Privacy Policy

Who is responsible

7777 Days is operated by the artist Simon Lotrek, who is responsible for the project's processing of personal information. For privacy questions and requests, contact simon.lotrek@gmail.com.

Website information and interactive features

The website and its infrastructure may process IP addresses, browser and device information, request times, technical logs and security-check results to deliver the website, troubleshoot problems and prevent abuse.

Votes, button clicks and code attempts may be associated with browser identifiers or protected identifiers derived from technical information. The system keeps information such as choices, contribution counts, timestamps and processing receipts so it can enforce participation rules and avoid duplicate updates. These identifiers are pseudonymous, not a guarantee of complete anonymity.

Official shared counters are maintained on the server. Local display changes and browser preferences do not give visitors permission to change official results.

The character's heartbeat, activities and HP Debt are fictional simulations. They do not measure visitors' health, physical activity or physiological information.

Cookies and browser storage

The website uses browser storage to remember interface and audio preferences, the selected tab, scroll positions and chart settings. Interface preferences expire after seven days without interaction and are removed when next checked. Audio preferences currently remain until they are changed or browser storage is cleared.

Technical cookies and stored identifiers support vote integrity, security checks and access to unlocked downloads. Depending on the feature, they can last for the browser session or persist longer. The support-access cookie currently lasts up to one year and the vote-identity cookie up to two years. A security verification may expire sooner than its associated identifier.

Pending contributions may also be stored locally until the server acknowledges them. Clearing cookies or local storage can reset preferences, interrupt pending contributions or remove access to browser-linked downloads. It does not automatically delete server records.

Browser settings let you inspect and clear this storage. Where applicable law requires consent for non-essential storage or third-party features, that consent is separate from accepting the site's Terms of Service.

YouTube integration

7777 Days uses YouTube API Services to retrieve information about selected project videos, including video identifiers and view and like counts. It also reads public top-level comments to identify eligible comments containing the word SLOW for an interactive mechanic.

The project owner may separately authorise read-only YouTube Analytics access for the project's own content. Video-level view and watch-time reports help calibrate estimates and make gradual corrections. This connection does not access visitors' accounts, request revenue reports or permit publishing. Its credentials and renewable access tokens remain server-side and can be disconnected by the owner.

Comment text is processed to determine eligibility but is not stored as a full comment archive. The system retains eligible comment and video identifiers, relevant timestamps and a protected author identifier to prevent the same participant or comment from being counted again under the mechanic's rules.

Aggregate activity influences artistic counters and charts. Some displayed values are project-defined estimates or adjusted game values, not direct measurements of viewers' watch time or official platform analytics. The website does not identify individual people who view or like a video.

YouTube videos are embedded using YouTube's privacy-enhanced domain. Loading the player or playing a video can still send technical information to Google or YouTube. Embedded services may display advertising under their own rules.

Google's independent processing is described in the Google Privacy Policy. YouTube use is subject to the YouTube Terms of Service.

TikTok integration

A temporary owner-authorised TikTok sandbox connection can supply aggregate video statistics to the website's counters and charts. This does not imply that TikTok has approved a production integration.

The intended connection uses TikTok Login Kit and the user.info.basic and video.list permissions to authorise access to the project's publishing account. Within the information TikTok makes available, this may include basic profile information, account and video identifiers, video metadata and aggregate view, like and comment counts.

The requested permissions do not provide the text of TikTok comments. A total comment count is not treated as a count of comments containing SLOW. No access to private messages, visitors' TikTok accounts or posting on their behalf is requested for this integration.

API credentials and access tokens are handled server-side, with restricted access. They are used only to maintain the authorised connection and obtain the information needed for the project. Tokens are not included in public pages or statistics. The temporary sandbox connection does not renew its token automatically.

The account owner can revoke the connection through TikTok. Revocation prevents further authorised collection once it takes effect. It does not by itself guarantee that every existing server record has already been erased. Deletion and retention must also follow TikTok's applicable requirements.

TikTok processes information independently under its applicable regional privacy policy, including the EEA, UK and Switzerland policy and the other regions policy. This policy will be updated if the permissions or integration change.

Instagram integration

The project uses Instagram's official API with an authorised Creator account to read its own selected videos and aggregate views, likes, comment counts and available watch-time measurements. These statistics can influence the website's counters and charts. Visitors do not need to connect their Instagram accounts.

