Privacy policy

This explains what Flamas collects, why, who else ends up seeing it, and how to make us stop. It is written to be read rather than to be defensible, and it describes what the software actually does.

Who we are

Flamas is operated by Sárvári Merse, +36703004005. We are the data controller for the personal data described here. Questions, requests and complaints go to merse.sarvari@gmail.com.

What we collect, and why

• Your account. Email address, display name, username, and whatever you choose to add: a bio, a link, an avatar. If you sign in with Google we receive your email address, name and profile picture from Google, and nothing else. We need this to have an account at all.
• What you post. Products, launches, comments, posts, wants, votes, messages you send to other people. Most of it is public by design and is meant to be read.
• Payments. If you buy credits, Stripe processes the payment. We never see or store your card details. We keep the fact of the purchase, the amount, and a Stripe customer reference.
• Technical data. Your IP address is used to rate limit sign-in attempts and abusive requests. We do not build an advertising profile, and there is no third-party tracking or advertising network on this site.
• Images you upload. Stored on our own object storage, served from our domain.

The part worth reading twice

A maker can pay to receive your email address, but only if you explicitly said they could. On a want, and when expressing interest in a launch, there is an unticked box that says a maker may email you about it. If you tick it, and only then:

• We store the exact wording you agreed to and the moment you agreed, so there is a record of what you were actually asked.
• The maker whose product wins that want's race can spend credits to receive your address, along with the others who consented.
• Nobody else can. Not the person who posted the want, not a maker whose product lost, not an advertiser. There is no other route by which your address leaves this service.
• You can revoke it at any time, and revoking removes you from a list somebody has already bought. We cannot un-send an email that already went out, and we do not pretend otherwise.

Signing up, signing in, posting, voting and commenting never put you on any such list.

Automated processing

• Moderation.Text you post may be sent to Google's Gemini API to be scored for spam and abuse. A refusal is a machine decision you can appeal by contacting us, and a human reviews the queue.
• Candidate review.When a product is put forward as the answer to a want, the want's text and the product's description are sent to the same API to judge whether it is relevant. It can keep a product off a ballot; it never deletes anything, and a person reviews what it flags.
• Listing drafts. If you paste a product URL, we fetch that page and send its content to the same API to draft your listing.

Who else sees your data

These are the only processors we send personal data to:

• Resend, to deliver email. They receive your address and the message.
• Stripe, to take payments. They receive what a payment needs.
• Google, for sign-in, and for the automated processing above.
• Our hosting and database providers, who store the data on our behalf.

Some of these are outside the European Union and receive data under the transfer terms in their own agreements. We do not sell personal data to anyone, and the paid contact lists described above are not an exception to that: they move only with your specific, revocable consent.

How long we keep things

• Your account and what you posted: until you delete them.
• Uptime check results for listed products: 90 days.
• Sign-in codes and password reset links: seven days, and they stop working long before that.
• Purchase records: as long as tax law requires, because a receipt is not ours to delete.

Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it, object to how we use it, or ask us to send it somewhere else. Email merse.sarvari@gmail.com and we will answer within a month. You can change email preferences yourself in settings, and revoke a contact consent from the want or launch it was given on.

Deleting your account removes your profile and your content. Things other people depend on are handled carefully: a vote you cast stays counted but stops being attributable, because removing it would silently change a result other people acted on.

If you think we have handled your data badly, you can complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH). We would rather you told us first.

Cookies

We set a session cookie when you sign in, and a short-lived cookie during sign-in itself. That is all. There are no analytics cookies, no advertising cookies, and nothing to consent to, which is why you have not been shown a banner.

Changes

If we change how we use personal data in a way that matters, we will say so here and, when it is significant, by email. The date at the top is the last time this changed.