Gårdisto AB · Updated 20 October 2026

Privacy Policy

Only Hz and getonlyhz.com are provided by Gårdisto AB, Sweden. We are responsible for the processing described here. Contact support@gardisto.eu with questions or privacy requests.

The Only Hz Android app does not require an account and has no advertising, app-added behavioural analytics or cross-app tracking. The website has separate, optional analytics and advertising tools, described below.

Audio delivery and service security

When the app prepares or plays audio, our service processes the requested frequency, session length and programme where applicable. The audio service uses OpenAI Sites and Cloudflare infrastructure; this information website is hosted by Vercel. Providers may process an IP address, request time and path, device or browser information, security signals, approximate location derived from an IP address, and diagnostics such as response status or latency to deliver, secure and troubleshoot the service.

Our application uses the network address to create a process-local, pseudonymous rate-limit key. It does not store the raw address in that map; the counter is removed when its one-minute window ends. Provider-managed delivery and security logs are separate.

Google Play purchases and access checks

Google Play handles payment for the paid app and, in Android versions that offer it, an optional one-time full unlock. Google may provide Gårdisto AB with sales, tax and financial reports. We do not receive payment-card details.

For installation and audio-access verification, the app sends a Google Play Integrity proof and a random request reference. In versions offering the unlock, verifying or restoring it also sends a Google Play purchase token. We check the installation and current purchase status with Google, including pending, cancelled, consumed, refunded and acknowledgement states. Eligible purchases are acknowledged with Google before access is confirmed. These checks are for purchase fulfilment, restoration, fraud prevention and protected audio access, not advertising.

Google Play sends purchase, cancellation and refund-related notifications through Google Cloud Pub/Sub. These may contain purchase tokens, product identifiers, event details and technical message identifiers. We authenticate the notifications and check the current purchase status with Google.

The Android verification service processes those proofs, tokens and notification contents during requests. It does not maintain a customer-account or purchase-history database for these checks or deliberately log those payloads. For sessions requiring the optional full unlock, purchase status is checked again when new playback access is requested. Google and infrastructure providers may separately retain transaction, messaging, security and diagnostic records.

iPhone purchases and access checks

The iPhone app has no account requirement, advertising, app-added behavioural analytics or cross-app tracking. It offers free three-minute sessions at 432 Hz and 528 Hz and an optional one-time full-access purchase through Apple. There are no subscriptions. Apple handles payment and may provide Gårdisto AB with sales, tax and financial reports; we do not receive payment-card details. The optional website tools described below are separate from the iPhone app.

On iPhone, the app sends signed Apple installation information, a device-verification reference and an App Attest proof. Playback requests include the selected frequency, session length and journey where applicable. Verifying or restoring full access also sends signed purchase information containing product and transaction identifiers. We verify this information with Apple and check current purchase status before granting full access or authorizing a paid listening session. Successful verification returns a short-lived audio access token. These checks support playback, purchase fulfilment, restoration, security and fraud prevention, not advertising.

The Apple purchase-verification service processes purchase proofs during the request. It does not maintain a separate purchase-history or entitlement database or intentionally log raw signed purchase proofs. Apple and infrastructure providers may retain their own transaction and technical records separately; our service does not control their retention or promise immediate deletion of those records.

iPhone installation-security records

App Attest binds requests to an app installation. Our security database retains a verification-key identifier and public key, a hashed device-verification identifier, environment information, and counters and references used to prevent copied or replayed requests. These records remain associated with the installation across requests even though the app has no account or advertising identifier. Verification-key records do not expire automatically in the current service. Uninstalling the app does not automatically delete these server-side records; contact us using the privacy-request details below to ask about deletion.

Random verification challenges expire after two minutes. They are removed when successfully used or when subsequent challenge requests clean up expired entries; expiry does not guarantee immediate physical deletion. The iPhone can temporarily retain pending installation proof and attestation data to retry verification. It clears that pending data after acknowledgement or during a later verification attempt.

On your device

Volume and session preferences may be saved on the device and can be removed by clearing app data or uninstalling. Local screen-capture status may be used to block protected playback during recording; that status is not sent for advertising. Removing local app data does not delete Google purchase records or provider-managed logs.

Listening streaks and the optional community leaderboard

Daily and weekly streaks, achievements and playback-completion records are stored on your device. Ordinary app updates preserve them; clearing app data or uninstalling may remove them. Local listening history is not imported into the community leaderboard.

In app versions with the community feature, participation is optional. You choose a nickname, and the service automatically determines a country from your network connection when you join, without GPS. This indicates the connection location, not nationality or residence; travel or a VPN can affect it. An unavailable country is shown as unknown. Your nickname, country, points, rank and season titles are visible to other users.

