Privacy Policy

1. Controller#

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws as well as other data protection regulations is: ModSeven Engineering Owner: Philipp Hanzik Gogolstraße 8b 90475 Nuremberg Germany Email: info@modseven.net

2. General information on data processing#

As a matter of principle, we process personal data of our users only insofar as this is necessary to provide a functional website as well as our content and services. Personal data of our users is regularly processed only with the user’s consent. An exception applies in cases where prior consent cannot be obtained for factual reasons and the processing of the data is permitted by law.

3. Hosting (Vercel)#

This website is hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). When this website is accessed, technically necessary data (in particular server log files) is processed by Vercel. Vercel may process data in the USA. A data processing agreement (DPA) exists between us and Vercel for transfers to the USA. Insofar as data is transferred to third countries, this is done on the basis of the EU standard contractual clauses (Art. 46(2)(c) GDPR) and, where applicable, on the basis of the EU-US Data Privacy Framework. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a reliable, secure and high-performance provision of the online offer).

Further information: https://vercel.com/legal/privacy-policy

4. Server log files#

When you visit our website, our hosting provider (Vercel) automatically collects and stores the following data transmitted by your browser or device in so-called server log files:

• IP address – of the requesting device (truncated/anonymised where technically possible)
• Date and time – of the request
• URL and method – of the requested resource
• HTTP status code – and amount of data transferred
• User agent – browser type, version and operating system
• Referrer – the previously visited page, if transmitted

This data is stored for a limited time to ensure operation, security (defence against attacks) and error analysis, and is not merged with other data sources. Legal basis: Art. 6(1)(f) GDPR.

5. Cookies, language selection and cookie consent#

Our website uses cookies. Cookies are small text files stored in your browser. We use both technically necessary cookies (e.g. to store your cookie decision, your language selection and, for logged-in users, a session cookie for authentication) and – after your consent – cookies for analytics purposes. The website is available in German and English. On your first visit the language is preselected automatically: for this we evaluate the country of origin derived from your IP address by our hosting provider (only the country code, e.g. “DE”) and, as a fallback, your browser’s language setting. This information is used solely to redirect you to the appropriate language version and is not stored by us. You can change your language at any time using the “DE / EN” switch in the page header.

• cookieConsent – Stores your decision regarding the cookie banner. Duration: 365 days. Legal basis: Art. 6(1)(f) GDPR and § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act).
• NEXT_LOCALE – Stores the most recently selected language (de/en) so that you see the appropriate language version directly on your next visit. Duration: 365 days. Legal basis: Art. 6(1)(f) GDPR and § 25(2) no. 2 TDDDG.
• Authentication cookie – Only set when you sign in to the internal area. Contains a signed JSON Web Token (JWT). HTTP-only, secure. Legal basis: Art. 6(1)(b) GDPR.
• Google Analytics (_ga, _ga_*) – Only set if you explicitly consent to their use in the cookie banner. Legal basis: Art. 6(1)(a) GDPR, § 25(1) TDDDG.

You can withdraw your consent at any time by deleting the cookies in your browser or by contacting us by email.

6. Google Analytics#

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. It is used exclusively if you have explicitly consented in the cookie banner. The data stream is named “mdsvn”, the measurement ID is G-RT96KR6VJN. Google Analytics uses cookies and similar technologies to analyse your use of the website. The information generated about your use of this website is usually transmitted to a Google server in the USA and stored there. IP anonymisation is active; your IP address is therefore truncated by Google beforehand within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide the website operator with further services related to website and internet usage.

• Purpose – statistical evaluation of website usage in order to improve the content and structure of the site
• Legal basis – Art. 6(1)(a) GDPR (consent) and § 25(1) TDDDG
• Recipients – Google Ireland Ltd. / Google LLC (USA)
• Third-country transfer – transfer to the USA on the basis of the EU-US Data Privacy Framework and EU standard contractual clauses
• Retention period – Data transmitted from your device in the context of Google Analytics is automatically deleted after 14 months. The cookies _ga and _ga_* have a lifetime of up to 24 months.
• Withdrawal – You can withdraw your consent at any time with effect for the future – by deleting the cookies in your browser, by declining in the cookie banner or by installing the browser add-on at https://tools.google.com/dlpage/gaoptout

A data processing agreement pursuant to Art. 28 GDPR is in place with Google. Further information on how Google Analytics handles user data can be found in Google’s privacy policy: https://policies.google.com/privacy

7. Contact form#

If you send us enquiries via the contact form or by email, your details from the enquiry form, including the contact details you provide there, are stored by us for the purpose of processing the enquiry and in case of follow-up questions. The following data is processed:

• Name – to address you personally
• Email address – to answer your enquiry
• Subject & message – content of your enquiry
• IP address – for protection against misuse (spam prevention, security)
• Timestamp – of the submission

The data is stored in a database operated by us (PostgreSQL via Prisma ORM) and additionally forwarded by email to our mailbox. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in efficient processing). The data is not passed on to third parties. Retention period: until your enquiry has been fully processed, but no longer than 24 months, unless statutory retention obligations require otherwise.

