1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws as well as other data protection regulations is: ModSeven Engineering Owner: Philipp Hanzik Gogolstraße 8b 90475 Nuremberg Germany Email: info@modseven.net

2. General information on data processing

As a matter of principle, we process personal data of our users only insofar as this is necessary to provide a functional website as well as our content and services. Personal data of our users is regularly processed only with the user’s consent. An exception applies in cases where prior consent cannot be obtained for factual reasons and the processing of the data is permitted by law.

3. Hosting (Vercel)

This website is hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). When this website is accessed, technically necessary data (in particular server log files) is processed by Vercel. Vercel may process data in the USA. A data processing agreement (DPA) exists between us and Vercel for transfers to the USA. Insofar as data is transferred to third countries, this is done on the basis of the EU standard contractual clauses (Art. 46(2)(c) GDPR) and, where applicable, on the basis of the EU-US Data Privacy Framework. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a reliable, secure and high-performance provision of the online offer).

Further information: https://vercel.com/legal/privacy-policy

4. Server log files

When you visit our website, our hosting provider (Vercel) automatically collects and stores the following data transmitted by your browser or device in so-called server log files:

• IP address – of the requesting device (truncated/anonymised where technically possible)
• Date and time – of the request
• URL and method – of the requested resource
• HTTP status code – and amount of data transferred
• User agent – browser type, version and operating system
• Referrer – the previously visited page, if transmitted

This data is stored for a limited time to ensure operation, security (defence against attacks) and error analysis, and is not merged with other data sources. Legal basis: Art. 6(1)(f) GDPR.

5. Cookies, language selection and cookie consent

Our website uses cookies. Cookies are small text files stored in your browser. We use both technically necessary cookies (e.g. to store your cookie decision, your language selection and, for logged-in users, a session cookie for authentication) and – after your consent – cookies for analytics purposes. The website is available in German and English. On your first visit the language is preselected automatically: for this we evaluate the country of origin derived from your IP address by our hosting provider (only the country code, e.g. “DE”) and, as a fallback, your browser’s language setting. This information is used solely to redirect you to the appropriate language version and is not stored by us. You can change your language at any time using the “DE / EN” switch in the page header.

• cookieConsent – Stores your decision regarding the cookie banner. Duration: 365 days. Legal basis: Art. 6(1)(f) GDPR and § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act).
• NEXT_LOCALE – Stores the most recently selected language (de/en) so that you see the appropriate language version directly on your next visit. Duration: 365 days. Legal basis: Art. 6(1)(f) GDPR and § 25(2) no. 2 TDDDG.
• Authentication cookie – Only set when you sign in to the internal area. Contains a signed JSON Web Token (JWT). HTTP-only, secure. Legal basis: Art. 6(1)(b) GDPR.
• Google Analytics (_ga, _ga_*) – Only set if you explicitly consent to their use in the cookie banner. Legal basis: Art. 6(1)(a) GDPR, § 25(1) TDDDG.

You can withdraw your consent at any time by deleting the cookies in your browser or by contacting us by email.

6. Google Analytics

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. It is used exclusively if you have explicitly consented in the cookie banner. The data stream is named “mdsvn”, the measurement ID is G-RT96KR6VJN. Google Analytics uses cookies and similar technologies to analyse your use of the website. The information generated about your use of this website is usually transmitted to a Google server in the USA and stored there. IP anonymisation is active; your IP address is therefore truncated by Google beforehand within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide the website operator with further services related to website and internet usage.

• Purpose – statistical evaluation of website usage in order to improve the content and structure of the site
• Legal basis – Art. 6(1)(a) GDPR (consent) and § 25(1) TDDDG
• Recipients – Google Ireland Ltd. / Google LLC (USA)
• Third-country transfer – transfer to the USA on the basis of the EU-US Data Privacy Framework and EU standard contractual clauses
• Retention period – Data transmitted from your device in the context of Google Analytics is automatically deleted after 14 months. The cookies _ga and _ga_* have a lifetime of up to 24 months.
• Withdrawal – You can withdraw your consent at any time with effect for the future – by deleting the cookies in your browser, by declining in the cookie banner or by installing the browser add-on at https://tools.google.com/dlpage/gaoptout

