diff --git a/REPORT-tester-kit-2026-10-12.md b/REPORT-tester-kit-2026-10-12.md new file mode 100644 index 00000000..a67d56c0 --- /dev/null +++ b/REPORT-tester-kit-2026-10-12.md @@ -0,0 +1,119 @@ +# REPORT — the first tester: privacy notice 1.1 and a reusable kit (2026-10-12) + +## In plain words + +A tester answered on Prohardver today. Before his domain is bought in his name, the privacy notice had +to say that his name, address, e-mail and telephone number go to a domain seller — it did not. It does +now, live, and it says it before the purchase rather than after. + +Alongside it there is a small kit you reuse for every tester: the questions about his machine, the +data the domain needs, the e-mail he sends to accept the terms, the welcome e-mail, and your own step +list. No personal data is in any of it, and none ever goes into this repository. + +## 1. Your two answers + +| | you chose | +|---|---| +| Registrar for a tester's `.hu` domain | **Nethely Kft.** | +| Whose Cloudflare account holds the zone | **yours (Felhom's), during the test** | + +Both are recorded as dated rulings in `CONTEXT.md`. The second one also answers a question that had +been open in the privacy draft since 2026-10-08 (open point 9). + +**What I read, and where (2026-10-12):** + +- **Domainregisztrációs Szabályzat §1.2.2.1** — what a natural person must give: + *„Természetes személy domain-igénylő: neve, postacíme, értesítési email címe, értesítési + telefonszáma, faktor adata(i)"*. Mother's name, date of birth and ID number are listed as + **optional** — so they are not asked for and not passed on. §1.1.3: the applicant must be 18. + +- **The public WHOIS** — for a natural person the lookup shows only the label „Természetes személy"; + address and telephone are not public. In the registry's words: *„A pontos személyes adatok nem + nyilvánosak."* +- **Nethely** — *„A .hu domainek esetén online nyilatkoztattétel szükséges Öntől a regisztráció + befejezéséhez"*: **the tester himself must confirm the registration**, so his own e-mail address is + load-bearing. Whether he gets a separate login was **not stated** on the pages I read — their page + speaks only of the customer account the domains sit in (*„Az Ön ügyfélfiókjában található .hu + domainek"*). Recorded as unknown, not as a yes or a no. , + (Nethely Kft., 1115 Budapest, Halmi utca 29.) +- **The registry** — ISZT Internet Szolgáltatók Hálózati Koordinációs Központja Nonprofit Kft., + 1089 Budapest, Bláthy Ottó u. 9. + +**On the Cloudflare question**, what the build already assumed and nothing had written down: +`day0-install.md` A.1 has you create the tunnel in the Cloudflare dashboard and mint +`felhom-` scoped to that one zone, and the hub refuses a token that can see any other +zone (`01` §7, R-138 option C). Both need the zone on an account you administer. The notice now says +so, and says the domain moves to his own account when he leaves or the test ends. + +## 2. The privacy notice: what was added + +New **§10, „A domained regisztrációja"**, live at : + +> **Mit kérünk el tőled:** a **neved, a postacímed, egy értesítési e-mail-címed és egy értesítési +> telefonszámod**. Ennyit ír elő a .hu Domainregisztrációs Szabályzat természetes személy igénylőnek. +> A szabályzat szerint megadható még az anyád neve, a születési dátumod vagy egy igazolványszám is — +> **ezeket nem kérjük és nem is továbbítjuk**. […] +> **Kinek adjuk tovább:** a **Nethely Kft.** (1115 Budapest, Halmi utca 29.) regisztrátornak, aki a +> .hu nyilvántartó […] felé továbbítja. A .hu regisztrációhoz **tőled is kell egy online nyilatkozat** +> […] +> **Mi látszik ebből nyilvánosan:** […] **nem jelenik meg a neved, a címed és a telefonszámod**, csak +> a „Természetes személy" felirat. […] +> **A domain DNS-e a teszt alatt:** a domained a **mi Cloudflare-fiókunkban** van […] Ettől a domain +> még a tied: ha kiszállsz vagy a teszt véget ér, átvisszük a saját fiókodba — vagy ahová kéred. +> **Jogalap:** a veled kötött megállapodás teljesítése (GDPR 6. cikk (1) b). + +**The diff, 1.0 against 1.1.