report: the first tester - privacy notice 1.1, the two rulings, and the kit

REPORT-tester-kit-2026-10-12.md

@@ -0,0 +1,119 @@
+# REPORT — the first tester: privacy notice 1.1 and a reusable kit (2026-10-12)
+
+## In plain words
+
+A tester answered on Prohardver today. Before his domain is bought in his name, the privacy notice had
+to say that his name, address, e-mail and telephone number go to a domain seller — it did not. It does
+now, live, and it says it before the purchase rather than after.
+
+Alongside it there is a small kit you reuse for every tester: the questions about his machine, the
+data the domain needs, the e-mail he sends to accept the terms, the welcome e-mail, and your own step
+list. No personal data is in any of it, and none ever goes into this repository.
+
+## 1. Your two answers
+
+| | you chose |
+|---|---|
+| Registrar for a tester's `.hu` domain | **Nethely Kft.** |
+| Whose Cloudflare account holds the zone | **yours (Felhom's), during the test** |
+
+Both are recorded as dated rulings in `CONTEXT.md`. The second one also answers a question that had
+been open in the privacy draft since 2026-10-08 (open point 9).
+
+**What I read, and where (2026-10-12):**
+
+- **Domainregisztrációs Szabályzat §1.2.2.1** — what a natural person must give:
+  *„Természetes személy domain-igénylő: neve, postacíme, értesítési email címe, értesítési
+  telefonszáma, faktor adata(i)"*. Mother's name, date of birth and ID number are listed as
+  **optional** — so they are not asked for and not passed on. §1.1.3: the applicant must be 18.
+  <https://www.domain.hu/domainregisztracios-szabalyzat/>
+- **The public WHOIS** — for a natural person the lookup shows only the label „Természetes személy";
+  address and telephone are not public. In the registry's words: *„A pontos személyes adatok nem
+  nyilvánosak."* <https://www.domain.hu/whois/>
+- **Nethely** — *„A .hu domainek esetén online nyilatkoztattétel szükséges Öntől a regisztráció
+  befejezéséhez"*: **the tester himself must confirm the registration**, so his own e-mail address is
+  load-bearing. Whether he gets a separate login was **not stated** on the pages I read — their page
+  speaks only of the customer account the domains sit in (*„Az Ön ügyfélfiókjában található .hu
+  domainek"*). Recorded as unknown, not as a yes or a no. <https://www.nethely.hu/domain>,
+  <https://www.nethely.hu/impresszum> (Nethely Kft., 1115 Budapest, Halmi utca 29.)
+- **The registry** — ISZT Internet Szolgáltatók Hálózati Koordinációs Központja Nonprofit Kft.,
+  1089 Budapest, Bláthy Ottó u. 9. <https://www.domain.hu/impresszum/>
+
+**On the Cloudflare question**, what the build already assumed and nothing had written down:
+`day0-install.md` A.1 has you create the tunnel in the Cloudflare dashboard and mint
+`felhom-<customer-id>` scoped to that one zone, and the hub refuses a token that can see any other
+zone (`01` §7, R-138 option C). Both need the zone on an account you administer. The notice now says
+so, and says the domain moves to his own account when he leaves or the test ends.
+
+## 2. The privacy notice: what was added
+
+New **§10, „A domained regisztrációja"**, live at <https://felhom.eu/adatkezeles>:
+
+> **Mit kérünk el tőled:** a **neved, a postacímed, egy értesítési e-mail-címed és egy értesítési
+> telefonszámod**. Ennyit ír elő a .hu Domainregisztrációs Szabályzat természetes személy igénylőnek.
+> A szabályzat szerint megadható még az anyád neve, a születési dátumod vagy egy igazolványszám is —
+> **ezeket nem kérjük és nem is továbbítjuk**. […]
+> **Kinek adjuk tovább:** a **Nethely Kft.** (1115 Budapest, Halmi utca 29.) regisztrátornak, aki a
+> .hu nyilvántartó […] felé továbbítja. A .hu regisztrációhoz **tőled is kell egy online nyilatkozat**
+> […]
+> **Mi látszik ebből nyilvánosan:** […] **nem jelenik meg a neved, a címed és a telefonszámod**, csak
+> a „Természetes személy" felirat. […]
+> **A domain DNS-e a teszt alatt:** a domained a **mi Cloudflare-fiókunkban** van […] Ettől a domain
+> még a tied: ha kiszállsz vagy a teszt véget ér, átvisszük a saját fiókodba — vagy ahová kéred.
