdict, the contribution's reliability, the points and the impartial arbiter's assessment. The roster of investigators shows your name, rank and points, how many of your contributions were assessed and how many were added to the site and, after three assessed contributions, your reliability: the share of your contributions that turned out to be verified, fully or in part. Your text isn't published as it is: only a neutral paraphrase written by the impartial arbiter, an AI agent, appears.
- Messages from the Contact page: never published, and deleted after 12 months.
If you'd rather stay private, pick an alias that isn't your full name. And please don't put personal details about yourself or others in public texts.
Newsletter
You subscribe with double opt-in and get an email for each new daily news article, in your language. Every email has a link to unsubscribe in one click. The emails contain no tracking pixels: we don't know whether or when you open them. When you unsubscribe, your address is removed from the subscriber list. Two things remain, without your address: the sending log, for 24 months, and the code of the unsubscribe link you used, a fingerprint that lets us still reply “unsubscribed” if you open the link again.
Votes on scenarios
You don't need an email address to vote. To count only one vote per browser and per connection, we use the technical cookie osv_v and an IP fingerprint computed with the secret key, which in this case doesn't change every day. Votes, with the cookie code and the fingerprint, are kept while the proposal can still be voted on. After that they are deleted: 30 days after the proposal joins the site's scenarios, or 12 months after it is discarded.
Reports and decisions about content
If you report content you believe is illegal, we use your name, your email and the text of your report to examine it and reply to you, as the EU Digital Services Act (DSA) requires. We don't tell the author of the content who reported it, unless this is strictly necessary. If we don't publish or we remove a comment or scenario proposal of yours because it is illegal or breaks the rules, we email you the reason at the address you confirmed (except for spam); for a contribution, you can ask us for the reason.
What may be published is explained in the Terms and rules, which also explain how to report content and how to challenge a decision.
Automated moderation and human review
Comments and scenario proposals aren't published straight away. First they go through two automatic checks:
- Simple anti-spam rules, for example too many links, shortened links, typical spam words or text written all in capitals.
- A verdict from Anthropic's AI, which reads the text (for comments also the alias and the article's title and summary, for proposals also the links).
- Comments: with an “ok” verdict the comment is published; if the AI is unsure, Fabio decides; if the comment is spam, off topic, abusive or contains personal data about private individuals, it is discarded.
- Scenario proposals: with “ok” the proposal goes to the vote, translated into Italian and English; otherwise it is discarded.
- Contributions to the Investigations Unit: the AI agents of the daily check examine them, and the impartial arbiter decides what goes into the archive and how many points to award.
Messages from the Contact page don't go through the AI: Fabio reads them.
These decisions only concern whether a text appears on the site or how many points it gets: they have no legal or financial effect on you. You can still ask for a person to review them. Write to redazione@uapgrade.com saying which submission it is, for example the article and the day of your comment: Fabio will look at it himself and reply.
Vega and artificial intelligence
UAPgrade uses Claude, Anthropic's artificial intelligence, through Fabio's personal Claude subscription. We use it for:
- Vega, the site's assistant, which answers your questions using the archive records;
- moderating comments and scenario proposals;
- translating the site's content and scenario proposals between Italian and English;
- the daily check, in which AI agents verify sources and assess contributions;
- the daily news articles, signed “Written by Vega, UAPgrade's artificial intelligence” and published only after Fabio has approved them.
What Anthropic receives
- For Vega: your question, the page you're on and, if there is one, the record you're looking at; if you're continuing a conversation, also the last two questions and answers.
- For moderation: the comment text with the alias and the article's title and summary, or the proposal's title, text and links.
- For the daily check: contributions and proposals, without email addresses.
We never send Anthropic email addresses or IP addresses.
Anthropic's role
Because this is a personal subscription, governed by Anthropic's consumer terms, Anthropic processes this data as an independent controller, in the United States, under its own privacy policy. Fabio checks that the subscription setting that lets Anthropic use the data to train its models is switched off.
What we keep
Questions to Vega stay in our log for 40 days. The same log records each automated moderation, with the first 200 characters of the comment or the proposal's title: these entries are also kept for 40 days. The daily fingerprint that counts your questions for the day is deleted within a few hours of the end of the day. Answers already given are stored for up to 2 days, so an identical question can get the same answer straight away. Please don't put personal details about yourself or others in your questions.
Vega introduces itself as an AI. How and where we use artificial intelligence is explained on the Artificial intelligence page.
People mentioned in the archive
UAPgrade checks what has been said in public by people who play a part in the UAP debate: witnesses who have spoken publicly, officials, politicians, scholars, journalists, commentators. If you are one of them, this section is written for you: since we can't write to each person, we publish it here.
What data, and where it comes from
Name, role, a short biography, public statements, position on the subject, documented links with other people, controversies reported by sources and the “documented authority index”. The index measures how far what a person claims is documented and publicly verifiable; it doesn't measure their honesty or their intelligence.