8. Email delivery (Strato)#

For sending and receiving emails – in particular for contact form enquiries – we use the mail servers of Strato AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with Strato. The servers are located in Germany. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reliable email delivery).

Privacy policy: https://www.strato.de/datenschutz/

9. Registration and login (internal area)#

If you create a user account in the internal area, we process the data you provide (e.g. name, email address, password) in order to provide the customer account. Passwords are stored exclusively as hash values using bcrypt; they are never stored in plain text. After a successful login, a signed JSON Web Token (JWT) is set as an HTTP-only cookie in your browser to authenticate you for further requests. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Retention period: until the account is deleted by you or by us; the session cookie has a limited validity.

10. Recipients / processors#

We use the following service providers, each of which is bound by a data processing agreement pursuant to Art. 28 GDPR:

• Vercel Inc. (USA) – hosting of the website
• Google Ireland Ltd. / Google LLC – web analytics via Google Analytics (only with consent)
• Strato AG (Germany) – sending and receiving emails

11. Your rights#

You have the following rights vis-à-vis us with regard to the personal data concerning you:

• Right of access – Art. 15 GDPR
• Right to rectification – Art. 16 GDPR
• Right to erasure – Art. 17 GDPR
• Right to restriction of processing – Art. 18 GDPR
• Right to data portability – Art. 20 GDPR
• Right to object – Art. 21 GDPR
• Withdrawal of consent – Art. 7(3) GDPR – the lawfulness of processing carried out before the withdrawal remains unaffected

To exercise your rights, an informal email to info@modseven.net is sufficient.

12. Right to lodge a complaint with a supervisory authority#

You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data (Art. 77 GDPR). The authority responsible for us is: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) Promenade 18 91522 Ansbach Germany https://www.lda.bayern.de

13. SSL/TLS encryption#

For security reasons and to protect the transmission of confidential content, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address line of the browser changes from “http://” to “https://” and by the lock symbol in your browser bar.

14. Currency and amendment of this privacy policy#

This privacy policy is currently valid and was last updated in September 2026. Due to the further development of our website or changes in legal or regulatory requirements, it may become necessary to amend this privacy policy. The current privacy policy can be accessed on this page at any time.

1. Controller#

The controller within the meaning of the GDPR and other national data protection laws as well as other data protection regulations is: ModSeven Engineering – Philipp Hanzik Gogolstraße 8b, 90475 Nuremberg, Germany Email: info@modseven.net Please direct all enquiries regarding data protection, access, rectification and erasure exclusively to the email address above.

2. Scope#

This policy applies to:

• the mobile Choreo app for Android (package net.modseven.choreo)
• the backend at https://choreo-mu.vercel.app (web pages for email confirmation, invitation acceptance, password reset)
• the optional MagicMirror module “MMM-Choreo”, which authenticates against the backend

3. Which personal data is processed?#

4. Purposes and legal bases#

5. Recipients / processors#

We use processors within the meaning of Art. 28 GDPR with whom data processing agreements exist or for whom we rely on the respective data processing addendum:

6. Data transfer to third countries#

Vercel and Google are corporations based in the USA. A transfer of personal data to the USA is possible. The transfer takes place on the basis of:

• the EU-US Data Privacy Framework (for the respectively certified recipients)
• additionally the standard contractual clauses (SCCs) of the EU Commission where no certification applies
• as well as supplementary technical and organisational measures

The database (Neon) is operated in the Frankfurt (EU) region; the application data stored there is therefore not transferred to third countries.

7. Retention period and deletion#

• Account and family data remains stored as long as the account exists.
• Time entries and tasks are generally stored permanently so that statistics and histories remain available. The user can delete individual entries in the app at any time.
• Verification and reset tokens become unusable after redemption or expiry and are discarded during the next processing run (maximum lifetime of 60 minutes for reset, 24 hours for email verification).
• Refresh tokens are invalidated on logout, password change or reset.
• Invitations: 14-day lifetime, automatically invalid thereafter.
• Push tokens are deleted when the user signs out or revokes push on the device.
• Upon request by the user (email to info@modseven.net), the entire account including all tasks, times and avatars is deleted. In special cases (e.g. if the user is the admin of the only family administration) we will consult beforehand about handing over to another member.

