felhom.eu/REPORT-tester-kit-2026-10-12.md

# REPORT — the first tester: privacy notice 1.1 and a reusable kit (2026-10-12)

## In plain words

A tester answered on Prohardver today. Before his domain is bought in his name, the privacy notice had
to say that his name, address, e-mail and telephone number go to a domain seller — it did not. It does
now, live, and it says it before the purchase rather than after.

Alongside it there is a small kit you reuse for every tester: the questions about his machine, the
data the domain needs, the e-mail he sends to accept the terms, the welcome e-mail, and your own step
list. No personal data is in any of it, and none ever goes into this repository.

## 1. Your two answers

| | you chose |
|---|---|
| Registrar for a tester's `.hu` domain | **Nethely Kft.** |
| Whose Cloudflare account holds the zone | **yours (Felhom's), during the test** |

Both are recorded as dated rulings in `CONTEXT.md`. The second one also answers a question that had
been open in the privacy draft since 2026-10-08 (open point 9).

**What I read, and where (2026-10-12):**

- **Domainregisztrációs Szabályzat §1.2.2.1** — what a natural person must give:
  *„Természetes személy domain-igénylő: neve, postacíme, értesítési email címe, értesítési
  telefonszáma, faktor adata(i)"*. Mother's name, date of birth and ID number are listed as
  **optional** — so they are not asked for and not passed on. §1.1.3: the applicant must be 18.
  <https://www.domain.hu/domainregisztracios-szabalyzat/>
- **The public WHOIS** — for a natural person the lookup shows only the label „Természetes személy";
  address and telephone are not public. In the registry's words: *„A pontos személyes adatok nem
  nyilvánosak."* <https://www.domain.hu/whois/>
- **Nethely** — *„A .hu domainek esetén online nyilatkoztattétel szükséges Öntől a regisztráció
  befejezéséhez"*: **the tester himself must confirm the registration**, so his own e-mail address is
  load-bearing. Whether he gets a separate login was **not stated** on the pages I read — their page
  speaks only of the customer account the domains sit in (*„Az Ön ügyfélfiókjában található .hu
  domainek"*). Recorded as unknown, not as a yes or a no. <https://www.nethely.hu/domain>,
  <https://www.nethely.hu/impresszum> (Nethely Kft., 1115 Budapest, Halmi utca 29.)
- **The registry** — ISZT Internet Szolgáltatók Hálózati Koordinációs Központja Nonprofit Kft.,
  1089 Budapest, Bláthy Ottó u. 9. <https://www.domain.hu/impresszum/>

**On the Cloudflare question**, what the build already assumed and nothing had written down:
`day0-install.md` A.1 has you create the tunnel in the Cloudflare dashboard and mint
`felhom-<customer-id>` scoped to that one zone, and the hub refuses a token that can see any other
zone (`01` §7, R-138 option C). Both need the zone on an account you administer. The notice now says
so, and says the domain moves to his own account when he leaves or the test ends.

## 2. The privacy notice: what was added

New **§10, „A domained regisztrációja"**, live at <https://felhom.eu/adatkezeles>:

> **Mit kérünk el tőled:** a **neved, a postacímed, egy értesítési e-mail-címed és egy értesítési
> telefonszámod**. Ennyit ír elő a .hu Domainregisztrációs Szabályzat természetes személy igénylőnek.
> A szabályzat szerint megadható még az anyád neve, a születési dátumod vagy egy igazolványszám is —
> **ezeket nem kérjük és nem is továbbítjuk**. […]
> **Kinek adjuk tovább:** a **Nethely Kft.** (1115 Budapest, Halmi utca 29.) regisztrátornak, aki a
> .hu nyilvántartó […] felé továbbítja. A .hu regisztrációhoz **tőled is kell egy online nyilatkozat**
> […]
> **Mi látszik ebből nyilvánosan:** […] **nem jelenik meg a neved, a címed és a telefonszámod**, csak
> a „Természetes személy" felirat. […]
> **A domain DNS-e a teszt alatt:** a domained a **mi Cloudflare-fiókunkban** van […] Ettől a domain
> még a tied: ha kiszállsz vagy a teszt véget ér, átvisszük a saját fiókodba — vagy ahová kéred.
> **Jogalap:** a veled kötött megállapodás teljesítése (GDPR 6. cikk (1) b).

