Privacy Policy
Last updated: 7 September 2026
This policy covers two things: the 7rats app, and the sevenrats.com website. The short version is that your photos never leave your device, the website counts visits with Google Analytics only if you accept the cookie banner, and the only personal data you give us directly is what you choose to type into the contact form.
Who is responsible for your data
The data controller is Exovoid Ltd., bul. Cherni Vrah 47A, 1404 Sofia, Bulgaria (company registration number BG208120758), which publishes 7rats.
For any privacy question, or to exercise the rights listed below, write to contact@exovoid.eu.
The 7rats app
Your photos
Photos are processed entirely on your device. When you pick a photo, 7rats reads it, builds the canvas and border around it, and writes the result back to Photos or hands it to the share sheet. Nothing is uploaded, nothing is sent to us, and we never see your images, their metadata or their location data.
7rats asks for access to your photo library only so it can open the photo you select and save the exported one. You can grant limited access to individual photos instead of the whole library, and the app works the same way. You can change or revoke this at any time in Settings → Privacy & Security → Photos.
No accounts, no tracking
There is no sign-up and no login. We do not build a profile of you, we do not use the Advertising Identifier for tracking across other companies' apps or websites, and we do not sell or share personal data.
Advertising in the free version
The free version of the app shows a single banner ad, served by Google AdMob (Google Ireland Ltd.). To fill that banner, AdMob receives technical data from your device such as its IP address, device model, operating system version and coarse region. This is what makes the free version possible, and it is the only network request the app makes.
- The banner appears only inside the app. It is never added to the image you export.
- Apps must ask before tracking you across other companies' apps and websites. If you are shown that prompt and decline, 7rats and its ad provider serve you non-personalized ads instead.
- The one-time in-app purchase removes the banner. Once it is removed, the app makes no network requests at all.
Legal basis: your consent for personalized advertising where consent is required (Art. 6(1)(a) GDPR), and our legitimate interest in funding a free app through non-personalized advertising otherwise (Art. 6(1)(f) GDPR). See how Google uses data from apps that use its services.
Purchases
The ad-free unlock is processed by Apple through the App Store. We never see your payment details. Apple tells the app only whether the purchase exists. Apple's handling of your data is governed by the Apple Privacy Policy.
Apple may also give us aggregate, anonymised App Store statistics such as download and crash counts. These cannot identify you.
The sevenrats.com website
What we collect, and why
| Data | Why | Legal basis |
|---|---|---|
| Name, email address and message (all required) | To read your message and reply to it, and to send you a confirmation that we received it. | Art. 6(1)(b) GDPR - steps taken at your request before entering into a contract, or Art. 6(1)(f) - our legitimate interest in answering enquiries. |
| Analytics data: a random visitor and session ID kept in cookies, the pages you open and when, the site or search that sent you, your device type, browser, screen size and language, and an approximate city-level location derived from your IP address | To see how many people visit the site and which pages are worth keeping, so we can improve them. | Art. 6(1)(a) GDPR and Art. 5(3) of the ePrivacy Directive - your consent, given by pressing Accept on the cookie banner and withdrawable at any time. |
| Your IP address, transiently | To rate-limit the contact form and to run the reCAPTCHA spam check. It is held in memory only for as long as the rate-limit window and is never written to disk. | Art. 6(1)(f) GDPR - our legitimate interest in keeping the form free of abuse. |
The website has no database. The form does not store what you typed anywhere on our servers; it is turned into an email and sent on.
Analytics
We use Google Analytics 4 (Google Ireland Ltd.) to count visits to sevenrats.com, and only if you press Accept on the cookie banner. Nothing is loaded, and no cookie is set, before you choose. Refusing costs you nothing: the site behaves identically either way.
If you accept, your browser loads a script from googletagmanager.com and sends Google
the data listed in the table above. Google processes it for us as our processor, under its
data
processing terms. If you refuse, that request is never made.
- We do not see your IP address. Google uses it to work out an approximate city-level location and then discards it; it is not logged or stored in our reports, and traffic from the EU is collected on Google's European servers.
- No advertising features. Google Signals and ad personalisation are switched off on our property, so what we measure is not used to build advertising audiences or to follow you around other websites.
- We only ever look at totals. We have no interest in individual visitors, and we do not try to identify anyone or combine analytics data with the emails you send us.