8. App permissions (Android)#

• Push notifications (Android 13+): only if the user agrees; without consent the app continues to work but does not receive teasing pings.
• Photo picker (PickVisualMedia): requested when the user wants to select an avatar image. Only the image selected by the user is read, never the entire photo library.
• Internet and foreground service (for running timers): technically necessary.

9. Cookies and tracking#

• The app itself does not set cookies and uses no tracking (no Google Analytics, no Facebook pixel, no advertising IDs).
• The website uses only technically necessary storage mechanisms (session storage during the email verification / reset flow), no tracking cookies.
• No data is sold or passed on to advertising networks.

10. Avatar URLs#

Profile pictures are delivered via a unique, hash-based URL of the form /api/users/<userId>/avatar?v=<sha1> so that browsers and the app can cache the image. The URL cannot be guessed (user ID and hash are both randomly generated), but the endpoints are technically publicly accessible. Anyone who knows the link can retrieve the image — comparable to an “unlisted” URL.

11. MagicMirror token#

Family admins can generate a read-only token that allows a MagicMirror module to access basic family data (members, current time accounts, upcoming tasks). The token can be revoked at any time; a new token invalidates the old one.

12. Security measures#

• Transport encryption: TLS 1.2/1.3 for all connections between app, website and backend
• Password hashing: bcrypt with 12 rounds
• JWT signature: HS256 with a secret held server-side
• Token rotation: refresh tokens are revoked on security events (password change, reset, logout)
• Data minimisation: each endpoint only returns the fields required; in particular, the password hash is never transmitted to the client

13. Rights of data subjects#

As a data subject within the meaning of the GDPR, you have the following rights:

• Access (Art. 15) to the data stored about you
• Rectification of inaccurate data (Art. 16)
• Erasure of your data (Art. 17), insofar as no statutory retention obligations apply
• Restriction of processing (Art. 18)
• Data portability (Art. 20) — on request we provide a machine-readable export of your data
• Objection (Art. 21) to processing based on legitimate interests
• Withdrawal of consent given, with effect for the future

To exercise these rights, an informal email to info@modseven.net stating the email address associated with your account is sufficient.

14. Right to lodge a complaint with a supervisory authority#

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). As a rule, the authority of your habitual residence is responsible. In Germany, the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, https://www.lda.bayern.de is responsible for us. Users from Austria can contact the Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, https://www.dsb.gv.at, dsb@dsb.gv.at.

15. Children#

Choreo is primarily aimed at adults or families with parents as family admins. Accounts for minors may only be created with the consent of a parent or guardian. We do not collect data directly from children under 16 without such consent.

16. Changes to this privacy policy#

We reserve the right to amend this privacy policy so that it always complies with current legal requirements or to implement changes to our services. The current version then applies to your next visit. Users will be notified by email of significant changes.

1. Controller#

The controller for data processing in connection with this app is: ModSeven Engineering – Philipp Hanzik Gogolstraße 8b 90475 Nuremberg Germany Email: info@modseven.net Web: modseven.net

2. Basic principle: local and offline#

YAMA is a companion app for MeshCore radios. The app is built to process as little data as possible:

• It uses no user accounts, no advertising and no analytics or tracking services (no Google Analytics, Firebase Analytics, advertising IDs or similar).
• Your messages, contacts, channels, settings and measurement points are stored exclusively locally on your device and are not transmitted to us or third parties.
• An internet connection is only required for map tiles (see section 5).

3. Data stored locally on the device#

The following data is stored locally in the app and does not leave your device towards our servers:

This data remains stored until you delete it in the app or uninstall the app. If Android system backup is enabled on your device, app data may be included in this device-/account-bound backup. Legal basis: Art. 6(1)(b) GDPR (provision of the functions you requested).

4. Support / contact form#

If you use the support / contact form in the app, the details you enter – name, email address and your message – are transmitted to our server at https://modseven.net so that we can process your request. Without active use of this form, no such transmission takes place.

Purpose: processing your request. Legal basis: Art. 6(1)(b) or (f) GDPR (responding to enquiries). Retention period: as long as necessary to process the request, or until statutory retention periods expire.

