Last updated: 17 October 2026
Reprogram Within is made by Reprogram Within Pty Ltd (ABN 12 703 212 659), an independent Australian company. Contact: [support@reprogramwithin.com].
Nothing, by default. The app has no user accounts and no analytics. It does not use third-party advertising or tracking software of any kind.
If a future version enables anonymous usage counts (for example, how many times a loop was played), they will be counts only, never content, never audio, and this policy will say so before it happens.
Everything you make: voice recordings, scripts, the beliefs you write down (including the "what I was told" notes, which are stored only so they can be shown back to you and are never played aloud or sent anywhere), diary lines, messages from family members, lesson progress, mood check-ins and settings. They live in the app's local storage. If you delete the app or erase everything in Settings, they are gone unless you exported a backup first. The Android app opts out of Google's automatic app backup; on iPhone, your own iCloud or computer backup may include the app's data like any other app, and nobody but you can read it. A backup file you export never contains an API key.
The microphone is used only when you press record, to capture a family member reading a story or a script, or a message for someone you love. The recording is stored on the device. It is not uploaded by the app.
When you invite a relative to record a message, the app creates a link. If the invite service is enabled, the relative's recording is held, encrypted in transit, on our server only until your app collects it, then deleted. If the service is not enabled, the relative receives a file to send to you by any means you choose, and no server is involved. In both cases, a message for a child is never audible to that child until a parent approves it in the app.
The composer writes short scripts from a request you type. If it is enabled, the text you type, the script type, and the age group of the listener are sent to our composer service, which uses the Anthropic API to generate the script. Only that text, the script type and the age group are sent: never recordings, never anyone's name, never your diary, never the "what I was told" notes. Our service keeps a one-way hash of each request for safety auditing of the Positivity Firewall; it does not store the text. If the composer is not enabled, the app uses its built-in library and nothing is sent.
If you are in distress, the composer does not write a script. It shows support lines for your region instead.
Child profiles have no email, no password and no account. A parent or guardian sets the app up and operates it; the child only ever sees the dim night screen or the Kid screen. Nothing created for a child by anyone other than the parent is audible to the child until the parent approves it. The app does not collect personal information from children. It is designed with the Australian Privacy Act, COPPA and GDPR-K in mind.
An echo lets a consenting adult's voice read any story or script in the app. To make one, that adult reads a short consent passage in the app; the passage includes, in their own words, that they are an adult and agree. That recording stays on your device. When a new reading is needed, the recording and the text of that story or script are sent to our voice service, which uses ElevenLabs to make the voice for the moments it takes to read, and the voice is deleted from the service straight after; our service stores neither. Each reading is kept on your device and plays offline afterwards. We never clone a child's voice. Removing an echo in the app deletes every reading and the consent recording from your device. On a phone, the app also keeps an automatic copy of everything in its own Documents folder, which on iPhone is visible in the Files app and included in your iCloud backup; it never leaves the device by itself. The consent recording is included in a backup you export, like any other recording, so a lost phone does not have to mean a lost voice; the service-side voice is never in a backup. Warm voices are ready-made voices from the same service; adding one sends only the text it reads. If the voice service is not enabled in your version of the app, these features are switched off and nothing is sent.
If you choose "Keep a copy on our servers", you sign in with an email address and a code we send to it, and the app uploads the same one-file backup it keeps on your phone: your recordings, scripts, memories and settings. It is stored on our servers (hosted by Supabase), encrypted at rest, in a folder only your sign-in can reach, and used for one purpose: giving it back to you on any phone when you sign in. Our support team can restore it for you if you ask. It updates automatically whenever something changes. Sign out or delete it at any time from the Family screen; deleting the app does not delete the copy, so a new phone can restore it. If you never turn this on, nothing is uploaded and we hold nothing of yours.
Subscriptions and module purchases are processed by Apple, Google or our web payment provider. We receive confirmation of what was purchased, never your card details. Purchase records are kept for us by RevenueCat under an anonymous identifier with no name, email or recording attached. A module bought once remains yours; if a subscription lapses, nothing you recorded is removed.
Export everything as one file, restore it on another device, or erase everything, from Settings at any time. There is no account to delete because there is none.
If this policy changes, the new version will be published at the same address with an updated date.