A data processing agreement pursuant to Art. 28 GDPR is in place with Google. Further information on how Google Analytics handles user data can be found in Google’s privacy policy: https://policies.google.com/privacy

7. Contact form

If you send us enquiries via the contact form or by email, your details from the enquiry form, including the contact details you provide there, are stored by us for the purpose of processing the enquiry and in case of follow-up questions. The following data is processed:

• Name – to address you personally
• Email address – to answer your enquiry
• Subject & message – content of your enquiry
• IP address – for protection against misuse (spam prevention, security)
• Timestamp – of the submission

The data is stored in a database operated by us (PostgreSQL via Prisma ORM) and additionally forwarded by email to our mailbox. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in efficient processing). The data is not passed on to third parties. Retention period: until your enquiry has been fully processed, but no longer than 24 months, unless statutory retention obligations require otherwise.

8. Email delivery (Strato)

For sending and receiving emails – in particular for contact form enquiries – we use the mail servers of Strato AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with Strato. The servers are located in Germany. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reliable email delivery).

Privacy policy: https://www.strato.de/datenschutz/

9. Registration and login (internal area)

If you create a user account in the internal area, we process the data you provide (e.g. name, email address, password) in order to provide the customer account. Passwords are stored exclusively as hash values using bcrypt; they are never stored in plain text. After a successful login, a signed JSON Web Token (JWT) is set as an HTTP-only cookie in your browser to authenticate you for further requests. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Retention period: until the account is deleted by you or by us; the session cookie has a limited validity.

10. Recipients / processors

We use the following service providers, each of which is bound by a data processing agreement pursuant to Art. 28 GDPR:

• Vercel Inc. (USA) – hosting of the website
• Google Ireland Ltd. / Google LLC – web analytics via Google Analytics (only with consent)
• Strato AG (Germany) – sending and receiving emails

11. Your rights

You have the following rights vis-à-vis us with regard to the personal data concerning you:

• Right of access – Art. 15 GDPR
• Right to rectification – Art. 16 GDPR
• Right to erasure – Art. 17 GDPR
• Right to restriction of processing – Art. 18 GDPR
• Right to data portability – Art. 20 GDPR
• Right to object – Art. 21 GDPR
• Withdrawal of consent – Art. 7(3) GDPR – the lawfulness of processing carried out before the withdrawal remains unaffected

To exercise your rights, an informal email to info@modseven.net is sufficient.

12. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data (Art. 77 GDPR). The authority responsible for us is: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) Promenade 18 91522 Ansbach Germany https://www.lda.bayern.de

13. SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address line of the browser changes from “http://” to “https://” and by the lock symbol in your browser bar.

14. Currency and amendment of this privacy policy

This privacy policy is currently valid and was last updated in September 2026. Due to the further development of our website or changes in legal or regulatory requirements, it may become necessary to amend this privacy policy. The current privacy policy can be accessed on this page at any time.

1. Controller

The controller within the meaning of the GDPR and other national data protection laws as well as other data protection regulations is: ModSeven Engineering – Philipp Hanzik Gogolstraße 8b, 90475 Nuremberg, Germany Email: info@modseven.net Please direct all enquiries regarding data protection, access, rectification and erasure exclusively to the email address above.

2. Scope

This policy applies to:

• the mobile Choreo app for Android (package net.modseven.choreo)
• the backend at https://choreo-mu.vercel.app (web pages for email confirmation, invitation acceptance, password reset)
• the optional MagicMirror module “MMM-Choreo”, which authenticates against the backend

3. Which personal data is processed?

4. Purposes and legal bases

5. Recipients / processors

We use processors within the meaning of Art. 28 GDPR with whom data processing agreements exist or for whom we rely on the respective data processing addendum:

6. Data transfer to third countries

Vercel and Google are corporations based in the USA. A transfer of personal data to the USA is possible. The transfer takes place on the basis of:

• the EU-US Data Privacy Framework (for the respectively certified recipients)
• additionally the standard contractual clauses (SCCs) of the EU Commission where no certification applies
• as well as supplementary technical and organisational measures

The database (Neon) is operated in the Frankfurt (EU) region; the application data stored there is therefore not transferred to third countries.