For the leaderboard and score verification, the service stores a random profile identifier, nickname, country, platform, creation time, a hashed access credential, round references, verification challenges, durations, server timestamps, qualifying listening days and awards. Completed rounds are checked with the relevant store's installation-verification service. We do not publish purchase details, raw verification proofs or device identifiers. Reports contain the reporter and reported profile references, a selected reason and submission time. OpenAI Sites and Cloudflare provide the backend infrastructure described above.

Choose “Leave leaderboard” in the app to delete your community profile, rounds, listening days, awards and related reports from the active application database. They otherwise remain while you participate. Hashed registration and round references are retained without a profile link to prevent deleted requests or completed rounds from being replayed; those security hashes have no automatic expiry. Provider-managed logs and backups follow their own retention controls. Purchases and local streaks remain separate from participation.

The private leaderboard credential stays on your device across ordinary updates. It is not an email or social account: uninstalling, clearing app data or switching devices may remove access to that profile. Contact support with your public profile reference if you lose access and need deletion assistance. We use community information to provide the feature you request and protect it against abuse, not for advertising.

Website cookies and external services

Optional analytics

With your consent, this website uses Google Analytics to understand visits, pages viewed, engagement, approximate location, device and browser information, and clicks to Google Play. Google Analytics uses first-party cookies, including _ga, to distinguish browsers and sessions. We do not load Google Analytics or send analytics data to Google before you accept. Advertising storage, advertising personalisation and Google signals are disabled.

Analytics cookies are set for up to 180 days without extending that period on each visit. We have configured event and user data retention in Google Analytics to two months without resetting it on new activity; aggregated reports may remain available for longer.

Optional TikTok advertising measurement

Only if you consent to advertising, the website loads TikTok Pixel to measure page views (PageView) and clicks to Google Play (play_store_click). A click is not proof of an app installation or purchase. TikTok may receive the event, page URL, IP address, device and browser information, and cookie or other technical identifiers. It can use these to match website activity to TikTok users, measure our advertising and personalise advertising on TikTok.

Automatic Advanced Matching, enhanced data postback and TikTok first-party cookies are disabled in our pixel settings. We do not send contact fields, such as names, email addresses or phone numbers, for advanced matching. TikTok third-party cookies may still be used after advertising consent. TikTok describes their duration as 13 months from when they are set or last used; see its cookie information and Privacy Policy for its processing and retention practices.

Your cookie choices

Analytics and advertising each rely on your consent and can be chosen separately. Use “Reject all” to decline both, or “Cookie settings” at the bottom of any page to change your choices. Neither optional tool loads before its relevant consent. Your choices are stored on your device for 180 days, and you can use the website without accepting either.

Withdrawing consent stops future tracking by the relevant tool on this website. Rejecting analytics also removes this website’s Google Analytics cookies. Withdrawal does not erase information already collected or remove cookies on TikTok’s domain; you can manage those through your browser and TikTok’s privacy controls.

These website tools are separate from the Android app. Hosting and security services may use strictly necessary cookies. External links, Google Play and any services you use alongside Only Hz have their own privacy practices.

Other provider information: Google, OpenAI, Cloudflare and Vercel. The providers described here may process information outside your country, including outside the EEA; their notices describe relevant transfer safeguards.

Purposes, retention and sharing

We process information needed to provide requested playback, purchases, restoration and support, to protect the service from fraud and misuse, and to meet applicable legal and accounting obligations. These purposes rely, as applicable, on providing the service under our contract, legitimate security interests and legal obligations.

We retain support correspondence and any necessary business records for their support, dispute-resolution or legal purpose. We do not retain them for advertising. Technical-log retention depends on the purpose and provider controls. Our verification service does not set the retention of Google purchase records or hosting-provider logs, and we cannot promise their immediate deletion. Contact us for a review of records relating to you.

Information is shared with the service providers described above as needed for these purposes, and where required by law. Android app information is not shared for targeted advertising. Separately, consenting to website advertising permits the TikTok sharing and advertising uses described above.

Health information

The app does not request or collect medical records or health measurements. Frequency themes are reflective and spiritual prompts, not a diagnosis or guaranteed health effect. Please do not send sensitive medical information in support messages.

Your rights and deletion requests

Email support@gardisto.eu to request access, correction or deletion, or to ask about restriction, objection or portability where applicable. Explain the request and the relevant approximate date. We may ask for the minimum information needed to locate and verify a record. Because there is no app account, some technical records may not be identifiable as yours.

We assess requests under applicable data-protection law. Some records may need to be retained for legal obligations or claims. You can also complain to the Swedish Authority for Privacy Protection, IMY, or your local supervisory authority. Changes to this notice will be published here with an updated date.