5. Map tiles (third-party providers)#

For the map view, the app loads map tiles from external map services. In doing so, the respective provider necessarily receives your IP address and the requested tile coordinates (which reflect the approximate map section viewed). Depending on the selected map style, the following are used:

• CARTO (tiles from basemaps.cartocdn.com) – map data © OpenStreetMap contributors, style © CARTO
• Esri (satellite, server.arcgisonline.com)

Please note the privacy policies of these providers. The map is only loaded when you open the map view. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in displaying the map).

6. Bluetooth and mesh network#

The app connects to your MeshCore device via Bluetooth. Only data between the app and the device is exchanged over this connection; there is no transmission to us. Please be aware of the nature of a radio mesh network: messages you send over the network, as well as any position of your node you may have configured, are transmitted by radio and relayed by other participants/repeaters. What you send over the mesh is therefore not private vis-à-vis other network participants. This is the responsibility of the user and is not processing by us.

7. Permissions and their purpose#

On Android 12+, Bluetooth scanning is requested with the flag “not used to derive location” (neverForLocation). Location is only used for the map functions mentioned above.

8. Disclosure to third parties#

Apart from the cases mentioned in section 4 (support server) and section 5 (map providers), no personal data is passed on to third parties. No data is sold.

9. Your rights#

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Since most data resides exclusively on your device, you can remove it yourself at any time by deleting it in the app or uninstalling the app. For matters concerning the support server, please contact the address given in section 1. You also have the right to lodge a complaint with a data protection supervisory authority.

10. Changes to this privacy policy#

We amend this privacy policy when the app or the legal situation changes. The current version published here applies.

11. Contact#

If you have any questions about data protection, you can reach us at: info@modseven.net

1. Data Controller#

Responsible for data processing within the Tummo Breath App: ModSeven Engineering – Philipp Hanzik Gogolstraße 8b, 90475 Nürnberg, Germany Contact: support@modseven.net

2. Health Data#

The Tummo Breath App is a guided breathing exercise application. It does not collect, store, transmit, or share any health data or biometric information.

• Local storage only – All breathing session data (e.g. session duration, round counts) is stored locally on your device only and is never transmitted to any server.
• No health APIs – The app does not use any health or fitness APIs (e.g. Google Fit, HealthConnect).
• No sharing – No health data is shared with third parties, advertisers, or analytics services.

3. What Data We Collect#

The Tummo Breath App only collects data that you voluntarily submit through the in-app support form:

• Name – to address you personally when responding
• Email address – to reply to your inquiry
• Message (free text) – the content of your request
• Date & time – for tracking and follow-up purposes

Through the support form we do not collect IP addresses, location data, health data, or any other tracking information. Aside from the anonymous usage statistics described in section 4, no analytics or advertising SDKs are used.

4. Anonymous Usage Statistics#

To improve the app and understand which features and settings are used, we collect anonymous usage statistics. No personal data is collected in this process.

5. Legal Basis#

Data processing is based on Art. 6(1)(b) GDPR (contract performance or pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in responding to support inquiries).

6. Data Retention#

Data submitted through the support form is stored for the duration of processing your inquiry and deleted within 90 days thereafter, unless legal retention obligations apply.

7. Data Deletion#

You have the right to request deletion of your personal data at any time. To do so, send an informal email to support@modseven.net. We will completely remove your data within 30 days of receiving your request and confirm the deletion by email.

8. Your Rights#

Under the GDPR, you have the following rights: access to your stored data (Art. 15), rectification of inaccurate data (Art. 16), erasure of your data (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing (Art. 21). You also have the right to lodge a complaint with a data protection supervisory authority.

9. Third-Party Sharing#

Your data is not shared with, sold to, or otherwise transferred to any third parties. All processing is carried out exclusively by the data controller.

10. Changes#

This privacy policy may be updated from time to time. The current version is always available at this URL.

Key points at a glance#

• NoteStrike analyses the microphone signal exclusively on your device to recognise the notes you play. Nothing is recorded, nothing is stored and nothing is transmitted.
• Settings and practice statistics are stored on your device only. We have no access to them.
• The app has no user accounts, no advertising and no analytics or tracking services, and does not use the advertising ID.
• Data leaves your device only in two cases that you trigger yourself: when you write to us via the feedback form (name, email address, message) and when you buy the Pro version via Google Play (payment is handled by Google).

1. Controller#

The controller within the meaning of the General Data Protection Regulation (GDPR) is: ModSeven Engineering Owner: Philipp Hanzik Gogolstraße 8b 90475 Nürnberg Germany Email: info@modseven.net

2. Microphone (RECORD_AUDIO permission)#

NoteStrike needs access to the microphone to detect the pitch of the notes you play on your instrument. This is the core function of the app.

