Privacy Policy

Last updated: 3 October 2026

1. Who we are

Brainwash It ("we", "us") is operated from the Netherlands and is the controller of the personal data described in this policy. Contact details will be published here before public launch.

2. The short version

3. What we collect

Your voice

The recordings you make in the app: the sample used to create your synthetic voice, any extra voices you save, and affirmation lines you record directly. Recordings are stored on your device, not in our database. To provide the service, recordings are sent to our voice providers, which create and keep a synthetic voice model (a "clone") so your sessions can be generated in your voice.

What you tell the app

What you type or say when you ask for new affirmations. A spoken request is turned into text, and we discard the audio once that is done. The text, together with the reasons you picked during onboarding, is used to write your affirmations.

Your account

Your email address (email sign-in) or your Apple account (Sign in with Apple). Before you sign in, the app runs under an anonymous account with a random ID.

Your profile and content

Your first name, the reasons you pick during onboarding, your player settings (including session language), the affirmations you write or edit, and your session history (when you practised, for how long, and on which topic) to power your streaks and progress.

Usage and protection

A per-day counter of how many generations (voices, written affirmations and transcriptions) your account requests (to prevent abuse and control costs), and the IP address and request metadata that our hosting provider records in its security logs.

Our website

brainwash.it sets no cookies and uses no analytics or tracking. Fonts are self-hosted. Our hosting provider keeps short-lived server logs.

4. Why, and on what legal basis

• Creating and using your voice clone: with your explicit consent, which you give in the app before recording. A synthetic copy of a voice is sensitive (biometric-category) data, so we ask separately and clearly. You can withdraw consent at any time by deleting the voice or your account.
• Writing affirmations from what you tell us: with your explicit consent, given in the app before your first session. What you write can say something about your health or state of mind, so we ask clearly and separately.
• Your account, sync and progress: to perform our contract with you: this is what makes the app work across your devices.
• Quotas, abuse prevention and security logs: our legitimate interest in keeping the service available, secure, and affordable to run.

We make no automated decisions with legal or similarly significant effects about you.

5. Who processes your data

We use a small number of service providers, each processing data only on our instructions:

• Supabase — our database and sign-in, hosted in Frankfurt (EU). See their privacy policy.
• Cartesia — creates your voice clone, generates session audio from your recordings and affirmation texts, times each word for the read-along, and turns spoken requests and the lines you record yourself into text (US). See their privacy policy.
• Anthropic — writes your affirmations from what you type or say and the reasons you picked (US). See their privacy policy.
• Vercel — hosts our voice API and this website (US). See their privacy policy.
• Apple — if you use Sign in with Apple, Apple handles that sign-in under its own privacy policy.

We do not sell your personal data, and we do not share it for advertising. We do not permit our AI providers to use your recordings, your texts or generated audio to train their models.

6. Where your data is processed

Your account data and content are stored in the EU (Frankfurt). Voice processing and affirmation writing happen on our providers' servers in the United States, protected by EU-approved safeguards: Standard Contractual Clauses and, where certified, the EU–US Data Privacy Framework.

7. How long we keep it

• Recordings on your device — until you delete the voice, the recordings, or the app.
• Voice clones and samples at our providers — removed when you delete the voice or your account. We are rolling out fully automatic provider-side deletion; until it ships everywhere, contact us and we will remove a clone immediately.
• Account data and content — until you delete your account (Settings), which permanently deletes your profile, settings, content, and session history.
• Spoken requests — the audio is discarded as soon as it has been turned into text.
• Security logs — our hosting provider keeps them only briefly.

8. Your rights

Under the GDPR you can ask us for access to your data, correction, deletion, restriction of processing, a portable copy, and you can object to processing based on legitimate interest. You can withdraw your voice consent at any time, with immediate effect for future processing. You can also complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens.

Most of this you can do yourself in the app: delete a voice, delete recordings, or delete your whole account in Settings.

9. Children

Brainwash It is not intended for children under 16, and we do not knowingly collect their data.

10. Changes to this policy

If we make material changes, we will let you know in the app before they take effect. The date at the top always shows the current version.

11. Contact

A contact address for privacy questions and requests will be published here before public launch.