Legal
Privacy Policy
Last updated: 21 September 2026
Who is responsible
Sublis is operated by Leonardo Gusani, Clussstraße 5, 74074 Heilbronn, Germany. Privacy contact: leonardo@morrow.so.
Your choices stay personal
Your onboarding name, age and preferences, goals, affirmation texts, covers, playlists, listening statistics and completed library are stored on this device. We do not send your onboarding answers or selected cover photographs to our AI provider. Device backups may contain local app data, depending on your device settings.
When you use AI creation
Only after you explicitly allow AI processing, your goal and selected writing styles are sent through our Google Cloud backend to OpenAI to create affirmations. Affirmation text and voice settings are sent to OpenAI to create synthetic speech. A short sample of that generated speech is sent to OpenAI for a transcription-based quality check. It is generated audio, not a recording of you.
Please avoid entering sensitive personal information or other people’s personal details. You can edit the generated text before using it. AI does not make decisions with legal or similarly significant effects about you.
Cloud processing and storage
Google Cloud processes API requests and runs the audio worker. Supabase stores an installation identifier, a hash of the installation access token, your AI permission record, audio job settings and private generated audio. The installation token is stored in the operating system’s secure storage and may survive an iOS reinstall. We do not store your original goal in the render job. A pending job contains the affirmation text and audio settings needed to complete it.
Purchases and technical data
Apple handles payment. RevenueCat processes an installation-linked app user identifier, purchase history and subscription status to provide and restore Pro access. Sublis does not receive your card or bank details. Our backend uses keyed hashes of IP addresses for abuse prevention and temporary usage counters. Hosting providers process IP addresses and technical connection data as part of providing the service. App events and listening statistics currently remain on your device. We do not use advertising tracking or sell your data.
Why we process data
We process data needed to provide requested creation, storage, support and subscription services to perform our contract with you under Article 6(1)(b) GDPR. Optional AI sharing uses your consent under Article 6(1)(a). Limited abuse prevention serves our legitimate interest in protecting the service under Article 6(1)(f). Required transaction and accounting records may be retained under Article 6(1)(c). Do not submit health information or other special-category personal data.
How long we keep it
Job affirmation text is removed from the active database after completion, cancellation or terminal failure. Pending jobs expire after 7 days. Private voice masters and previews expire after 24 hours. Finished cloud audio and its job result expire after 30 days. Usage counters expire at the end of their daily window. A scheduled cleanup removes expired objects. Device copies remain until you delete them or remove app data.
Deletion and withdrawal
Settings → Privacy & data lets you withdraw AI permission or request deletion of this installation’s cloud data and local data. Cloud access is revoked after the server accepts deletion; queued and active jobs are cancelled and cleanup removes associated audio and job data. A revoked token hash may remain for up to 7 days to support safe deletion retries.
Provider backups and records required by law may remain under applicable retention rules. Deleting Sublis data does not cancel an Apple subscription. Temporary audio links can remain usable until their 15-minute expiry or until the file is removed.
Providers and international transfers
Our service providers are Google Cloud, Supabase, OpenAI and RevenueCat. Apple operates App Store purchases. Depending on the service and processing location, data may be processed in the European Economic Area or transferred to other countries, including the United States. Where required, providers use recognized transfer mechanisms such as adequacy decisions or the European Commission’s Standard Contractual Clauses and supplementary safeguards.
OpenAI API data is not used to train models by default, although provider-side abuse-monitoring retention may apply. Provider systems and protected backups may retain deleted data for limited periods under their policies and contractual obligations. Contact leonardo@morrow.so for information about applicable safeguards.
Your rights
Subject to the applicable conditions, you can request access, correction, deletion, restriction, portability or object to processing based on legitimate interests. You may withdraw consent at any time and complain to a supervisory authority, including the data protection authority in your EU place of residence. Include the installation ID shown in Settings when relevant; no affirmation text is required in a support request.
No account or cross-device library
Sublis currently has no email/password account or cross-device library sync. Subscription access can be restored through Apple. Local tracks, playlists and profile data are not automatically restored by a purchase restore. If this policy materially changes, the updated notice will be provided and AI permission requested again where required.