This data comes only from public sources: sworn testimony, official documents, interviews, articles, books, podcasts and videos. Each record cites its sources.
Portraits in the directory of people come only from freely licensed or public domain sources: Wikimedia Commons, including official portraits from the US government. The author and license of each one are listed in Method and sources. People without a free portrait are shown with their initials. The exception is the comparison between David Grusch and Luis Elizondo: there the two portraits are illustrations created with artificial intelligence, not photos, and the caption says so (see Artificial intelligence).
Our rules
- We don't publish sensitive data beyond what the person has made public.
- We don't name private witnesses who haven't come forward, or minors.
- We don't attribute accusations to anyone without a source that names them.
- We only quote word for word from sworn testimony and official documents, 15 words at most; everything else we summarize in our own words.
Legal basis and retention
This is reporting on facts of public interest, covered by Art. 85 GDPR and Articles 136-137 of the Italian Privacy Code (Legislative Decree 196/2003). The limits of the right to report the news apply, in particular that information must be essential: we only publish what is needed to understand the facts. We keep this data for as long as the archive needs it.
This data also goes through Anthropic's artificial intelligence: when the AI agents of the daily check verify and update the archive and write the daily news, when we translate the records and when Vega answers questions. Anthropic processes it as an independent controller, in the United States (see Data outside Europe).
How to ask for a correction or object
Write to redazione@uapgrade.com naming the record, for example with the link to the profile, and telling us what is wrong. You can ask us to correct a wrong detail or to add a source. You can also object to the publication of a detail or of your portrait, on grounds relating to your particular situation (Art. 21 GDPR). We weigh each request between your rights and the public's interest in being informed, and reply within one month. If the mistake is ours, we fix it and, if it matters, record it in the site's public error log.
Social media and donations
Social media profiles
If you follow, comment on or message UAPgrade's profiles on X, Instagram or YouTube, the platform processes your data as an independent controller, under its own privacy policy. We see what the platform shows us, for example your public name, comments and messages, plus aggregated statistics about our profiles. For page statistics, according to the Court of Justice of the European Union (case C-210/16, on Facebook pages), whoever runs a page may be a “joint controller”, meaning responsible for that data together with the platform. To exercise your rights over that data, you can contact the platform or us. Our legal basis is our legitimate interest in making the site known and talking with our followers. This data stays on the platforms.
Donations
The site collects no data for donations: the button takes you to PayPal. If you donate, the payment happens on PayPal, which processes your data as an independent controller under its own privacy policy. Your card or account details never reach us; we only see what PayPal shows to anyone who receives a payment.
Who receives the data
Fabio processes the data. Apart from him, only the parties below receive it. A processor works on our behalf, only on our instructions and under a contract (Art. 28 GDPR). An independent controller decides for itself how to use the data, under its own privacy policy.
| Who | Role | What they receive | Where |
|---|---|---|---|
| Contabo | Processor: the server | The site and the whole database | United States |
| Aruba | Processor: email | Emails: the ones you send to redazione@uapgrade.com and our replies, submission confirmations, the newsletter, Redazione login links and daily summary | Italy |
| Anthropic | Independent controller | Texts for Vega, moderation, translations, the daily check and the articles; never email or IP addresses | United States |
| PayPal | Independent controller | Only if you donate: the payment data, on PayPal's site | Under its privacy policy |
| X, Instagram, YouTube | Independent controllers (possibly joint controllers for profile statistics) | Only if you interact with our profiles | Under their privacy policies |
| Site visitors | The public | Whatever is public: aliases, comments, proposals, investigator names on the roster | Anywhere |
We don't sell data to anyone. We may disclose it to the authorities only when the law requires it.
Data outside Europe
The European Economic Area (EEA) is made up of the European Union countries plus Iceland, Liechtenstein and Norway. Some data leaves the EEA:
- The server is in the United States. Contabo's server, which hosts the site and the database, is located in the United States. The transfer is covered by Contabo's data processing agreement, which includes the standard contractual clauses adopted by the European Commission (Art. 46 GDPR). They are a model contract prepared by the Commission: whoever receives the data promises to protect it the way it is protected in Europe. For this transfer we don't use a Commission “adequacy decision” (one that recognizes that a country protects data well): we use these clauses. You can ask us for a copy of the clauses at redazione@uapgrade.com.
- Anthropic processes the texts that go through the AI in the United States, as an independent controller. The safeguards it uses for these transfers are described in its privacy policy.
- Social media platforms and PayPal may process data outside the EEA, under their own privacy policies.
