Privacy policy

Last updated: October 2026

1. Who is responsible?

777Hz is offered by Semih Inac (777Project). The controller is Semih Inac, 777Project, Glogauer Str. 14, 76139 Karlsruhe, Germany, email: info@777project.de.

2. In short

We only process the data we need to show you the app “777Hz”, to sell and unlock the subscription and to answer your messages. The app has no account and no login, counts no visits, sets no cookies and uses no analytics or advertising services of other providers, nor any social media plugins. Your device computes the pictures and sounds itself; fonts, program files and music come from our own server, and no connection is made to other providers.

3. Hosting and delivery

This website (777hz.pages.dev) is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (Cloudflare Pages). Whenever a page or file is requested, Cloudflare processes technically necessary data: IP address, date and time, the address requested, browser identifier and the page visited before. This serves secure, fast delivery and protection against attacks (legitimate interest, Art. 6(1)(f) GDPR). Requests to the subscription functions (addresses starting with /api/) and the music (/pm/) are passed on by Cloudflare, within our Cloudflare account, to our server, which also runs at Cloudflare (Cloudflare Workers – the same server that runs 777project.de). For these requests Cloudflare keeps a technical log for troubleshooting (time, address requested, technical details of the request including the IP address) and deletes it after three days (Cloudflare Workers Logs, Art. 6(1)(f) GDPR). We do not keep any other access logs. Cloudflare processes the data as our processor (Art. 28 GDPR). For the transfer to the USA we rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), under which Cloudflare is certified, and on the standard contractual clauses in the data processing agreement.

4. The app on your device

What is stored on your device. In your browser's local storage (localStorage, entry fza:v1) the app remembers your settings: the world you listened to last, the mixes you keep with “Save mix”, the language you chose, whether the picture should move when you tilt your phone, whether you closed the home screen tip or the welcome note, the first name you type for “Your Sound Pattern”, and whether the subscription is currently offered. So that the app also starts without the internet, your browser keeps the program files and the music you have already listened to in its cache (Cache Storage via a so-called service worker, entries starting with fza-, the music in fza-premium). If you have the subscription, your personal access link and our server's last answer (until when the subscription runs) are stored in the entry fza:premium:v1. None of this is sent to us, except as described for the subscription below. This is strictly necessary for the app you are using (§ 25(2) no. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act); the app sets no cookies and therefore shows no cookie notice. The entries remain until you delete them: in the app under “About 777Hz” → “Delete settings and saved mixes” or “Sign this device out of the subscription”, or in your browser's settings (site data for 777hz.pages.dev).

Your Sound Pattern. Only your device stores the first name from which the app calculates your sound pattern (fza:v1); it is not sent to us. The picture you create with “Save picture” is also made on your device.

Whether the subscription is offered. At most every 12 hours the app asks our server whether the subscription is available. The request contains no identifier and no information about you; it only appears in the technical log described in 3. (Art. 6(1)(f) GDPR – the app should show you the right offer).

Motion sensor. If you switch on “Move the picture when you tilt your phone”, the app reads your device's orientation, only to move the picture a little. The values stay on your device and are not stored; on the iPhone your device asks for permission first.

5. The subscription (with trial)

Subscribing. When you take out the subscription, we process your email address, whether you subscribe with or without the trial, the price, your contract number (APP-…), the ID of the PayPal subscription, the ID of your PayPal account (payer ID, only for the rule “one trial per person”), the status of the contract (for example until when the trial runs or until when it is paid), the time and wording of your declarations when subscribing, the language you subscribed in (so that our emails reach you in that language) and which emails we have sent you about it. We need this to perform the contract and to unlock the app for you (Art. 6(1)(b) GDPR). It is stored in our database at Cloudflare (Cloudflare D1, processing as described in 3.). There is no account or password.

Country. We do not offer the subscription in every country (currently not in the United Kingdom). That is why, when you open the order page and when you subscribe, our server reads the country that Cloudflare derives from your IP address (for example “DE”) and compares it with this list; if PayPal reports a country for your PayPal account when you subscribe, we compare that too. We do not store the country (Art. 6(1)(f) GDPR – our interest in offering the subscription only where we meet the tax and legal requirements).

One trial per person. So that the trial is not used more than once, as soon as a trial begins we store a non-reversible check value of your email address and of your PayPal account (payer ID), each formed with a secret key – never the address or ID itself. At the next subscription we only compare these check values. We delete them 2 years after the trial began (Art. 6(1)(f) GDPR – our interest in offering the trial fairly once per person).

