App: Twentymind
Last updated: 7 November 2026
1. Overview
Twentymind turns a topic into a researched audio course of about 20 minutes: 10 lessons of roughly 2 minutes each, spoken by two synthetic voices, in English, German, Spanish, French or Italian. The courses are created by AI on our servers. Finished courses are kept in a shared library. The app is an ad-free subscription and is intended for adults.
- At first launch the app creates an anonymous account, with no name, email address or password. If you like, you secure it with Apple or Google (section 3).
- Your course topic goes to the AI services of Anthropic and Google only after your explicit agreement (section 5).
- New courses are public in the library by default, without showing who created them. Likes only count as a total (section 6).
- Analytics and crash reports run only with your consent (sections 8 and 9). No ads, no tracking across other apps.
- You delete your account and data in the app under Profile or by email (section 13).
2. Controller
Leon PließnigMühldorf 135/89814 MühldorfAustriaEmail: support@gamificationlp.comPhone: +43 681 818802333. Anonymous account (Supabase)
So that your subscription, course credits, progress and courses are kept, the app creates an anonymous account at first launch. It has a random identifier, the account ID, which you can see in the app under Profile. For this account we store: your settings (such as app and course language and the interests you picked at the start), your consent choices with their time, your listening progress, daily goal and streak, your likes and blocks, your reports, the courses you created and your subscription status (section 7). The app does not ask for names, email addresses or phone numbers.
Securing your account: under Profile you can secure your account with “Sign in with Apple” (iPhone and iPad only) or “Sign in with Google”, so that your progress, streak and own courses are kept on a new device. The app asks for neither a name nor an email address. Apple or Google confirm the sign-in and send us an identifier of your Apple or Google account. Google always includes the email address of your Google account; Apple sends at most an email address or a relay address created by Apple. Supabase stores these details in your account's sign-in record. We use them only to sign you in again and do not write to that address. When you delete the account, we also delete the sign-in record, and we revoke a sign-in with Apple with Apple as well. The providers are Apple Inc. or Apple Distribution International and Google Ireland Limited or Google LLC. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).
If you have not secured your account with Apple or Google, we delete it automatically after 180 days without use. The period counts from your last use of the app or, if later, the end of your subscription. A secured account stays until you delete it.
Notifications: if you agree that the app tells you when your course is ready and your device allows it, the app receives a device token for notifications from Firebase Cloud Messaging (Google Ireland Limited or Google LLC). We store it with your account ID, the platform and the language, and send through Firebase Cloud Messaging only the message that a course is ready or has failed, with its title. We delete the token when it becomes invalid or when you delete your account. You turn notifications off in your device settings. Any transfer to the USA relies on the European Commission's standard contractual clauses. The legal basis is your consent (Art. 6(1)(a) GDPR).
The database is run by Supabase (Supabase, Inc., USA) as our processor in a data centre in the EU (Frankfurt am Main). Where Supabase accesses data from a third country for operations or support, this relies on the European Commission's standard contractual clauses. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR). The data is kept until you delete your account.
On your device the app also stores the last known subscription status, progress, settings and consent choices. It keeps the access key to your account in the operating system's protected storage (Android Keystore or the iOS Keychain).
More information: supabase.com/privacy.
4. Servers, audio and library search (Cloudflare)
The app's interface and course creation run on Cloudflare Workers. Audio files and course data are stored in Cloudflare R2 and delivered through Cloudflare. In doing so, Cloudflare (Cloudflare, Inc., USA) processes, as our processor, your IP address, technical details of the request and, for signed-in requests, your account ID. The transfer to the USA relies on the European Commission's standard contractual clauses. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).
When you search the library, Cloudflare Workers AI turns your search text once into a series of numbers that is used to find matching courses. The search text is then discarded; it is not stored and not passed to Anthropic or Google.
More information: www.cloudflare.com/privacypolicy.
5. Creating courses (Anthropic and Google Cloud Vertex AI)
Before you create your first course, the app asks explicitly whether you agree that your topic is sent to Anthropic (text) and Google (speech). Without your agreement you can keep using the library, but you cannot create new courses.
For a new course the app sends your topic, the level, the language and the visibility (public or private) to our server. An automatic filter first checks the topic for prohibited content and for personal data. The Anthropic API (Claude) then researches the topic on the web: it searches with terms derived from your topic, reads publicly available pages and writes the course script with a source list. We delete the raw text of the pages read after each job. Google Cloud Vertex AI turns the finished script into speech with a Gemini speech model, in data centres in the EU. Another Gemini model there listens to the start of each recording to catch speaking errors; only the generated recording goes to Google for this. Translations of a course work the same way: Anthropic translates the script and Vertex AI voices it again.
Only the topic and the texts made from it go to Anthropic and Google, not your account ID. Please do not enter names or other details about people in a topic; the app rejects topics about private individuals. The providers are Anthropic, PBC (USA), where the data may be processed, and Google Cloud EMEA Limited (Ireland), which processes it in the EU; access by Google LLC (USA) is possible. Both process the data as processors and, under their terms, use it neither to train their models nor to improve their products. Google may store requests for a short time to detect abuse. The transfer to the USA relies on the European Commission's standard contractual clauses. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR). A topic on its own says nothing about whether it concerns you personally. Neither Anthropic nor Google receives your account ID. Public courses never show who created them; with Twentymind Pro you can keep a course private.