How long we keep data
| What | How long |
|---|---|
| Daily IP fingerprint | Deleted within a few hours of the end of the day |
| Server technical logs | Rotating: at most 3 files of 10 MB, then the oldest are overwritten |
| Server access log (Traefik), with the IP address | Rotating: at most 3 files of 10 MB; today a few days |
| Statistics | Kept only as daily totals, with no personal data |
| Visit note (sessionStorage) | Until you close the tab |
| Returning-visitor code (only with your consent) | Up to 13 months; deleted if you withdraw consent |
Cookie choice (uapg_consenso) | 6 months |
Scenario cookie (osv_v) | 1 year |
| Preferences in your browser | Until you delete them; tab-only ones until you close the tab |
| Submissions awaiting confirmation | 48 hours if you don't confirm; 30 days after confirmation |
| Contact page messages, in the site's database | 12 months |
| Emails exchanged with redazione@uapgrade.com (requests about your data, reports, review requests, our replies to Contact messages) | No time limit set |
Email addresses of commenters, scenario proposers and contributors; for proposals, also the osv_v cookie code | Removed after 12 months |
| Discarded comments and contributions | Deleted after 12 months |
| Discarded scenario proposals, in the text you sent us (not public) | Deleted 12 months after being discarded, together with their votes |
| Assessed contributions, in the text you sent us (not public: the site shows the Arbiter's paraphrase) | As long as the published card in the Investigations Unit stays in the archive |
| Published comments and proposals, investigator names on the roster and in the contribution log | As long as they stay on the site; you can ask us to remove them |
| Scenario votes, with cookie code and fingerprint | While the proposal is open to voting; then 30 days if it joins the site's scenarios, 12 months if it is discarded |
| Questions to Vega and the log of AI requests (for moderation: the first 200 characters of the comment, or the proposal's title) | 40 days |
| Vega's ready-made answers | 2 days |
| Newsletter subscription | Until you unsubscribe |
| Newsletter sending log | 24 months |
| Code of a newsletter unsubscribe link already used (a fingerprint, without the address) | No time limit set |
| Daily check working folders | 30 days |
Redazione: login link, session (uapg_red cookie), action log | 15 minutes; 12 hours; 24 months |
| Data on people mentioned in the archive | As long as the archive needs it |
These periods apply to data on our server, in the redazione@uapgrade.com mailbox and in your browser. Data held by Anthropic, PayPal and the social media platforms follows their own rules.
Your rights
At any time, and free of charge, you can ask us:
- to see your data and get a copy of it (access, Art. 15 GDPR);
- to correct it if it is wrong or incomplete (rectification, Art. 16);
- to delete it, for example one of your comments or your subscription (erasure, Art. 17);
- to restrict its use, for example while we check a correction you asked for (restriction, Art. 18);
- to receive the data you gave us in a machine-readable format, to take it elsewhere, when we process it for a service you asked for or with your consent (portability, Art. 20);
- to object to uses based on our legitimate interest, on grounds relating to your particular situation (objection, Art. 21);
- to withdraw your consent whenever you like, without affecting what was done before (Art. 7(3)): for the newsletter, use the link at the bottom of every email; for returning visitors, the “Cookie preferences” link at the bottom of the site's pages;
- to have a person review an automated moderation decision (see Automated moderation and human review).
How. Write to redazione@uapgrade.com from the address you used on the site and tell us what you want: that way we can find your data and know it's yours. We reply within one month.
Some data isn't linked to you: for example questions to Vega, which carry no name or email, or the statistics, which are only totals. In these cases we can only find it if you give us details that let us do so (Art. 11 GDPR).
Complaints
If you think we are handling your data wrongly, you can complain to the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it). Or you can complain to the authority of the EU country where you live or work, or where the problem happened (Art. 77 GDPR). You can also go to court. If you like, write to us first: we'll try to sort it out together.
Minimum age
You must be at least 14 to comment, subscribe to the newsletter, propose scenarios, send contributions or ask Vega questions (Art. 8 GDPR and Article 2-quinquies of the Italian Privacy Code; for artificial intelligence, also Article 4 of Italian Law 132/2025). Anyone can read the site.
If you are a parent and think your child under 14 has sent us data, write to us and we'll delete it.
Security
We protect data with technical and organizational measures suited to the risks:
- an encrypted connection (HTTPS);
- no IP addresses in the database, only fingerprints made with a secret key, which change every day (except those for votes, which don't change and are kept while the proposal is open to voting, then for 30 days or 12 months: see How long we keep data);
- secret links, such as those for email confirmations and for logging in to the Redazione, are stored only as fingerprints, never in plain text;
- the Redazione is open only to Fabio, with no password: you get in with a link that works once and for 15 minutes, and the session lasts at most 12 hours, in a cookie that doesn't travel with the site's other requests;
- service credentials (email, artificial intelligence) are kept only on the server, never in the code;
- the AI agents of the daily check work in a separate environment, with no access to the database or to email addresses;
- limits on submissions per connection, against spam and abuse.
No system is one hundred percent secure. If a data breach happens, we assess it straight away; when the law requires it, we notify the Garante within 72 hours and, if the risk to you is high, we let you know (Arts. 33-34 GDPR).
Changes to this notice
If we change how we use data, we update this page and change the version and date at the top. If a change concerns something that needs your consent, we'll ask you again. This is version 1, of 2 November 2026.