+> **Jogalap:** a veled kötött megállapodás teljesítése (GDPR 6. cikk (1) b).
+
+**The diff, 1.0 against 1.1.** The only removed-or-changed lines are: the record's own title and its
+derived-on date, the version line, and the four renumbered headings (old 10–13 → 11–14). Everything
+else in the diff is an addition. The page's single internal cross-reference points at §3.4 and was
+unaffected.
+
+**One change beyond the new section, deliberately:** §11 („Kik látják még az adataidat") gained the
+registrar and the registry. A recipients list that omits two recipients is wrong, and I would rather
+explain one extra edit than publish an incomplete list.
+
+Version line: **„Zárt teszt — 1.1 verzió, hatályos: 2026. október 12."** The record is
+`documentation/legal/adatkezelesi-tajekoztato-1.1.md`; 1.0 stays as history and the legal README now
+points at the 1.1 records for both texts.
+
+## 3. The kit — `marketing/testers/kit/`
+
+| file | what it is |
+|---|---|
+| `README.md` | what the kit is, the order, and the no-personal-data rule with its reason |
+| `01-KERDESEK-GEP-ES-NET.md` | the questions about his machine and net — every one traced to `day0-install.md` Part B or the site's FAQ, with what to do if he does not know |
+| `02-DOMAIN-ADATOK.md` | the four fields the registry requires, and in bold: send them by e-mail, not on a forum or in a private message |
+| `03-ELFOGADO-EMAIL.md` | the e-mail he sends back accepting terms 1.1 and privacy notice 1.1 — **the domain is not bought before it arrives** |
+| `04-UDVOZLO-EMAIL.md` | the next steps in order, and the recovery code warning in full: shown once, and nobody can open the backup without it |
+| `05-LEPESEK-UZEMELTETONEK.md` | your own list, first message to installed box, each step pointing at its `day0-install.md` section, with the gates between steps |
+
+Plus `marketing/testers/EMAIL-privacy-1.1.md` — the notice to the existing testers that the privacy
+notice changed, with the same recipient reasoning as the terms e-mail.
+
+**No requirement in the kit is invented.** Each one carries a source comment naming the line it comes
+from, so nothing promises the tester something the terms do not.
+
+## 4. Commits, gates, register
+
+- **Commit:** `225afa0f` on `main`. No `--no-verify`.
+- **Gates:** `site_gates.py` green on Windows and again on Linux at a checkout containing this commit;
+  `instructions_gate.py` OK there too. **The full `repo_gates.py --fast` could not be run at this
+  commit:** the DooPlex clone has another session's uncommitted register work in it all evening, and I
+  left that tree alone rather than disturbing it. A scratch clone runs the cross-repo gates
+  inconclusive (the sibling repos are not beside it), so it is not a substitute — stated rather than
+  dressed up.
+- **Register: 102 before, 102 after, 0 opened, 0 closed.** The register moved from 128 to 102 today
+  through two other sessions, not this one. This task found nothing worth filing: the one thing it
+  could have filed — that the notice did not cover the domain — is what it fixed.
+- Live read-back: `https://felhom.eu/adatkezeles` → **200**, „1.1 verzió, hatályos: 2026. október 12.",
+  §10 present, §§11–14 renumbered.
+
+## 5. What is yours to do next
+
+1. **Send `marketing/testers/EMAIL-privacy-1.1.md`** to the one real existing tester (the friend whose
+   machine is not built yet). Individually, not as a thread.
+2. **Send `kit/01-KERDESEK-GEP-ES-NET.md`** to the Prohardver tester. Your reply to him already covers
+   the shape of the thing (a machine, the install, the domain you buy in his name for two years, and
+   why a dedicated domain is needed) — what it does not yet ask is the specifics: the model or CPU,
+   the memory, the disks, the always-on place, the cable, the upload speed, and whether anything on
+   that machine must survive the install.
+3. **Then `kit/02-DOMAIN-ADATOK.md`**, and wait for `03` before buying anything.