Payment via PayPal. For payment we redirect you to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg, and pass on to PayPal your email address, the subscription and the price. PayPal processes your payment data – including when you pay by credit or debit card – under its own responsibility, checks the payment and reports to us the conclusion, payments, refunds and cancellations as well as the ID of your PayPal account (Art. 6(1)(b) GDPR). More in PayPal's privacy statement: paypal.com/de/legalhub/paypal/privacy-full.

Your access link. We send you the personal link by email via Resend (see 6.). It contains the number of your contract and a check value, but no name and no email address. When you open it, your browser stores it (see 4.), and the app asks our server at most every 6 hours whether the subscription is still running and until when; without the internet it uses the last answer, but never beyond the end. Your browser loads the music with a short-lived code that comes from this answer. These requests appear in the technical log described in 3. (with the address requested, i.e. also the link or code; Cloudflare deletes it after three days). The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

“Resend your link”. If you enter an email address there, we only send a link if a running subscription belongs to it; the answer on the page is the same in every case. So that nobody can use the form to send lots of emails to other people's addresses or to try out addresses, we store for 24 hours, per request, a non-reversible check value of the address entered and such a check value of the IP address and hour, each formed with a secret key – never the address or the IP address itself (Art. 6(1)(f) GDPR – protection against misuse).

Reminder before the first charge. About 24 hours before the end of your trial we send you a short email: when the trial ends, what will be charged afterwards and how to cancel. It is part of the contract (Art. 6(1)(b) GDPR).

Storage period. When your contract ends, we delete your email address 30 days after the end; if you abandon subscribing at PayPal, after three days. We keep the payment details (amount, date, PayPal IDs) for ten years because tax law requires it (§ 147 AO, the German Fiscal Code; Art. 6(1)(c) GDPR). For the check values of the trial see above.

6. Emails

We send the confirmation of receipt and the contract confirmation with your access link, “Resend your link”, the reminder before the end of the trial and the confirmations of cancellations and withdrawals via Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) as our processor. Resend processes the recipient address and the content of the email for this. Resend is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); standard contractual clauses also apply. The sender is an address @777project.de; your replies go to info@777project.de.

Emails to our addresses @777project.de (for example info@) are received by Cloudflare (Email Routing, see 3.) and automatically forwarded to two mailboxes where we read and answer them: a Gmail mailbox of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and an Outlook.com mailbox of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Our internal notifications about subscriptions, withdrawals and cancellations also go there. Sender, recipient, subject, content and attachments are processed (Art. 6(1)(b) GDPR for questions about a contract, otherwise Art. 6(1)(f) GDPR – our interest in reliably receiving and answering messages). Google and Microsoft may also process the data in the USA; Google LLC and Microsoft Corporation are certified under the EU-US Data Privacy Framework (Art. 45 GDPR).

When sorting and answering incoming emails we are assisted by the AI assistant Claude; its provider, Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland, processes the content of the email concerned (Art. 6(1)(f) GDPR – our interest in answering enquiries quickly). Anthropic may also process data outside the EU and relies on adequacy decisions and standard contractual clauses of the European Commission for this.

7. Online withdrawal and cancellation

If you use the “Withdraw from contract” function, we store your name, the details of the contract, your email address, your statement and the date and time of receipt and send you a confirmation of receipt. We are legally obliged to do so (§ 356a BGB, Art. 6(1)(c) GDPR). We keep these details until the contract has been settled and the statutory retention and limitation periods have expired.

If you cancel via “Cancel contracts here”, we store your cancellation (type of cancellation, the reason where applicable, name, email address, contract number, requested end) with the date and time of receipt and send you the confirmation required by law (§ 312k BGB, Art. 6(1)(c) GDPR). We keep this declaration for three years as proof (Art. 6(1)(f) GDPR); after that we delete it.

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Just write to us at info@777project.de. You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR) – in the country where you live, or the one competent for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

Right to object: where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). Withdrawing consent: you can withdraw a consent at any time with effect for the future (Art. 7(3) GDPR), by email to info@777project.de.

9. Obligation to provide data, no automated decisions

You can view the app's overview without providing any information. Without an email address we cannot conclude the subscription, because access works through the link in the email. There is no automated decision-making in individual cases, including profiling (Art. 22 GDPR); the “one trial per person” check only compares check values and at most leads to us offering you the subscription without the trial.