**The diff, 1.0 against 1.1.** The only removed-or-changed lines are: the record's own title and its
derived-on date, the version line, and the four renumbered headings (old 10–13 → 11–14). Everything
else in the diff is an addition. The page's single internal cross-reference points at §3.4 and was
unaffected.

**One change beyond the new section, deliberately:** §11 („Kik látják még az adataidat") gained the
registrar and the registry. A recipients list that omits two recipients is wrong, and I would rather
explain one extra edit than publish an incomplete list.

Version line: **„Zárt teszt — 1.1 verzió, hatályos: 2026. október 12."** The record is
`documentation/legal/adatkezelesi-tajekoztato-1.1.md`; 1.0 stays as history and the legal README now
points at the 1.1 records for both texts.

## 3. The kit — `marketing/testers/kit/`

| file | what it is |
|---|---|
| `README.md` | what the kit is, the order, and the no-personal-data rule with its reason |
| `01-KERDESEK-GEP-ES-NET.md` | the questions about his machine and net — every one traced to `day0-install.md` Part B or the site's FAQ, with what to do if he does not know |
| `02-DOMAIN-ADATOK.md` | the four fields the registry requires, and in bold: send them by e-mail, not on a forum or in a private message |
| `03-ELFOGADO-EMAIL.md` | the e-mail he sends back accepting terms 1.1 and privacy notice 1.1 — **the domain is not bought before it arrives** |
| `04-UDVOZLO-EMAIL.md` | the next steps in order, and the recovery code warning in full: shown once, and nobody can open the backup without it |
| `05-LEPESEK-UZEMELTETONEK.md` | your own list, first message to installed box, each step pointing at its `day0-install.md` section, with the gates between steps |

Plus `marketing/testers/EMAIL-privacy-1.1.md` — the notice to the existing testers that the privacy
notice changed, with the same recipient reasoning as the terms e-mail.

**No requirement in the kit is invented.** Each one carries a source comment naming the line it comes
from, so nothing promises the tester something the terms do not.

## 4. Commits, gates, register

- **Commit:** `225afa0f` on `main`. No `--no-verify`.
- **Gates:** `site_gates.py` green on Windows and again on Linux at a checkout containing this commit;
  `instructions_gate.py` OK there too. **The full `repo_gates.py --fast` could not be run at this
  commit:** the DooPlex clone has another session's uncommitted register work in it all evening, and I
  left that tree alone rather than disturbing it. A scratch clone runs the cross-repo gates
  inconclusive (the sibling repos are not beside it), so it is not a substitute — stated rather than
  dressed up.
- **Register: 102 before, 102 after, 0 opened, 0 closed.** The register moved from 128 to 102 today
  through two other sessions, not this one. This task found nothing worth filing: the one thing it
  could have filed — that the notice did not cover the domain — is what it fixed.
- Live read-back: `https://felhom.eu/adatkezeles` → **200**, „1.1 verzió, hatályos: 2026. október 12.",
  §10 present, §§11–14 renumbered.

## 5. What is yours to do next

1. **Send `marketing/testers/EMAIL-privacy-1.1.md`** to the one real existing tester (the friend whose
   machine is not built yet). Individually, not as a thread.
2. **Send `kit/01-KERDESEK-GEP-ES-NET.md`** to the Prohardver tester. Your reply to him already covers
   the shape of the thing (a machine, the install, the domain you buy in his name for two years, and
   why a dedicated domain is needed) — what it does not yet ask is the specifics: the model or CPU,
   the memory, the disks, the always-on place, the cable, the upload speed, and whether anything on
   that machine must survive the install.
3. **Then `kit/02-DOMAIN-ADATOK.md`**, and wait for `03` before buying anything.