Privacy Policy

1. Data protection at a glance

The following information will provide you with an easy-to-navigate overview of what will happen with your personal data when you visit this website. The term "personal data" comprises all data that can be used to personally identify you. For detailed information, please consult the sections below.

Who is responsible? The data processing on this website is carried out by the operator named under "Responsible party" below.

Which data do we collect? When you visit this website, our web server writes an anonymised access log; your IP address is truncated before it is ever stored (§ 4). When you merely visit the site we collect no other data; the website has no contact form, no accounts, no checkout, and no analytics tools. One exception is direct business outreach by email (§ 7): if we contact you proactively, we process your business contact details from publicly available sources.

What do we use your data for? Solely to provide the website technically and to protect it from abuse. No analysis of your usage takes place.

What are your rights? Access, correction, deletion, restriction, data portability, objection, and the right to file a complaint with the supervisory authority. See § 11.

2. Information about the responsible party

The responsible party is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data.

3. Hosting (Hetzner)

Hetzner

Provider is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (hereinafter "Hetzner"). The website sevengrid.app is served from a server operated in Germany by Hetzner Online GmbH.

Details are available in Hetzner's privacy policy: www.hetzner.com/legal/privacy-policy/.

The use of Hetzner is based on Art. 6(1)(f) GDPR. We have a legitimate interest in reliable presentation of our website.

Data Processing Agreement: We have entered into a data processing agreement (DPA) with Hetzner pursuant to Art. 28 GDPR ensuring that Hetzner processes the personal data of our website visitors only according to our instructions and in compliance with the GDPR.

4. Server log files

Our web server (Caddy, running on our own server hosted at Hetzner, see § 3) writes an anonymised access log. The anonymisation happens before anything reaches the disk: for IPv4 addresses the last octet is removed, IPv6 addresses are truncated to their /48 prefix; cookies (which this website does not set anyway), authentication, language, and forwarding headers are discarded. A complete IP address is therefore never stored at any point. Per request, the log contains:

• the truncated IP address
• time of the request
• requested URL and HTTP status
• browser identification (user agent)
• referrer URL

This data is not merged with other data sources. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in defending against spam and abuse and in the technically sound delivery of the website.

Retention: The logs rotate automatically and are deleted after 14 days at the latest. No analysis for advertising or tracking purposes takes place. Data whose further retention is necessary for evidentiary purposes (e.g. in case of a concrete security incident) is exempt from deletion until the matter is finally resolved.

5. Fonts (self-hosted)

This page uses the font families Inter, Geist, and JetBrains Mono. All three are released under the SIL Open Font License 1.1 and are served directly from this website's server from the /assets/fonts/ directory.

There is no connection to fonts.googleapis.com, fonts.gstatic.com, or any other third-party CDN. When you visit the website, your IP address is transmitted for the font resources only to our hosting provider (Hetzner, see § 3), not to Google, not to Vercel, not to JetBrains.

Legal basis for serving the fonts: Art. 6(1)(f) GDPR (legitimate interest in consistent, device-independent presentation).

6. localStorage (theme and language preference)

This website sets no cookies. It uses your browser's localStorage to persist two pieces of information on your device:

• sevengrid-theme: stores your selected colour theme (one of twenty, e.g. Aurora, Daylight or Midnight) so your choice persists across visits. Value: the theme name as a plain string.
• sevengrid-lang: stores the language you picked in the language switcher (de or en) so you do not have to switch again on your next visit. Value: a two-letter language code.

On the app privacy policy and data deletion subpages, one sessionStorage entry (sg-privacy-lang) is added for the duration of your visit. It records that you explicitly chose the German version there, so the automatic language redirect does not send you back. It is deleted when you close the browser tab.

These values never leave your device. They are not transmitted to our server or any third party. They contain no tracking-relevant information. You can remove the entries at any time via your browser settings (clear site data); theme and language will reset to the defaults on your next visit.

Legal basis: § 25(2)(2) TDDDG in conjunction with Art. 6(1)(f) GDPR. The storage is strictly necessary to provide the theme and language choice you explicitly requested.

7. Direct outreach & contact by email

As part of our outreach for the SevenGrid app, we proactively contact blogs, online media, content creators and companies for whom our app may be thematically relevant, and briefly introduce it to them by email. If you receive such an email from hello@sevengrid.app, the following information applies pursuant to Art. 14 GDPR (data not obtained from you directly).

What data we process

Exclusively business contact details: name or company/blog/media name, a business email address, optionally a form of address, and the language we chose for the message. We do not process special categories of personal data (Art. 9 GDPR).

Where the data comes from

The contact details originate from publicly available sources, in particular your own website or legal notice, publicly visible profiles on social networks, or a directory you yourself provide for business contact. We do not buy address data and do not use private addresses.

Purpose and legal basis

The purpose is a context-specific initial business approach to introduce SevenGrid to you and ask whether a feature, a review or coverage might be of interest. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR in directly approaching potentially interested multipliers and business partners (cf. Recital 47 GDPR). We limit ourselves to publicly provided business contact details, approach you in a thematically relevant way, and stop any further contact immediately on request.

Recipients

To manage the contact list we use an external list / spreadsheet management service. This may involve a transfer of data to a third country (USA); the provider bases such transfers on the EU Standard Contractual Clauses and a certification under the EU-US Data Privacy Framework. The emails themselves are sent via our own mail server hosted with a German provider. Your data is not passed on to any other third parties.

