Nederlands · English
Privacy policy
De Mentale Wasstraat @home is the @home programme of De Mentale Wasstraat: 42 exercises in four categories (Let's Breathe, Feel the track, Food for thought and Sharing), with a new exercise unlocked every day. The app is offered by Stichting Garage2020 ("we", "us"). The content was developed by design studio morgenmakers together with De Mentale Wasstraat. This policy explains which personal data the app collects, why, and what your rights are. The short version: we collect as little as possible, we never sell or share your data with advertisers, and the database with your data is located in the European Union.
Who is responsible
Stichting Garage2020 is the data controller for the app. Contact for privacy questions: levi@garage2020.nl · www.garage2020.nl.
The content of the @home programme was created by design studio morgenmakers, together with the organisation behind De Mentale Wasstraat. morgenmakers writes the exercises and makes the visuals; they have no access to your account, your notes or your posts in the community.
The app is built and maintained on behalf of Stichting Garage2020 by an external development partner, acting as our processor; we are concluding a data processing agreement with that partner. The data is stored with our hosting provider Supabase in the EU (Frankfurt region, eu-central-1), and the pages you are reading now are hosted by Railway.
What we collect
- Account data: your e-mail address and password. We never store the password itself, only an irreversible encrypted hash of it. A name is optional; by default others see you as "Anonieme deelnemer" (anonymous participant).
- Programme progress: which exercises you completed, your streak, the personal notes you write with an exercise, and the time you chose for your daily reminder, if you set one. Notes are private: no other participant and no moderator can read them.
- Content in the community (the Community tab): the posts and replies you share, plus reports and blocks used for moderation.
- Usage statistics: simple counts such as opening the app and completing exercises, stored against your account id so we do not count the same person twice. No advertising IDs, no location, no third-party analytics, no tracking cookies.
- Signal word flags: if a post of yours contains a word from a short list of crisis words, that post is flagged for a moderator and you are shown a referral to professional help. See Safety in the community below.
- Push token: if you allow notifications, we store a code for your device that lets us send a notification to it, plus the type of device (iPhone or Android). If you log out we disable that code; if you delete your account it is removed.
About data that says something about your wellbeing. Part of what you put in the app says something about your mental health: the notes you write with an exercise, what you share in the community, and the fact that a post of yours contained a crisis word. Under the GDPR this is a special category of personal data (article 9), which we may only process with your explicit consent. You give that consent when you create your account, and you can withdraw it at any time by deleting your account or e-mailing us. Withdrawing does not affect what we did before.
We treat this data with extra care: data minimisation, encryption in transit and at rest, strict access rules, a database inside the EU, and no use whatsoever for AI training, advertising or anything other than running the programme. Your notes are private. Other participants cannot see them and our moderators cannot request them: the database does not allow it. Only our technical administrator can access the raw database, and only for maintenance, incidents and support, under the processing agreement with our development partner and only when there is no other way.
Safety in the community
To keep the community safe, everything you post is checked at the moment of sending against a short list of crisis words. A match does not block or punish you: it flags the post for a human moderator and shows you a referral to professional help (113 Suicide Prevention). The post itself stays visible while that review takes place, so that speaking up is never met with silence.
Moderators can read everything posted in the community, see which content was reported or flagged, and can remove content that violates our community rules. They cannot read your personal notes. Reports from participants are reviewed by a human moderator within 24 hours, and if we remove something of yours we tell you which rule was broken. The contact and support page explains how to reach us or appeal a decision.
The app is not a crisis service and we do not read posts live. Need help right now? 113 Suicide Prevention (Netherlands): call 0800 0113, free and open 24/7, or chat via www.113.nl. Call 112 if there is immediate danger.
Why we may process your data (legal bases)
- To deliver the programme you signed up for (performance of a contract, article 6.1.b): your account, your progress, the community.
- Your explicit consent (article 9.2.a) for the part of that data that says something about your mental health: notes with an exercise, what you post in the community and signal word flags. You give it when signing up and can always withdraw it.
- To keep the community safe (legitimate interest, article 6.1.f): moderation, reports, blocks and the signal word check. Our interest is a community in which people are not harmed at a vulnerable moment; we balanced that against your privacy by limiting moderator access to reported and flagged content.
- To see how the programme is used (legitimate interest): counts of app opens and completed exercises, never linked to advertising and never shared with anyone.
You can object to any processing based on legitimate interest, and withdraw any consent, by e-mailing us. Providing your data is not a legal obligation, but without an e-mail address and password we cannot give you an account.
How long we keep it
| Account, progress, notes | As long as your account exists. Gone immediately when you delete it. |
| Posts and replies in the community | Until you remove them, a moderator does, or you delete your account. When you delete your account, your posts and the replies under your topics disappear for everyone. |
| Reports and blocks | Disappear with your account. If we must keep evidence of a serious criminal offence for the police, we keep only that, and no longer than necessary. |
| Usage counts | Kept indefinitely, but the link to you is erased the moment you delete your account. |
| Support e-mail | Up to 24 months after your question was handled. |
You can delete your account at any time in the app, under the Profiel tab. No longer have the app? Use the account deletion page.
One thing does not disappear, and we would rather be honest about it: the usage counts above. Events such as "app opened" or "exercise completed" remain in our statistics, but the link to you is erased when you delete your account. What remains is a number without an owner, which we can no longer trace to you or anyone else.
Your rights
Under the GDPR you can ask us for access to your data, correction, deletion, restriction of processing and a copy in a portable form, and you can object to processing based on legitimate interest or withdraw your consent. E-mail levi@garage2020.nl and we respond within a month. If you are not satisfied with how we handle it, you can lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or with the supervisory authority in the EU country where you live.
We do not use your data for automated decision-making or profiling. The signal word check never blocks you or changes anything about your account: it shows you a referral and puts the post in front of a human moderator. In addition, the app does not post a message containing a word from a short list of slurs and other words the community rules forbid; you see right away that you need to rephrase it. That does not change anything about your account either.
Who else has access to your data
We do not sell your data and do not share it with advertisers or social networks. These are the only parties involved:
- Supabase (database and accounts), Frankfurt region, eu-central-1. The database is shared with another app of the same foundation, in a strictly separated schema: the data of one app cannot be reached from the other.
- Resend, for sending the e-mails about your account, such as the e-mail that confirms your address and the password reset e-mail. Resend receives your e-mail address and the content of that e-mail.
- Expo, for delivering push notifications. Expo receives your device's push token and the title and text of the notification, and passes them on to Apple or Google.
- Railway, for the website you are reading now. It records standard technical data about your visit, such as your IP address.
- Apple and Google, for distributing the app through their stores and delivering push notifications to your device. They process their own store and device data under their own privacy terms; they do not tell us who you are.
Resend and Expo are American companies and may process this data in the United States. They do so under their data processing terms. Your notes, your progress and your community posts are stored only in the database in the EU.
Feel the track exercises link to the song on Spotify or SoundCloud. If you tap such a link, that service opens outside the app and its own privacy terms apply. We do not pass on any data about you.
Age
You must be at least 16 to create an account. If an account was created by someone younger, e-mail us, or have a parent or guardian do so, and we remove the account.
Changes
If this policy changes, we update it here and adjust the date above. Important changes are announced in the app.