Privacy Policy
Last updated: 24 October 2026
The short version
- Free plan: your affirmations and voice recordings stay on your device. We never receive them.
- Premium: we store your email address and, for cloud sync, your affirmations and recordings on our own server in the Netherlands, with encrypted backups in the EU.
- We don’t listen to, analyse or share your recordings. No ads, no analytics, no tracking cookies, no selling of data.
- Payments are handled by Link (Stripe). We never see your card details.
- You can download all your data or delete your account at any time, in the app under Account.
1. Who we are
NightMantra is a trade name of DDV Tech & Consulting, a sole proprietorship registered in the Netherlands (KvK 75000598). We are the controller of the personal data described in this policy, as defined in the EU General Data Protection Regulation (GDPR).
Address: Nobelstraat 10d, 2513 BD Den Haag, Netherlands · Email: hello@nightmantra.com
We are a one-person business, so there is no separate data protection officer; questions about privacy go to the email address above.
2. What we process, why and how long
Using NightMantra for free (no account)
Without an account, everything you create (affirmation texts, voice recordings and your settings) is stored only in your browser on your device. It is never sent to us, and we cannot see, recover or delete it. If you clear your browser data or uninstall the app, it is gone.
Like every website, our server briefly handles technical information to deliver the pages to you (such as your IP address). We do not store it in a database or use it to identify you.
With an account (Premium)
| Data | Why | Legal basis (GDPR) | How long |
|---|---|---|---|
| Email address; Stripe customer and subscription IDs; subscription status and dates | Your account, logging in, knowing whether Premium is active | Contract (art. 6(1)(b)) | As long as your account exists; deleted when you delete your account |
| Login codes and links (stored only as a scrambled hash) | Logging you in without a password | Contract (art. 6(1)(b)) | Valid 15 minutes; deleted one day later |
| Login sessions (a cookie with a random token; we store only its hash) | Keeping you logged in on your devices | Contract (art. 6(1)(b)) | Until you log out, or at most 180 days |
| Cloud sync: your affirmation texts, voice recordings and when they were created or changed | Syncing and backing up your affirmations across your devices | Contract (art. 6(1)(b)) | While Premium is active, and for 90 days after it ends (so you can resubscribe or download them); then deleted. Deleted right away if you delete them or your account. |
| Encrypted backups of the above | Restoring the service after a technical failure | Legitimate interest in a reliable service (art. 6(1)(f)) | Rolling backups; data you delete disappears from all backups within 4 months |
| Emails you send us, and our replies | Answering your questions | Legitimate interest (art. 6(1)(f)), or contract if it’s about your subscription | Until your question is resolved, then at most 12 months |
| Technical server logs (times, errors; email addresses only in masked form, e.g. “d***@gmail.com”) | Security and fixing problems | Legitimate interest (art. 6(1)(f)) | 14 days |
Where we rely on legitimate interest, you can object at any time (see Your rights).
We do not use your data for advertising, profiling or automated decisions that affect you. We do not use analytics or tracking tools.
3. Your recordings and affirmations
Your affirmations and voice recordings are personal. We treat them that way:
- We store them only to provide cloud sync and backups to you. We do not listen to them, read them, analyse them, use them to train AI, or use your voice to identify you.
- We only access them if you ask us to for support, or if the law requires it.
- Affirmations can say something about your health, beliefs or private life. That is your choice to write; we store and protect them like all other account data and never use them for anything else.
- Please only record your own voice, or someone else’s with their permission.
4. Payments
Premium is sold through Link, part of Stripe (“Sold through Link”). Link acts as the reseller and handles the checkout, payment, invoices, VAT, refunds and payment-related support. For this, Stripe and Link process your payment details (such as your name, email, country, and payment method) as independent controllers under their own privacy policies: Link privacy policy and Stripe privacy policy.
We never see or store your full card or bank details. In our Stripe account we can see your email address, your country, your subscription and transaction history, and the type and last four digits of your payment method. We use this only to provide Premium, help you with questions, and keep our financial records. Dutch tax law requires us to keep financial records for 7 years.
5. Who we share data with
We don’t sell your data or share it for marketing. We use a small number of service providers:
- Stripe and Link (payments, see above), as independent controllers.
- Proton AG (Switzerland) sends our login emails and hosts our email inbox. Proton processes your email address and the content of those emails on our behalf, as a processor.
- Backblaze stores our backups in its EU data centre in Amsterdam, as a processor. Backups are encrypted on our server before they are uploaded; Backblaze cannot read them.
- Our data centre in the Netherlands houses our server physically. It has no access to the data on it.
We may also disclose data if the law requires it, for example on a valid order from a Dutch authority.
6. Data outside the EU
Our server and backups are in the Netherlands. Some providers are based outside the EU:
- Proton AG is in Switzerland, which the European Commission recognises as providing an adequate level of data protection.
- Backblaze, Inc. is a US company. Our backups are stored in the EU and encrypted before upload; any transfer is covered by the EU Standard Contractual Clauses in Backblaze’s data processing agreement.
- Stripe and Link may process payment data in the US under their own safeguards, described in their privacy policies.
7. Cookies and storage on your device
We use no tracking or advertising cookies, so we don’t ask for cookie consent. We only use what is needed for the app to work:
nm_session(cookie): keeps you logged in. Only set when you log in; up to 180 days.nm_app(cookie): contains only “1”. Once you have created an affirmation, it makes nightmantra.com open the app instead of the homepage. 1 year.- Browser storage (localStorage and IndexedDB): your affirmations, recordings, language and app settings, and sync status. This stays on your device; for Premium, your affirmations and recordings are also synced as described above.
The checkout page is run by Stripe and Link on their own websites, which may use their own cookies, for example for fraud prevention.
8. Security
- All connections use HTTPS.
- No passwords: you log in with a one-time code or link. We store only scrambled hashes of codes, links and session tokens.
- The server is kept up to date and protected by a firewall; only the necessary ports are open.
- Backups are encrypted before they leave our server.
- Only we (the owner of NightMantra) have access to the server.
If a data breach is likely to put your rights at risk, we will report it to the Dutch Data Protection Authority and inform you as the law requires.
9. Your rights
Under the GDPR you have the right to:
- Access your data and receive a copy;
- Data portability: receive your data in a common format. In the app: Account → Download my data (a .zip with your texts and recordings);
- Erasure: in the app: Account → Delete my account. This cancels your subscription and deletes your account, texts and recordings from our server right away (and from backups within 4 months);
- Rectification of incorrect data, for example your email address;
- Restriction of processing, and to object to processing based on legitimate interest.
For anything you can’t do in the app, email hello@nightmantra.com from the address on your account. We respond within one month. To protect your account, we may ask you to confirm the request from that address.
You can also file a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or with the data protection authority in your own country. We’d appreciate the chance to sort it out with you first.
10. Children
NightMantra is not intended for children. You need to be at least 16 years old to create an account or buy Premium. If you believe a child has given us personal data, please contact us and we will delete it.
11. Changes to this policy
We may update this policy when our service or the law changes. The date at the top shows the latest version. If a change is important, Premium members get an email before it takes effect.
12. Contact
Questions about your privacy: hello@nightmantra.com.
NightMantra is a trade name of DDV Tech & Consulting
Nobelstraat 10d, 2513 BD Den Haag, Netherlands
KvK 75000598 · VAT NL002514584B81 · hello@nightmantra.com