Privacy Policy

Last updated: 18 July 2026

1. Who we are

Brainwash It ("we", "us") is operated from the Netherlands and is the controller of the personal data described in this policy. Contact details will be published here before public launch.

2. The short version

3. What we collect

Your voice

The recordings you make in the app: the sample used to create your synthetic voice, any extra voices you save, and affirmation lines you record directly. Recordings are stored on your device, not in our database. To provide the service, recordings are sent to our voice providers, which create and keep a synthetic voice model (a "clone") so your sessions can be generated in your voice.

Your account

Your email address (email sign-in) or your Apple account (Sign in with Apple). Before you sign in, the app runs under an anonymous account with a random ID.

Your profile and content

Your first name, the reasons you pick during onboarding, an optional reminder time, your player settings (including session language), the affirmations you write or edit, and your session history (when you practised, for how long, and on which topic) to power your streaks and progress.

Usage and protection

A per-day counter of how many voice generations your account requests (to prevent abuse and control costs), and the IP address and request metadata that our hosting provider records in its security logs.

Our website

brainwash.it sets no cookies and uses no analytics or tracking. Fonts are self-hosted. Our hosting provider keeps short-lived server logs.

4. Why, and on what legal basis

• Creating and using your voice clone: with your explicit consent, which you give in the app before recording. A synthetic copy of a voice is sensitive (biometric-category) data, so we ask separately and clearly. You can withdraw consent at any time by deleting the voice or your account.
• Your account, sync, progress and reminders: to perform our contract with you: this is what makes the app work across your devices.
• Quotas, abuse prevention and security logs: our legitimate interest in keeping the service available, secure, and affordable to run.

We make no automated decisions with legal or similarly significant effects about you.

5. Who processes your data

We use a small number of service providers, each processing data only on our instructions:

• Supabase — our database and sign-in, hosted in Frankfurt (EU). See their privacy policy.
• Cartesia — creates your voice clone and generates session audio from your recordings and affirmation texts (US). See their privacy policy.
• ElevenLabs — computes the word timings that power the read-along, and holds some earlier voice clones (US). See their privacy policy.
• Vercel — hosts our voice API and this website (US). See their privacy policy.
• Apple — if you use Sign in with Apple, Apple handles that sign-in under its own privacy policy.

We do not sell your personal data, and we do not share it for advertising. We do not permit our voice providers to use your recordings or generated audio to train their models.

6. Where your data is processed

Your account data and content are stored in the EU (Frankfurt). Voice processing happens on our providers' servers in the United States, protected by EU-approved safeguards: Standard Contractual Clauses and, where certified, the EU–US Data Privacy Framework.

7. How long we keep it

• Recordings on your device — until you delete the voice, the recordings, or the app.
• Voice clones and samples at our providers — removed when you delete the voice or your account. We are rolling out fully automatic provider-side deletion; until it ships everywhere, contact us and we will remove a clone immediately.
• Account data and content — until you delete your account (Settings), which permanently deletes your profile, settings, content, and session history.
• Provider retention — ElevenLabs keeps voice-derived data for at most 3 years after last use; hosting security logs are short-lived.

8. Your rights

Under the GDPR you can ask us for access to your data, correction, deletion, restriction of processing, a portable copy, and you can object to processing based on legitimate interest. You can withdraw your voice consent at any time, with immediate effect for future processing. You can also complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens.

Most of this you can do yourself in the app: delete a voice, delete recordings, or delete your whole account in Settings.

9. Children

Brainwash It is not intended for children under 16, and we do not knowingly collect their data.

10. Changes to this policy

If we make material changes, we will let you know in the app before they take effect. The date at the top always shows the current version.

11. Contact

A contact address for privacy questions and requests will be published here before public launch.