Privacy Policy

Last updated 25 September 2026

This policy explains what personal data Konfigo collects and why, under the EU General Data Protection Regulation (GDPR) and Hungarian law.

1. Who is responsible

The data controller is Gabor Magyar, a private individual, 7624 Pécs, Rókus utca 5. Contact for anything privacy related: hi@magyarg.dev.

2. What we collect and why

  • Account data: your name, email address and a hash of your password (never the password itself). If you sign in with Google or GitHub, we receive your name, email and profile picture from them. Purpose: creating and running your account. Legal basis: contract (Art. 6(1)(b)).
  • Content you create: projects, flags, config values, API key metadata (name, environment, last four characters and a hash, never the full key after creation) and an activity log of who changed what. Purpose: providing the service. Legal basis: contract.
  • Usage counters: the number of API requests your account makes per month, to apply plan limits. Legal basis: contract.
  • Technical data: IP address, user agent and request timestamps handled by our servers and sign-in system, used for security, abuse prevention and rate limiting. Legal basis: legitimate interest in keeping the service secure (Art. 6(1)(f)).
  • Website analytics: page views, referrer, browser, operating system, device type and country, plus anonymous product events (for example that a sign-up was completed or a button was clicked, never who did it), collected with Umami, which we host ourselves on our own servers. It sets no cookies, does not store your IP address and does not follow you across sites, and we do not record URL query strings. Respects your browser's Do Not Track setting. Purpose: understanding which pages are useful and improving the service. Legal basis: legitimate interest (Art. 6(1)(f)).
  • Emails: we send verification and password reset emails. We do not send marketing email.
  • Accounting records: if you buy a paid plan in the future, invoices are kept as required by Hungarian accounting and tax law (Art. 6(1)(c)).

We do not sell your data, and we do not use it for advertising or profiling.

3. Cookies

We only use strictly necessary cookies, which do not need consent:

  • Session cookies (set by our sign-in system, names start with better-auth) keep you signed in and protect against forgery.
  • konfigo_project remembers which project you have open (1 year).

We do not use analytics, advertising or tracking cookies (our analytics is cookieless, see above). The notice you saw when arriving is stored in your browser's local storage (konfigo_cookie_notice), not in a cookie. If we add optional cookies in the future, we will ask for your consent first.

4. Who we share data with

Only providers that help us run the service, under data processing terms:

  • Hosting and database: Digitalocean, Frankfurt.
  • Email delivery: Resend (verification and reset emails).
  • Google or GitHub, only if you choose to sign in with them.

Some providers may process data outside the European Economic Area. In that case we rely on safeguards such as the EU-US Data Privacy Framework or Standard Contractual Clauses. We may also disclose data where the law requires it.

5. How long we keep it

  • Account and project data: until you delete it or your account. Deleting a project removes its flags, values, keys and activity log.
  • Usage counters: removed together with the account.
  • Website analytics: aggregated statistics that do not identify you, kept for as long as they are useful.
  • Accounting records: 8 years, as required by Hungarian law.
  • Backups and logs are removed on a rolling schedule shortly after.

6. Your rights

You can ask for access to your data, correction, deletion, restriction of processing, a portable copy, and you can object to processing based on legitimate interest. Write to hi@magyarg.dev; we answer within one month. You can also complain to the Hungarian data protection authority, the NAIH (Nemzeti Adatvédelmi és Információszabadság Hatóság, 1055 Budapest, Falk Miksa utca 9-11, naih.hu), or to the authority in your country.

7. Security

Passwords are hashed, API keys are stored only as hashes, connections use HTTPS, and access is limited to what is needed to run the service. No system is perfectly secure; if a breach affects you we will notify you as the law requires.

8. Changes

We will update this page when our practices change and note the date at the top. For material changes we will let you know by email or in the app.