BrushIT Privacy Policy
Last updated: 18 September 2026
This policy explains what BrushIT does with data. It is written to be read, not to be survived — if anything here is unclear, email the address at the bottom and I will explain it properly.
The short version. BrushIT collects nothing. There is no account, no sign-in, no server and no analytics of any kind. Every brush your child logs is saved on your own iPhone and is never sent anywhere. The app does not ask for your email, contacts, photos, health data or location, and it shows no advertising.
Who is responsible
BrushIT is published by Mark Heath, an individual developer based in the United Kingdom. For the purposes of UK GDPR I am the data controller for anything described in this policy. Contact details are at the bottom of the page.
What BrushIT stores on your device
The app keeps one save file in its own private storage area on your iPhone. It holds:
- the date and time of each logged brush, how long it lasted, and whether the guided timer was used;
- streaks, XP, levels and the badges earned;
- the brushing windows, school days and any holiday periods you set;
- the chosen theme, reminder settings and other preferences;
- a first name, if you choose to type one — this is optional, and the app works perfectly well without it;
- details of the toothbrush being tracked, if you use that feature;
- whether this Apple Account owns BrushIT Complete.
This file never leaves your device. It is not backed up to any server I control, it is not shared with me, and I have no way to read it. If your iPhone is set to back up to iCloud, Apple may include it in that backup under Apple's own terms.
To delete all of it, delete the app. There are also Reset today and Erase all history buttons inside the app's settings if you want to clear things without uninstalling.
The parent PIN
If you switch on the parent lock, the four-digit code is stored in your iPhone's Keychain as a salted, stretched hash — not as the number you typed. It is marked so that it never syncs to iCloud and never restores onto a different device. I cannot read it, and neither can anyone else with the phone.
Purchases
BrushIT is free to download. BrushIT Complete is an optional one-off in-app purchase sold through Apple's In-App Purchase system. Apple handles the entire transaction. I never see and never receive your card number, billing address, Apple Account email, or any other payment detail. All I receive from Apple is aggregate sales reporting that does not identify individual buyers.
The app asks Apple whether this Apple Account has bought BrushIT Complete, and records only a yes or no answer on the device.
Apple's handling of your payment data is covered by the Apple Privacy Policy.
Reminders and Lock Screen cards
BrushIT can send reminders and place a card on the Lock Screen when a brushing window opens. These are scheduled locally by the app on your own iPhone. They are not push notifications sent from a server — there is no server — and no information leaves the device to make them happen.
What BrushIT does not do
- No account, no sign-in, no password.
- No advertising of any kind, and no advertising identifiers.
- No analytics, crash reporting, or third-party SDKs.
- No access to contacts, photos, camera, microphone, health data, or location.
- No selling of personal data to anyone, ever.
- No leaderboards, chat, user-generated content, or any way for anyone else to see your child.
- No links out of the app, other than this policy page.
Children
BrushIT is designed to be used by a child, usually with a parent setting it up. That is exactly why it collects nothing at all.
The app is not part of Apple's Kids Category, and I do not knowingly collect any personal information from children of any age. Because nothing is collected, transmitted or stored by me, there is nothing for a parent to request, review or ask me to delete — the honest answer to such a request would be "there is no file". To remove everything the app has recorded, use Erase all history in the app's settings, or delete the app.
Legal basis and retention
| What | Why it is lawful | How long |
|---|---|---|
| Brushing history and settings on your device | Necessary to provide the app you asked for (contract) | Until you erase it in the app or delete the app |
| Parent PIN in the device Keychain | Necessary to provide a feature you switched on (contract) | Until you turn the parent lock off or delete the app |
| Record of the in-app purchase | Necessary to give you what you paid for (contract) | Held by Apple; the app stores only yes or no |
Your rights
Under UK GDPR you have the right to access, correct, erase, restrict and object to the processing of your personal data, and the right to data portability.
Because I hold no personal data about you, there is nothing for me to send you or delete. For portability, BrushIT has an Export my data button that writes your whole history to a file you choose where to send — that file is yours and never passes through me.
If you are unhappy with how your data has been handled you can complain to the UK Information Commissioner's Office at ico.org.uk.
Changes
If this policy changes in a way that matters, the date at the top will change and the new version will be published here before the change takes effect in the app. Since the app collects nothing, I do not anticipate material changes — but if that ever changed, it would be said here clearly and in advance.
Contact
Questions about this policy, or about BrushIT generally: