What we keep, and why.

The controller of your personal data is:

Name

Peter Gombos (an individual)

Address

Berc utca 14, 1015 Budapest, Hungary

Email

pepegombos@gmail.com

• –Your account: your email address, your name, your password (stored only as a hash, never as you typed it), whether you have confirmed your email, and your sign-ins (each with the IP address and browser it came from). We need these to give you an account and keep it secure. Legal basis: the contract with you (GDPR Art. 6(1)(b)).
• –Your purchase: the email and name given at checkout, what was paid, in which currency, when, its status, Stripe's references for the payment, customer, invoice and receipt, and when you agreed to the terms (and which version). Legal basis: the contract (Art. 6(1)(b)) and our duty to keep accounting records (Art. 6(1)(c)).
• –Your firmware downloads: each download attempt, with your account, the version, whether it was served, the time, and the IP address and browser. It is your download history on the account page, and it protects the downloads from misuse. Legal basis: our legitimate interest in protecting what we sell (Art. 6(1)(f)).
• –Installation reports: your account, the release selected, whether you install, update or restore stock firmware, when the job starts and finishes, its outcome, and a short failure code if it fails. This helps us understand installation problems and provide support. We do not receive your device identity or project contents. Legal basis: our legitimate interest in maintaining a reliable installer (Art. 6(1)(f)).
• –Emails we send: sign-in links, password resets and the message after a purchase. No newsletters and no marketing. Legal basis: the contract (Art. 6(1)(b)).
• –Messages you send us: what you write, so we can answer. Legal basis: our legitimate interest in answering (Art. 6(1)(f)), or the contract when it is about your purchase.
• –Visits to the site: Vercel Web Analytics counts page views: the page (without anything after the “?” in its address), the site you came from, your country, and the type of browser, system and device. It uses no cookies, does not follow you to other sites, and does not identify you. Legal basis: our legitimate interest in knowing which pages are read (Art. 6(1)(f)).

We never see your card details, we do not sell your data, and we do not use it for advertising.

The installer and the projects page talk to your FM-1 over USB from your browser. What they read from it (its model and firmware version, your projects) and the files you choose (M-VAVE's V15 file, your project files) stay on your computer: none of it is sent to us. The installer fetches the release description and the firmware file from this site. Downloads and installation outcomes are logged as described above. The emulator runs entirely in your browser too.

Your browser also keeps two small notes of its own: your light or dark choice, and, while an install runs, that it started, so the page can offer to finish it if the tab was closed. They stay in the browser and are never sent to us.

Only one kind: the sign-in cookies, set when you log in so that the site knows it is you. They are essential to the account, so there is no cookie banner. There are no advertising, tracking or analytics cookies.

These services process data for us, under contracts that oblige them to protect it:

• –Vercel hosts the site, counts page views (Web Analytics) and stores the firmware files (Vercel Blob; the files hold no personal data).
• –Turso hosts the database with your account, purchases, downloads and installation reports.
• –Stripe takes the payment. Stripe also handles your card and payment details under its own privacy policy, as a controller in its own right.
• –Postmark delivers the emails we send.

Some of these companies are in the United States. Where data leaves the European Economic Area, the transfer rests on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

• –Your account, sign-ins, download history and installation reports: while you have the account. Ask us to close it and they are deleted.
• –Purchase and invoice records: as long as accounting and tax law requires (in Hungary, eight years), even after the account is closed.
• –A sign-in that is not used for 30 days expires.
• –Emails with us: as long as needed to help you, then deleted.

You can ask to see the data we hold about you, to correct it, to delete it, to restrict how it is used, or to receive it in a portable form, and you can object to what we do on the basis of legitimate interest. Write to pepegombos@gmail.com; we answer within a month. Your name and password can also be changed on your account page at any time.

If you think we handle your data wrongly, you can complain to the Hungarian data protection authority (NAIH) or to the authority in the country where you live. We would rather hear from you first.

Buying Groove OS needs an adult. We do not knowingly collect data from children under 16.

When what we collect or who helps us changes, this page changes with it, and the date at the top says when.