** The only removed-or-changed lines are: the record's own title and its +derived-on date, the version line, and the four renumbered headings (old 10–13 → 11–14). Everything +else in the diff is an addition. The page's single internal cross-reference points at §3.4 and was +unaffected. + +**One change beyond the new section, deliberately:** §11 („Kik látják még az adataidat") gained the +registrar and the registry. A recipients list that omits two recipients is wrong, and I would rather +explain one extra edit than publish an incomplete list. + +Version line: **„Zárt teszt — 1.1 verzió, hatályos: 2026. október 12."** The record is +`documentation/legal/adatkezelesi-tajekoztato-1.1.md`; 1.0 stays as history and the legal README now +points at the 1.1 records for both texts. + +## 3. The kit — `marketing/testers/kit/` + +| file | what it is | +|---|---| +| `README.md` | what the kit is, the order, and the no-personal-data rule with its reason | +| `01-KERDESEK-GEP-ES-NET.md` | the questions about his machine and net — every one traced to `day0-install.md` Part B or the site's FAQ, with what to do if he does not know | +| `02-DOMAIN-ADATOK.md` | the four fields the registry requires, and in bold: send them by e-mail, not on a forum or in a private message | +| `03-ELFOGADO-EMAIL.md` | the e-mail he sends back accepting terms 1.1 and privacy notice 1.1 — **the domain is not bought before it arrives** | +| `04-UDVOZLO-EMAIL.md` | the next steps in order, and the recovery code warning in full: shown once, and nobody can open the backup without it | +| `05-LEPESEK-UZEMELTETONEK.md` | your own list, first message to installed box, each step pointing at its `day0-install.md` section, with the gates between steps | + +Plus `marketing/testers/EMAIL-privacy-1.1.md` — the notice to the existing testers that the privacy +notice changed, with the same recipient reasoning as the terms e-mail. + +**No requirement in the kit is invented.** Each one carries a source comment naming the line it comes +from, so nothing promises the tester something the terms do not. + +## 4. Commits, gates, register + +- **Commit:** `225afa0f` on `main`. No `--no-verify`. +- **Gates:** `site_gates.py` green on Windows and again on Linux at a checkout containing this commit; + `instructions_gate.py` OK there too. **The full `repo_gates.py --fast` could not be run at this + commit:** the DooPlex clone has another session's uncommitted register work in it all evening, and I + left that tree alone rather than disturbing it. A scratch clone runs the cross-repo gates + inconclusive (the sibling repos are not beside it), so it is not a substitute — stated rather than + dressed up. +- **Register: 102 before, 102 after, 0 opened, 0 closed.** The register moved from 128 to 102 today + through two other sessions, not this one. This task found nothing worth filing: the one thing it + could have filed — that the notice did not cover the domain — is what it fixed. +- Live read-back: `https://felhom.eu/adatkezeles` → **200**, „1.1 verzió, hatályos: 2026. október 12.", + §10 present, §§11–14 renumbered. + +## 5. What is yours to do next + +1. **Send `marketing/testers/EMAIL-privacy-1.1.md`** to the one real existing tester (the friend whose + machine is not built yet). Individually, not as a thread. +2. **Send `kit/01-KERDESEK-GEP-ES-NET.md`** to the Prohardver tester. Your reply to him already covers + the shape of the thing (a machine, the install, the domain you buy in his name for two years, and + why a dedicated domain is needed) — what it does not yet ask is the specifics: the model or CPU, + the memory, the disks, the always-on place, the cable, the upload speed, and whether anything on + that machine must survive the install. +3. **Then `kit/02-DOMAIN-ADATOK.md`**, and wait for `03` before buying anything.