More information about Anthropic: www.anthropic.com/legal/privacy.
More information about Google Cloud Vertex AI: cloud.google.com/terms/cloud-privacy-notice.
6. Public library, likes, reports and blocks
New courses are public by default: everyone who uses the app can find them in the library and listen to them. The title, script, audio, sources, language, level and category are public, but not who created the course. With the Twentymind Pro subscription you can mark a course as private when you create it; it then does not appear in the library.
When you like a course, we store the like with your account ID so that you can remove it again. The library ranks popular courses higher by their number of likes. Others only see the total, not who liked a course. When you report a course, we store the reason, your details and your account ID in order to handle the report; we delete reports 12 months after they are resolved. When you block a creator's courses, we store that choice with your account ID.
The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR). For handling reports it is also compliance with legal obligations (Art. 6(1)(c) GDPR, Digital Services Act) and our legitimate interest in a safe library (Art. 6(1)(f) GDPR). If you delete your account, your public courses stay in the library without any link to you; private courses, likes and blocks are deleted.
7. Subscriptions through Google Play, the App Store and RevenueCat
You buy subscriptions through Google Play or the App Store. Google or Apple handle purchase and payment under their own responsibility; we receive no payment data, names or email addresses. To verify and restore purchases and to detect refunds, the app uses RevenueCat (RevenueCat, Inc., USA) as a processor. It processes a pseudonymous app user ID that is linked to your account ID, plus the product, period, status and the store's transaction identifiers. The data is kept for as long as your account exists. The transfer to the USA relies on the European Commission's standard contractual clauses.
Our server mirrors this subscription status and keeps a credit log, that is, which courses were created with which credit. The log is pseudonymous and is deleted or fully anonymised when you delete your account. The legal basis is the performance of the subscription contract (Art. 6(1)(b) GDPR). Google and Apple keep invoices and payment records under their own obligations.
More information: www.revenuecat.com/privacy.
8. Analytics (PostHog, only with consent)
Analytics is off until you agree in the app. With your consent the app sends PostHog (PostHog Inc., stored in its EU region) a pseudonymous identifier and a fixed list of usage events, such as app start, onboarding steps, viewing and steps of the plan choice, number of search results, opened courses, started and finished lessons and reports by category. It adds device type, operating system and app version and language; your IP address is processed for the transfer. The app never sends course topics, search texts, free text, names or email addresses. We only take over subscription events from RevenueCat for accounts that have agreed to analytics.
Separately, our server reports the cost and duration of course creation to PostHog, with the course ID only and without any link to you. The legal basis for analytics is your consent (Art. 6(1)(a) GDPR, Section 165(3) of the Austrian Telecommunications Act 2021). You can withdraw it at any time in the app under Profile; the app then sends nothing more and discards events not yet sent. We keep analytics data for at most 12 months and delete it earlier when you delete your account. PostHog stores the data in its EU region and processes it as our processor. We have concluded a data processing agreement with PostHog (Art. 28 GDPR). Because PostHog Inc. is based in the USA, access from the USA is possible; it relies on the European Commission's standard contractual clauses in the data processing agreement.
More information: posthog.com/privacy.
9. Crash reports (Firebase Crashlytics, only with consent)
If you agree in the app, it sends a report to Firebase Crashlytics (Google Ireland Limited or Google LLC) when it crashes. The report contains the technical error trace, device model, operating system and app version, the time and a random identifier of this installation, but no course topics and no details about you. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 165(3) of the Austrian Telecommunications Act 2021), which you can withdraw at any time in the app under Profile. Reports are deleted after 90 days. Any transfer to the USA relies on the European Commission's standard contractual clauses.
More information: firebase.google.com/support/privacy.
10. Permissions
The app uses internet access (library, courses, audio), background playback (an Android foreground service for media playback or iOS background audio, so lessons keep playing with the screen locked) and the store's billing. It does not access the camera, microphone, contacts, location or photos, and it shows no ads.
11. Children
Twentymind is intended for adults aged 18 and over and is not directed at children. We do not knowingly collect data from children.
12. Contact by email
If you contact us by email, we process your email address, the content of the message and your account ID if you give it, to answer your request. The legal basis is the performance of the contract where your account, subscription or courses is concerned (Art. 6(1)(b) GDPR), and otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). The mailbox is hosted by our host helloly GmbH in Austria. We delete the message 12 months after the request has been resolved, unless we must keep it longer, for example as a record of a refund (7 years, Section 132 of the Austrian Federal Fiscal Code, BAO).
13. Deleting your account and data
You can delete your account at any time in the app under Profile, or by email quoting your account ID. We delete an account that is not secured automatically after 180 days without use (section 3). What is deleted and what remains is described on the data deletion page. Deleting the account does not end a subscription; please cancel it on Google Play or in the App Store.
14. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), and the right to withdraw consent at any time (Art. 7(3)). The withdrawal applies from that moment; processing before it remains lawful.
Right to object: where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).
To do so, write to support@gamificationlp.com and include your account ID, because otherwise we cannot match your account. We reply within one month (Art. 12(3) GDPR).
You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the country where you live. The authority responsible for us is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna: www.dsb.gv.at.
15. Changes to this policy
If the processing changes, for example through a new feature or a new service, we update this policy beforehand. The version published here applies; the date at the top shows when it was last updated.