Privacy Policy
Last updated: 6 September 2026
This policy covers two things: the 7rats app, and the sevenrats.com website. The short version is that your photos never leave your device, and the only personal data we ever receive is what you choose to type into the contact form.
Who is responsible for your data
The data controller is Exovoid Ltd., bul. Cherni Vrah 47A, 1404 Sofia, Bulgaria (company registration number BG208120758), which publishes 7rats.
For any privacy question, or to exercise the rights listed below, write to contact@exovoid.eu.
The 7rats app
Your photos
Photos are processed entirely on your device. When you pick a photo, 7rats reads it, builds the canvas and border around it, and writes the result back to Photos or hands it to the share sheet. Nothing is uploaded, nothing is sent to us, and we never see your images, their metadata or their location data.
7rats asks for access to your photo library only so it can open the photo you select and save the exported one. You can grant limited access to individual photos instead of the whole library, and the app works the same way. You can change or revoke this at any time in Settings → Privacy & Security → Photos.
No accounts, no tracking
There is no sign-up and no login. We do not build a profile of you, we do not use the Advertising Identifier for tracking across other companies' apps or websites, and we do not sell or share personal data.
Advertising in the free version
The free version of the app shows a single banner ad, served by Google AdMob (Google Ireland Ltd.). To fill that banner, AdMob receives technical data from your device such as its IP address, device model, operating system version and coarse region. This is what makes the free version possible, and it is the only network request the app makes.
- The banner appears only inside the app. It is never added to the image you export.
- Apps must ask before tracking you across other companies' apps and websites. If you are shown that prompt and decline, 7rats and its ad provider serve you non-personalized ads instead.
- The one-time in-app purchase removes the banner. Once it is removed, the app makes no network requests at all.
Legal basis: your consent for personalized advertising where consent is required (Art. 6(1)(a) GDPR), and our legitimate interest in funding a free app through non-personalized advertising otherwise (Art. 6(1)(f) GDPR). See how Google uses data from apps that use its services.
Purchases
The ad-free unlock is processed by Apple through the App Store. We never see your payment details. Apple tells the app only whether the purchase exists. Apple's handling of your data is governed by the Apple Privacy Policy.
Apple may also give us aggregate, anonymised App Store statistics such as download and crash counts. These cannot identify you.
The sevenrats.com website
What we collect, and why
| Data | Why | Legal basis |
|---|---|---|
| Name, email address and message (all required) | To read your message and reply to it, and to send you a confirmation that we received it. | Art. 6(1)(b) GDPR — steps taken at your request before entering into a contract, or Art. 6(1)(f) — our legitimate interest in answering enquiries. |
| Your IP address, transiently | To rate-limit the contact form and to run the reCAPTCHA spam check. It is held in memory only for as long as the rate-limit window and is never written to disk. | Art. 6(1)(f) GDPR — our legitimate interest in keeping the form free of abuse. |
The website has no database. The form does not store what you typed anywhere on our servers; it is turned into an email and sent on.
Cookies
This site sets no cookies of its own, and there is no analytics. We do not know who you are, which pages you read, or where you came from. That is why there is no cookie banner: there is nothing to consent to.
Fonts are served from our own server rather than a font CDN, so no third party learns your IP address just from you opening a page.
The one exception is Google reCAPTCHA, described next, which sets a
_GRECAPTCHA cookie on Google's own domain when it runs.
reCAPTCHA on the contact form
The contact form is protected by Google reCAPTCHA v3 (Google Ireland Ltd.), which scores how likely a submission is to be automated. Google receives your IP address, browser and device information, and how you interacted with the page. This is strictly for spam and abuse prevention; the score is used once and not stored.
reCAPTCHA is not loaded when the page opens. It is fetched only when you first click into or tap the contact form, so a visitor who reads the site without writing to us never contacts Google at all.
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in preventing spam and abuse. Google's Privacy Policy and Terms of Service apply. If you would rather not use reCAPTCHA, email us directly at contact@exovoid.eu instead.
Server logs
Our hosting provider keeps standard web server logs (IP address, time, requested URL, user agent) for security and troubleshooting. These are kept for a short period and are not combined with anything else or used to identify you. Legal basis: Art. 6(1)(f) GDPR.
Who else sees your data
- Hostinger — our hosting and email provider. Your message is delivered to our mailbox through Hostinger's mail service, and both the message to us and the confirmation to you are stored in that mailbox. Hostinger acts as our processor.
- Google Ireland Ltd. — provides reCAPTCHA on the website and AdMob in the free version of the app.
- Apple — distributes the app and processes in-app purchases.
We do not sell personal data, and we do not share it with anyone else. Where a provider transfers data outside the EU/EEA, that transfer relies on the European Commission's Standard Contractual Clauses and, for transfers to the United States, the EU-US Data Privacy Framework.
How long we keep it
Your message lives only in our email mailbox. We keep support emails for 24 months from our last exchange with you, then delete them. IP addresses used for rate limiting are held in memory for 15 minutes and then discarded.
Children
7rats is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has sent us personal data, write to us and we will delete it.
Your rights
Under the GDPR you can ask us to:
- give you a copy of the personal data we hold about you (access);
- correct anything inaccurate (rectification);
- delete it (erasure);
- restrict how we use it, or object to us using it under legitimate interest;
- provide it in a portable, machine-readable format.
Write to contact@exovoid.eu and we will respond within one month. There is no charge. In practice, the only personal data we are likely to hold about you is an email exchange.
If you think we have handled your data badly, you can complain to the Bulgarian supervisory authority: the Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, cpdp.bg. You may also complain to the authority in your own EU country.
Do you have to give us this data?
No. It is not a statutory or contractual requirement, and the app itself asks for nothing. We do need a name, an email address and a message to be able to reply, so without them the contact form cannot be submitted.
Trademarks
Apple, the Apple logo, App Store, iPhone, and iPad are trademarks of Apple Inc., registered in the U.S. and other countries.
Changes
If we change how we handle your data, we will update this page and the date at the top. Material changes affecting the app will also be noted in the App Store release notes.