The collector also reads public top-level comments on those selected videos to identify eligible SLOW contributions. It processes comment text and retains eligible comment and video identifiers, timestamps and a protected author identifier for deduplication, rather than a full archive of comment text. It does not identify individual viewers or likers, send messages or publish content. An aggregate comment count alone is not treated as a count of SLOW comments.

The authorised account's identifiers and access token are kept server-side to validate ownership and maintain the connection. Long-lived tokens may be renewed through Instagram's official API. The account owner can revoke access through Instagram. Revocation prevents further authorised collection once effective, but does not automatically erase historical aggregate project statistics.

Instagram and Meta process information independently under their Privacy Policy. Contact the project using the address above for requests concerning information it directly controls.

Support messages and album access

The website currently includes a temporary simulated support checkout. It does not charge a card or take a real payment. Simulated events can nevertheless update project counters, funding displays, messages and album access. Their amounts are test data, not evidence of money received.

If you enter a name and message in this feature, they are intended for public display with the selected amount. A display name can be a pseudonym. An empty name is shown as Anonymous and no message is published. Do not submit private or sensitive information about yourself or anyone else.

Recent messages appear in a limited feed. Eligible messages can also appear in the longer-lived Permanent Messages section. A message leaving the recent feed does not mean its server record has been deleted.

The server retains support-event identifiers, amounts, timestamps, public submission fields and a browser-linked identifier to apply rewards once and maintain download rights. These records can remain after a test reset so that earlier events are not applied again.

No payment-card information is collected by the internal simulator. External links to services such as Ko-fi or Bandcamp lead to independently operated services. Any future real payment integration will require updated disclosures before it is activated.

Purposes and legal bases

Where European data protection law applies, the project relies on the following bases as appropriate to the processing:

• Legitimate interests in operating an interactive artistic project, protecting its services, preventing duplicate or abusive contributions and resolving technical problems. These interests must be balanced against the rights of the people concerned.
• Providing a service you request, such as recording a contribution or maintaining an unlocked download, where that processing is necessary for the requested service.
• Consent where required for optional storage, integrations or other processing. A platform authorisation is not a blanket consent to unrelated uses.
• Compliance with applicable legal obligations when relevant to a particular record or request.

Personal information is not used for automated decisions producing legal or similarly significant effects on visitors.

Recipients and international processing

Cloudflare provides hosting, security checks, application processing, databases and file delivery for the website. Its role and independent processing are described in the Cloudflare Privacy Policy. Other providers deliver embedded videos, icons or fonts and may receive ordinary technical information when your browser contacts them.

Public statistics and public support messages can be viewed by anyone and delivered through a content delivery network. Private identifiers and credentials are not intended to be part of those public files. Authorised technical operators may access private records when necessary to maintain the project or handle a request.

Providers may process information outside your country, including outside the European Economic Area. Applicable transfer safeguards, such as recognised adequacy arrangements or standard contractual clauses, must be used where required. You can contact the project for information about the safeguards relevant to its processing.

Retention

Retention depends on the purpose and type of information. Browser-storage periods are described above. API credentials are required only while an authorised integration remains in use, subject to necessary security handling and applicable platform rules.

SLOW comments normally influence the mechanic for one week. Expired event records currently remain for up to a further 30 days before routine cleanup. Anti-duplicate participant records are stored separately and currently have no automatic expiry. Hourly engagement records are routinely kept for approximately 48 hours, while daily aggregate history currently has no automatic time-based deletion.

Vote records, contribution receipts and support-event records currently have no general automatic deletion period. Some are needed to prevent duplicate processing or maintain granted access. Their retention must be limited to a justified purpose and reviewed rather than treated as unrestricted permanent storage.

Project history may include aggregate or non-identifying records. The artistic purpose does not override data-protection obligations or a platform's deletion requirements. Data must be removed, refreshed or anonymised when required. Infrastructure logs and backups have provider-specific retention arrangements.

Your choices and rights

Depending on applicable law, you may request access, correction, deletion, restriction or portability of personal information, and object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing.

Send requests to simon.lotrek@gmail.com. Include enough information to locate the relevant record, such as a public message, comment link or approximate date. Do not send passwords, API tokens or unnecessary identity documents. Limited verification may be necessary before private information can be disclosed or changed.

The project will respond within the applicable legal deadlines, normally within one month for requests under the GDPR. Shorter platform-specific deadlines may also apply. Deleting information from 7777 Days does not delete the original information on YouTube, TikTok or another independent service.

You may also complain to your competent data protection authority. In France, this is the CNIL.

Policy updates

This policy will be updated when the project, its integrations or its handling of information changes. The current version and its update date will remain available on this page.