7. Retention period and deletion

• Account and family data remains stored as long as the account exists.
• Time entries and tasks are generally stored permanently so that statistics and histories remain available. The user can delete individual entries in the app at any time.
• Verification and reset tokens become unusable after redemption or expiry and are discarded during the next processing run (maximum lifetime of 60 minutes for reset, 24 hours for email verification).
• Refresh tokens are invalidated on logout, password change or reset.
• Invitations: 14-day lifetime, automatically invalid thereafter.
• Push tokens are deleted when the user signs out or revokes push on the device.
• Upon request by the user (email to info@modseven.net), the entire account including all tasks, times and avatars is deleted. In special cases (e.g. if the user is the admin of the only family administration) we will consult beforehand about handing over to another member.

8. App permissions (Android)

• Push notifications (Android 13+): only if the user agrees; without consent the app continues to work but does not receive teasing pings.
• Photo picker (PickVisualMedia): requested when the user wants to select an avatar image. Only the image selected by the user is read, never the entire photo library.
• Internet and foreground service (for running timers): technically necessary.

9. Cookies and tracking

• The app itself does not set cookies and uses no tracking (no Google Analytics, no Facebook pixel, no advertising IDs).
• The website uses only technically necessary storage mechanisms (session storage during the email verification / reset flow), no tracking cookies.
• No data is sold or passed on to advertising networks.

10. Avatar URLs

Profile pictures are delivered via a unique, hash-based URL of the form /api/users/<userId>/avatar?v=<sha1> so that browsers and the app can cache the image. The URL cannot be guessed (user ID and hash are both randomly generated), but the endpoints are technically publicly accessible. Anyone who knows the link can retrieve the image — comparable to an “unlisted” URL.

11. MagicMirror token

Family admins can generate a read-only token that allows a MagicMirror module to access basic family data (members, current time accounts, upcoming tasks). The token can be revoked at any time; a new token invalidates the old one.

12. Security measures

• Transport encryption: TLS 1.2/1.3 for all connections between app, website and backend
• Password hashing: bcrypt with 12 rounds
• JWT signature: HS256 with a secret held server-side
• Token rotation: refresh tokens are revoked on security events (password change, reset, logout)
• Data minimisation: each endpoint only returns the fields required; in particular, the password hash is never transmitted to the client

13. Rights of data subjects

As a data subject within the meaning of the GDPR, you have the following rights:

• Access (Art. 15) to the data stored about you
• Rectification of inaccurate data (Art. 16)
• Erasure of your data (Art. 17), insofar as no statutory retention obligations apply
• Restriction of processing (Art. 18)
• Data portability (Art. 20) — on request we provide a machine-readable export of your data
• Objection (Art. 21) to processing based on legitimate interests
• Withdrawal of consent given, with effect for the future

To exercise these rights, an informal email to info@modseven.net stating the email address associated with your account is sufficient.

14. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). As a rule, the authority of your habitual residence is responsible. In Germany, the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, https://www.lda.bayern.de is responsible for us. Users from Austria can contact the Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, https://www.dsb.gv.at, dsb@dsb.gv.at.

15. Children

Choreo is primarily aimed at adults or families with parents as family admins. Accounts for minors may only be created with the consent of a parent or guardian. We do not collect data directly from children under 16 without such consent.

16. Changes to this privacy policy

We reserve the right to amend this privacy policy so that it always complies with current legal requirements or to implement changes to our services. The current version then applies to your next visit. Users will be notified by email of significant changes.

1. Controller

The controller for data processing in connection with this app is: ModSeven Engineering – Philipp Hanzik Gogolstraße 8b 90475 Nuremberg Germany Email: info@modseven.net Web: modseven.net

2. Basic principle: local and offline

YAMA is a companion app for MeshCore radios. The app is built to process as little data as possible:

• It uses no user accounts, no advertising and no analytics or tracking services (no Google Analytics, Firebase Analytics, advertising IDs or similar).
• Your messages, contacts, channels, settings and measurement points are stored exclusively locally on your device and are not transmitted to us or third parties.
• An internet connection is only required for map tiles (see section 5).

3. Data stored locally on the device

The following data is stored locally in the app and does not leave your device towards our servers:

This data remains stored until you delete it in the app or uninstall the app. If Android system backup is enabled on your device, app data may be included in this device-/account-bound backup. Legal basis: Art. 6(1)(b) GDPR (provision of the functions you requested).

