Free noncommercial test environment
Privacy Policy
Version: privacy-dev-2026-09-22-v1
Version date: 22 September 2026
1. Controller and scope
Stoyan Stoyanov is the controller for the entirely free, noncommercial DEV test at https://dev.hobbyhub.bg. For questions and requests about personal data, contact 100yan40@gmail.com. This policy applies to this test environment.
2. Google sign-in and account creation
We receive the unique Google account identifier and email when provided; verified email is stored as contact information. We request only openid and email. We do not receive your Google password, request Calendar access or date of birth, or durably store tokens for continuing Google access. We do not merge accounts solely because their emails match. You provide a display name. We record an internal identifier, state, Google association, necessary timestamps and the legal document versions, language and acceptance time.
3. Sessions and security
We use necessary technical cookies for sign-in, request protection and short-lived account creation. A session is valid for 8 hours, a Google sign-in request for 10 minutes, and an account-creation request for 30 minutes. Signing out revokes the current session. Abuse prevention processes technical request information, including the IP address within the protected sign-in path; the legal-version acknowledgement record itself contains no IP address or browser fingerprint.
4. Data used by features
Depending on the feature you use, we process events and organizers, participation and attendance, structured ratings, proposals and decisions, permitted routes and content, access permissions and important-action history. Non-public meeting places and private routes require the relevant current permission. Reports and moderation involve structured allegations, decisions, restrictions, communications, reconsiderations and controlled-access records.
5. Purposes and legal bases
Necessary processing for requested account creation, authentication and features provides the service and steps at your request before it — GDPR Article 6(1)(b). Abuse prevention, access control and necessary accountability rely on the legitimate interest in protecting the service and participants — Article 6(1)(f), with respect for your rights. Where a specific legal obligation requires processing, Article 6(1)(c) applies. Acknowledging this policy is not blanket consent to all processing.
6. Visibility and external services
Your chosen name and content may be displayed in permitted public or participant features. Your Google identifier, email and sign-in data are not displayed as a public profile. Google handles sign-in under its own policy: https://policies.google.com/privacy. Loading OpenStreetMap or OpenTopoMap maps sends ordinary technical request information to those providers; Open-Meteo weather information is also used. External Google Maps or Waze links open at your choice under the respective service’s rules.
7. DEV infrastructure and backups
The DEV server and backups use self-hosted, self-managed infrastructure in Bulgaria, EU, managed by Stoyan. They include the existing Proxmox/Synology backup layers. There is no external hosting provider for the DEV application or external backup provider for these copies. DEV/Proxmox automation retains the latest successful backup for each virtual machine in mirror copies; the USB mirror is pruned to the latest copy, and the ZFS/Synology layer pulls the latest copy. This does not establish a common retention period in days for every layer or version within it. Backups must not restore data covered by an already fulfilled erasure request; this control requires manual review before restoration.
8. Retention
Session or request validity is not a deadline for erasing all data. Expired Google requests and completed or expired account-creation requests are eligible for bounded automatic cleanup after a 24-hour technical threshold; maintenance interruptions may delay cleanup. Account data is kept while you participate in the DEV test. On ending participation, an explicit request or the end of the test, the operator manually reviews it for erasure or anonymization. Only what is necessary for a specific unresolved dispute, security incident or legal obligation is retained. Technical logs follow the current system configuration and are subject to manual necessity review; no single exact retention period has been established for them. You can request information about your case through the serviced contact.
9. Your rights and contact
You may request access and a copy, correction, erasure, restriction, portability where applicable, and object to processing based on legitimate interests. Contact 100yan40@gmail.com, including when you cannot sign in. Proportionate identity verification may be needed; do not send a password or identity document with your initial message. Requests are handled within applicable legal periods, normally one month, with notice of any permitted extension. There is no automatic export or one-click deletion feature.
10. Complaints and test limitations
You may complain to the competent supervisory authority, including the Bulgarian Commission for Personal Data Protection: https://cpdp.bg/. Google sign-in is not proof of age. There is no automated decision-making producing legal or similarly significant effects; moderation is human. Public browsing does not require an account; withholding required account data prevents use of signed-in features.
11. Processing by external services
The location of our DEV infrastructure does not mean every external service processes data only in the EU. Google describes processing in multiple countries and its applicable mechanisms and safeguards at https://policies.google.com/privacy/frameworks. Information about map requests is available at https://osmfoundation.org/wiki/Privacy_Policy and in the respective provider’s rules. These links describe their activities; we do not assert an unverified processing agreement or transfer mechanism on our behalf. Messages to the serviced Gmail address are also processed through Google’s service.