• The microphone signal is analysed in real time in the device’s memory (pitch detection). No audio recording is created, nothing is stored and nothing is transmitted to us or to third parties.
• The microphone is only active while you practise, i.e. as long as a practice screen is open. As soon as you leave the practice screen, microphone access ends.
• You can revoke the permission at any time in the Android settings. Note detection will then no longer be available.

Since this data never leaves your device, we have no access to it.

3. Locally stored data (settings and practice statistics)#

For the app to work and show your progress, it stores the following data exclusively in the app’s own storage on your device:

• settings, e.g. clef, note range, round mode, accidentals, appearance (light/dark)
• practice statistics, e.g. correctly and incorrectly played notes per note, round results, practice days
• counters for the rating prompt (see section 5) and the status of the Pro unlock

4. Feedback form#

Via the rating prompt (section 5) you can send us a message (“What should we improve?”). Only if you fill in the form yourself and tap “Send” is the following data transmitted in encrypted form (HTTPS) to our server at modseven.net. Name and email address are required fields so that we can reply to you:

• Name – to address you personally
• Email address – to reply to your message
• Message – the content of your request; the subject “NoteStrike” is added automatically
• IP address and timestamp – technically required when contacting our server, for protection against misuse

Please do not include any information in your message that you do not wish to transmit.

5. Rating prompt#

After a few practice sessions the app asks once whether you like NoteStrike (“Enjoying NoteStrike?”). The counters required for this (number of practice sessions and practice days, and whether you have already been asked) are stored locally only. Your answer is not transmitted to us.

• “Yes, I like it” opens the NoteStrike page in the Google Play app. Google’s privacy policy applies there.
• “Not really” opens the feedback form (section 4). Data is only transmitted once you submit it.

6. Pro version (in-app purchase via Google Play)#

The Pro features of NoteStrike are unlocked through a one-time in-app purchase. The purchase is handled entirely by the Google Play billing system (Google Play Billing).

• Payment is made exclusively to Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, or Google LLC, USA) under the terms of use and privacy policy applicable there: https://policies.google.com/privacy
• We receive no payment data (no credit card or bank details) and no information about your Google account.
• So that the app can unlock the Pro features, it queries the purchase status from Google Play and processes the purchase confirmation generated by Google (purchase token, product ID, purchase state). This data remains on the device and is not transmitted to our servers.
• Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

7. Internet access and external links#

The app uses the INTERNET permission exclusively for the feedback form (section 4) and for Google Play Billing (section 6). Beyond that, the app does not establish any internet connections. The “modseven.net” link in the settings opens our website in your browser. The website’s privacy policy applies there: https://modseven.net/en/datenschutz#website

8. What NoteStrike does not do#

• no registration, no user accounts, no login
• no analytics or tracking services (e.g. no Google Analytics, no Firebase) and no crash reports via third-party SDKs
• no advertising and no use of the advertising ID
• no location data, no contacts, no access to photos or files
• no disclosure or sale of data to third parties

9. Google Play#

You obtain the app via Google Play. In doing so, Google independently processes data, e.g. on installation, updates and devices and, if you have consented to this on your device, crash and usage statistics (“Android Vitals”). In the Google Play Console we only see aggregated, anonymised statistics. Google is responsible for this processing; details can be found in Google’s privacy policy.

10. Deletion of your data#

• Data on the device (settings, statistics) – delete it yourself at any time via Android settings → Apps → NoteStrike → Storage → Clear data, or by uninstalling the app.
• Feedback messages – write to info@modseven.net. We will delete your message together with your name and email address, unless statutory retention obligations require otherwise.
• Purchase data at Google Play – is managed by Google in your Google account.

11. Your rights#

You have the following rights vis-à-vis us with regard to your personal data:

• Right of access – Art. 15 GDPR
• Right to rectification – Art. 16 GDPR
• Right to erasure – Art. 17 GDPR
• Right to restriction of processing – Art. 18 GDPR
• Right to data portability – Art. 20 GDPR
• Right to object – to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)

12. Children#

NoteStrike is aimed at a general audience and not specifically at children. We do not knowingly collect personal data from children under 16 years of age. If you believe that a child has sent us data via the feedback form, please contact us; we will delete this data immediately.

13. Data security#

All connections from the app to our server are encrypted with TLS (HTTPS). Practice data remains in the protected app storage of your device.

14. Changes to this privacy policy#

We will update this privacy policy if the app or the legal requirements change. The current version can always be found at this address.