4. Support / contact form

If you use the support / contact form in the app, the details you enter – name, email address and your message – are transmitted to our server at https://modseven.net so that we can process your request. Without active use of this form, no such transmission takes place.

Purpose: processing your request. Legal basis: Art. 6(1)(b) or (f) GDPR (responding to enquiries). Retention period: as long as necessary to process the request, or until statutory retention periods expire.

5. Map tiles (third-party providers)

For the map view, the app loads map tiles from external map services. In doing so, the respective provider necessarily receives your IP address and the requested tile coordinates (which reflect the approximate map section viewed). Depending on the selected map style, the following are used:

• CARTO (tiles from basemaps.cartocdn.com) – map data © OpenStreetMap contributors, style © CARTO
• Esri (satellite, server.arcgisonline.com)

Please note the privacy policies of these providers. The map is only loaded when you open the map view. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in displaying the map).

6. Bluetooth and mesh network

The app connects to your MeshCore device via Bluetooth. Only data between the app and the device is exchanged over this connection; there is no transmission to us. Please be aware of the nature of a radio mesh network: messages you send over the network, as well as any position of your node you may have configured, are transmitted by radio and relayed by other participants/repeaters. What you send over the mesh is therefore not private vis-à-vis other network participants. This is the responsibility of the user and is not processing by us.

7. Permissions and their purpose

On Android 12+, Bluetooth scanning is requested with the flag “not used to derive location” (neverForLocation). Location is only used for the map functions mentioned above.

8. Disclosure to third parties

Apart from the cases mentioned in section 4 (support server) and section 5 (map providers), no personal data is passed on to third parties. No data is sold.

9. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Since most data resides exclusively on your device, you can remove it yourself at any time by deleting it in the app or uninstalling the app. For matters concerning the support server, please contact the address given in section 1. You also have the right to lodge a complaint with a data protection supervisory authority.

10. Changes to this privacy policy

We amend this privacy policy when the app or the legal situation changes. The current version published here applies.

11. Contact

If you have any questions about data protection, you can reach us at: info@modseven.net

1. Data Controller

Responsible for data processing within the Tummo Breath App: ModSeven Engineering – Philipp Hanzik Gogolstraße 8b, 90475 Nürnberg, Germany Contact: support@modseven.net

2. Health Data

The Tummo Breath App is a guided breathing exercise application. It does not collect, store, transmit, or share any health data or biometric information.

• Local storage only – All breathing session data (e.g. session duration, round counts) is stored locally on your device only and is never transmitted to any server.
• No health APIs – The app does not use any health or fitness APIs (e.g. Google Fit, HealthConnect).
• No sharing – No health data is shared with third parties, advertisers, or analytics services.

3. What Data We Collect

The Tummo Breath App only collects data that you voluntarily submit through the in-app support form:

• Name – to address you personally when responding
• Email address – to reply to your inquiry
• Message (free text) – the content of your request
• Date & time – for tracking and follow-up purposes

Through the support form we do not collect IP addresses, location data, health data, or any other tracking information. Aside from the anonymous usage statistics described in section 4, no analytics or advertising SDKs are used.

4. Anonymous Usage Statistics

To improve the app and understand which features and settings are used, we collect anonymous usage statistics. No personal data is collected in this process.

5. Legal Basis

Data processing is based on Art. 6(1)(b) GDPR (contract performance or pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in responding to support inquiries).

6. Data Retention

Data submitted through the support form is stored for the duration of processing your inquiry and deleted within 90 days thereafter, unless legal retention obligations apply.

7. Data Deletion

You have the right to request deletion of your personal data at any time. To do so, send an informal email to support@modseven.net. We will completely remove your data within 30 days of receiving your request and confirm the deletion by email.

8. Your Rights

Under the GDPR, you have the following rights: access to your stored data (Art. 15), rectification of inaccurate data (Art. 16), erasure of your data (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing (Art. 21). You also have the right to lodge a complaint with a data protection supervisory authority.

9. Third-Party Sharing

Your data is not shared with, sold to, or otherwise transferred to any third parties. All processing is carried out exclusively by the data controller.

10. Changes

This privacy policy may be updated from time to time. The current version is always available at this URL.