Privacy policy

This is a draft pending legal review. It describes current behaviour and does not claim compliance with any specific regulation.

Platform and operator

DOMYRA is both the platform name and the public-facing trade name. The platform is operated by an individual. DOMYRA is not represented here as a registered company or separate legal entity.

Privacy contact: contact@domyra.si. The individual operator’s legal identity and any legally required address disclosures remain pending review.

Research and account records

Public research tools do not require an account. Public registration is disabled and member pages are deferred. Existing account records remain stored and may include email, sign-in method, display name, roles, preferences, portfolio costs, saved domains and alert records. Restricted administration uses existing authorised accounts.

Public domain queries and evaluation results may be stored as publicly readable reference records without an account link. Domain strings can sometimes contain personal information. Do not submit confidential information. No automatic retention or deletion schedule for these reference records has been verified.

IP-derived identifiers and rate limiting

To prevent abuse, the application reads an IP value from request headers and derives a hash-based identifier for anonymous request counting. Signed-in requests use an account identifier. These identifiers are pseudonymous, not necessarily anonymous data. The rate-limit table stores the derived identifier rather than the raw IP address; this does not establish what hosting, proxy or provider logs collect.

Expired rate-limit records are deleted when the same identifier and request category are checked again. Records for inactive identifiers can remain beyond the counting window. No scheduled purge or fixed deletion deadline has been verified; a retention policy remains pending approval.

Who can see it

Your portfolio, watchlist, alerts and preferences are private to your account and protected by database-level access rules. Administrators can see account emails, sign-in dates and roles to operate the service. Administrative actions are recorded in an audit log.

Services, external requests and logs

DOMYRA uses Lovable Cloud for application and backend services, including database and authentication. Google Fonts requests were observed in the anonymous preview, allowing Google to receive request metadata. Actual hosting regions, infrastructure subprocessors, international transfers, contractual safeguards and provider-log retention remain unverified.

Application errors may be logged with messages and stack traces. Preview error reporting can forward error details and page paths to Lovable. Retention and deletion of application, hosting, authentication and database logs have not been verified.

According to Lovable Cloud provider documentation, the database is backed up daily and snapshots may be retained for up to approximately 14 days. These snapshots cover database schema and data, not files in storage buckets. The actual project-specific snapshot inventory has not been verified. Immediate removal of deleted data from backups and provider-specific deletion timelines remain unverified.

Cookies and browser storage

A fresh anonymous preview session visiting public research and legal pages without submitting queries had no observed cookies or local-storage entries. Session storage contained a page-scroll restoration entry. This observation does not establish that every workflow or the published environment is free of cookies, tracking or browser storage.

Owner authentication is configured to persist sessions in browser storage. The editor preview also has session-sharing behaviour. The purpose, duration and legal treatment of all deployed storage and similar technologies remain subject to review.

Account deletion and privacy requests

Public member settings are deferred, so public self-service export and deletion are not offered. Authenticated export and account-deletion functions remain in the application. The deletion function removes the authentication account and linked profile, roles, preferences, portfolio, watchlist and alert records, but refuses deletion of the last administrator.

Public reference records and administrative audit records remain. Audit records may contain account IDs, actions, targets, timestamps and operational details. The deletion function removes a specific legacy email field from matching audit entries; it does not establish that all retained audit records contain only a former account ID. Account-derived rate-limit records are not covered by the account-deletion cascades. Audit, log and backup retention and deletion procedures remain pending review.

Privacy requests may be directed to contact@domyra.si, but receipt and handling have not been confirmed. No authorised real delivery-and-receipt test has been performed. Request verification, handling and response procedures remain pending review.

Still to be confirmed

Pending legal and operational review: the operator’s legal identity and any required address disclosures; policy effective date; legal bases and applicable privacy obligations; retention and deletion schedules, including audit logs and backups; hosting regions, sub-processors and international transfers; cookie and browser-storage disclosures; and privacy-request verification, handling and response procedures.

Privacy contact functionality: unverified. The mailbox’s readiness to receive and handle requests must be confirmed. Listing the address does not confirm email delivery or configure an email service.

Qualified review must determine applicable Egyptian and international privacy obligations, if any. This draft does not establish a processing ground or claim compliance with Egyptian or international law.