Cookies
We set no cookies of our own. The only cookies this site can place come from Google Analytics,
they are first-party cookies on sevenrats.com, they hold random numbers rather than
anything about you, and they are placed only after you accept.
| Cookie | Purpose | Expires | Set when |
|---|---|---|---|
_ga |
Google Analytics - distinguishes one visitor from another so visit counts are not double-counted. | 2 years | Only after you accept |
_ga_XRZ0H0W7XX |
Google Analytics - keeps track of the current session. | 2 years | Only after you accept |
7rats-consent |
Remembers your answer to the cookie banner so we stop asking. Stored in your browser's local storage, not sent to us or anyone else. Strictly necessary, so it needs no consent. | Until you clear it | When you answer the banner |
Changing your mind. Press here or in the footer of any page to withdraw or give consent at any time. Withdrawing takes one click, deletes the Google Analytics cookies from your browser, and stops any further collection. You can also install Google's Analytics opt-out browser add-on, or use any browser or extension that blocks trackers.
Fonts are served from our own server rather than a font CDN, so a page you have not consented on contacts nobody but us.
Google reCAPTCHA, described next, additionally sets a _GRECAPTCHA cookie on Google's
own domain - but only if you start writing to us.
reCAPTCHA on the contact form
The contact form is protected by Google reCAPTCHA v3 (Google Ireland Ltd.), which scores how likely a submission is to be automated. Google receives your IP address, browser and device information, and how you interacted with the page. This is strictly for spam and abuse prevention; the score is used once and not stored.
reCAPTCHA is not loaded when the page opens. It is fetched only when you first click into or tap the contact form, so a visitor who reads the site without writing to us never contacts Google at all.
Legal basis: Art. 6(1)(f) GDPR - our legitimate interest in preventing spam and abuse. Google's Privacy Policy and Terms of Service apply. If you would rather not use reCAPTCHA, email us directly at contact@exovoid.eu instead.
Server logs
Our hosting provider keeps standard web server logs (IP address, time, requested URL, user agent) for security and troubleshooting. These are kept for a short period and are not combined with anything else or used to identify you. Legal basis: Art. 6(1)(f) GDPR.
Who else sees your data
- Hostinger - our hosting and email provider. Your message is delivered to our mailbox through Hostinger's mail service, and both the message to us and the confirmation to you are stored in that mailbox. Hostinger acts as our processor.
- Google Ireland Ltd. - provides Analytics and reCAPTCHA on the website, and AdMob in the free version of the app.
- Apple - distributes the app and processes in-app purchases.
We do not sell personal data, and we do not share it with anyone else. Where a provider transfers data outside the EU/EEA, that transfer relies on the European Commission's Standard Contractual Clauses and, for transfers to the United States, the EU-US Data Privacy Framework.
How long we keep it
Your message lives only in our email mailbox. We keep support emails for 24 months from our last exchange with you, then delete them. IP addresses used for rate limiting are held in memory for 15 minutes and then discarded.
Analytics events are deleted by Google after 14 months, the longest retention Google Analytics allows. The aggregate counts we look at (visits per page, per month) are not personal data and stay in our reports.
Children
7rats is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has sent us personal data, write to us and we will delete it.
Your rights
Under the GDPR you can ask us to:
- give you a copy of the personal data we hold about you (access);
- correct anything inaccurate (rectification);
- delete it (erasure);
- restrict how we use it, or object to us using it under legitimate interest;
- provide it in a portable, machine-readable format.
Write to contact@exovoid.eu and we will respond within one month. There is no charge. In practice, the only personal data we are likely to hold about you is an email exchange.
If you think we have handled your data badly, you can complain to the Bulgarian supervisory authority: the Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, cpdp.bg. You may also complain to the authority in your own EU country.
Do you have to give us this data?
No. It is not a statutory or contractual requirement, and the app itself asks for nothing. We do need a name, an email address and a message to be able to reply, so without them the contact form cannot be submitted.
Trademarks
Apple, the Apple logo, App Store, iPhone, and iPad are trademarks of Apple Inc., registered in the U.S. and other countries.
Changes
If we change how we handle your data, we will update this page and the date at the top. Material changes affecting the app will also be noted in the App Store release notes.