Storage period

We store your contact details only for as long as necessary for the outreach, at most 12 months after the last contact; after that they are deleted. If you object to the contact, we record your email address on an internal suppression list, solely for the purpose of not contacting you again (Art. 6(1)(f) GDPR). We keep this suppression entry until you request its deletion.

Your right to object

You can object at any time to the processing of your data for this outreach (Art. 21 GDPR). An informal reply to our email (e.g. "not interested") or a short message to hello@sevengrid.app is sufficient; you will then receive no further contact from us. Your further data-subject rights (access, rectification, erasure, restriction, data portability, complaint to the supervisory authority) are set out in § 11.

8. External links

This website contains links to external resources, in particular to the sister site byteside.net and, where applicable, the Google Play Store. These are static links: no scripts, pixels, iframes, or embed widgets from these third parties are loaded into our page. Only after you actively click does the destination open; from that point on, the respective provider processes your IP address, cookies, and other browser data according to their own privacy policy. Before you click, no data is transmitted to these third parties.

External links carry rel="noopener noreferrer", so the referrer of your current visit is not transmitted either. Legal basis for providing the links: Art. 6(1)(f) GDPR.

Note: the domain byteside.net belongs to the same responsible party as this website and is, in data-protection terms, not a third party. When switching between the domains, the privacy policy of the respective domain applies.

9. Mobile app: separate privacy policy

The mobile SevenGrid app (available on the Google Play Store since July 2026) processes data in a completely different manner from this marketing website. In particular:

• Habit, mood, and reflection data are stored exclusively locally on your device (SQLite database). We run no cloud sync of any kind. What an iPhone does on its own is a different matter: its iCloud device backup, encrypted and held in your Apple account, may contain the database, as the app privacy policy explains.
• For the optional Pro purchase, Google Play or the Apple App Store handles the payment; RevenueCat validates the purchase using an anonymous app user ID.
• For anonymised crash reports, the service Sentry (EU region) is used.
• On the platform side, Google Play and Apple may process data according to their respective platform privacy policies.

The complete app privacy policy with all GDPR mandatory disclosures is available separately: App Privacy; it is also included in the app itself (menu "Privacy"). For deletion requests: Request data deletion. This document does not cover the app.

10. General notes & mandatory information

Data protection

This policy describes completely what happens to personal data when you visit sevengrid.app, and above all, what does not happen. We treat personal data confidentially, in accordance with the GDPR and this policy. For the sake of completeness: data transmission on the Internet (for instance email communication) can in principle have security gaps; complete protection against access by third parties is not possible.

Encryption & technical security

This website is only reachable over HTTPS (TLS). HSTS with a one-year lifetime ensures your browser establishes future connections encrypted from the start. In addition, the site ships a strict Content-Security-Policy that technically prevents connections to foreign servers (every resource comes from our own server), and a referrer policy that limits what is passed on when you leave the site. Reporting channels for security vulnerabilities are published in our security.txt.

Retention

Unless a more specific retention period is mentioned in this privacy policy, your personal data will remain with us until the purpose for the data processing no longer applies. If you assert a legitimate request for deletion or revoke your consent to data processing, your data will be deleted unless we have other legally permissible grounds for retention.

Legal bases

On this website, we base every processing operation on our legitimate interest under Art. 6(1)(f) GDPR (providing and securing the website and direct business outreach under § 7), plus § 25(2) no. 2 TDDDG for storing your theme and language choice on your device (§ 6). Processing based on consent (Art. 6(1)(a) GDPR), contract performance ((b)), or a legal obligation ((c)) does not currently take place on this website. Should that change, we will update this policy first.

Recipients of personal data

We only pass personal data to external parties if this is necessary for contract performance, if we are legally obligated, if we have a legitimate interest under Art. 6(1)(f) GDPR in passing it on, or if some other legal basis permits the transfer. The only data processor for this website is Hetzner Online GmbH (see § 3).

No automated decision-making

Automated decision-making, including profiling within the meaning of Art. 22(1) and (4) GDPR, does not take place on this website.

11. Your rights

Right of access, rectification, and erasure

Within the framework of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients, and the purpose of data processing, and, if applicable, the right to correction or deletion of this data. For this and for any further questions, please contact us: hello@sevengrid.app.

Right to restriction of processing

You have the right to request the restriction of processing of your personal data. The right to restriction of processing exists in particular if you contest the accuracy of your data, the processing was unlawful, we no longer need the data but you need it to pursue legal claims, or you have lodged an objection.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract handed over to you or to a third party in a common, machine-readable format. If you request direct transfer of the data to another controller, this will only be done as far as technically feasible.

Right to withdraw consent

Many data processing operations are only possible with your express consent. You can withdraw consent already given at any time. The lawfulness of data processing carried out prior to withdrawal remains unaffected by the withdrawal.

Right to object (Art. 21 GDPR)

If data processing is based on Art. 6(1)(e) or (f) GDPR, you have the right at any time to object to the processing of your personal data on grounds relating to your particular situation; this also applies to profiling based on these provisions. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defence of legal claims.

Right to complain to the supervisory authority

In the event of breaches of the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged breach. The supervisory authority responsible for the controller is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Königstraße 10a, 70173 Stuttgart, Germany
www.baden-wuerttemberg.datenschutz.de