Privacy Policy

Effective: July 31, 2026. Last updated: July 31, 2026.

In brief

The free version of our mobile apps shows advertising, and that is where almost all data collection happens. To show and measure those adverts, advertising and analytics software built into the apps receives your device’s resettable advertising identifier, an approximate location worked out from your IP address (roughly city or region level), basic device information, information about how you use the app, and the fact that you have bought a subscription. Under California law and several other US state laws, that counts as “selling” and “sharing” your personal information, and we say so plainly rather than hide behind a technicality.

We have no accounts, no logins and no passwords. We never see your name or your payment card details, and we only have your email address if you choose to write to us. This website, watereject.org, is much quieter: no adverts, no accounts, no forms, and cookieless analytics only.

What this policy covers

This policy applies to the Android application “Water Eject: Speaker Cleaner” (package com.water_eject.speaker_cleaner) on Google Play, the iOS application “Water Eject°” on the Apple App Store, and the website watereject.org. Together we call these the Service. We refer to ourselves as WaterEject.org, or as “we”, “us” and “our”.

Your use of the apps and the website is also governed by our Terms and Conditions .

Who is responsible for what. We are the controller for the Service as a whole and for the choices we make about which partners to include in it. Our advertising and analytics partners are not simply acting on our instructions: for the data they collect through the app for their own purposes — including building profiles across other companies’ apps and websites — they act as independent controllers, and in some cases as joint controllers with us. That matters practically, because it means you also have rights directly against them and not only against us. Apple and Google likewise act for their own purposes, under their own privacy policies, when they process your payment. If you ask us, we will tell you what role a particular partner plays and point you to its own policy and rights request form.

The apps and the website work very differently, so where something applies to only one of them we say so.

Notice at collection

We do not collect your name, postal address, phone number, payment card number, government identifiers, biometric or health data, precise GPS location, contacts, photos, microphone audio, or the contents of any message. We only have your email address if you write to us. The app plays sound; it does not record it.

We collect approximate location only. California law treats precise geolocation — data that can place you within about 1,850 feet — as sensitive personal information. City-level location is not that. We do not collect any category of sensitive personal information as those laws define it, so we do not offer a separate “Limit the Use of My Sensitive Personal Information” control.

When you use the apps

The free version is funded by advertising supplied by third-party networks. We do not run our own servers that collect information about you, we have no account system, and we cannot look you up by name. The data described above is collected by the advertising, analytics and crash-reporting software built into the app and sent directly to those companies. We see reports and aggregate figures back from them.

Advertising identifiers. On Android the app uses the Android Advertising ID; on iOS, the Identifier for Advertisers. Both are resettable identifiers controlled by you and are not tied to your name. The analytics software in the app also creates a per-install identifier, which changes if you delete and reinstall the app. These are the only identifiers the app reads or creates. Neither is linked to a name, an email address or an account, because there are none.

Personalised versus adverts chosen without a profile. If you agree to personalised adverts, our advertising partners use the advertising identifier, approximate location and app usage to choose adverts for you and to measure how they perform. That is profiling. It has no legal or similarly significant effect on you and does not change your access to the app.

If you decline, we do not read your advertising identifier and no profile is used to choose what you see. Delivering any advert still means the advert has to be requested from an advertising network, and that request necessarily shows the network your IP address and basic characteristics read from your device. In the EEA and the UK that read is not strictly necessary either, so your answer on the consent screen covers it as well: if you refuse it, no advert request is made from your device. Whatever you choose, the app itself works exactly the same.

You do not have to provide anything. The 165 Hz tone plays whether or not you agree to analytics or personalised advertising.

When you visit watereject.org

The website has no accounts, no forms, no comments, no shop and no advertising. It sells and shares nothing.

We use Umami, hosted in the European Union at analytics.eu.umami.is, to count page views. As we have configured it, it sets no cookies, stores nothing on your device, creates no lasting identifier and does not follow you to other sites. It reports only aggregate figures. Because it is used solely for our own audience measurement and never for advertising, we rely on legitimate interest and do not ask for consent for it. If we ever change that configuration, we will update this policy first.

The data is stored in the European Union. Storage location is not the whole story, though: where staff of a provider outside the EEA can reach a service remotely, that is still an international transfer, so we treat website analytics under the same transfer section as everything else below rather than claiming that no transfer can occur.

The site also loads an icon stylesheet from Cloudflare’s cdnjs content delivery network. As with any file loaded from another server, your IP address and browser details are necessarily visible to that provider in order to deliver the file. It is not used to profile you. We are working to serve this file from our own site so that the disclosure stops happening at all. We do not use Google Analytics.

Storing and reading information on your device

Apps and websites can store information on your phone or read information from it. In the European Economic Area and the United Kingdom, we need your permission before we do this unless it is strictly necessary for what you asked for. Playing the tone and remembering your settings are strictly necessary. Reading your advertising identifier, reading device characteristics to build an advert request, and collecting analytics are not, so we ask first.

We do not read your advertising identifier, and we do not enable personalised advertising or advert measurement, before your choice is returned. We should be precise about what that does and does not mean: some software has to load in order to draw the consent screen at all, and while it is loading it handles only what is needed to show you that screen. Where a component offers a setting that holds collection back or defaults it off until consent arrives, we set it to the most restrictive option available.

Your choices

EEA, UK and Switzerland. The apps show a consent screen before any advertising or analytics collection begins. Reject-all is as easy as accept-all and nothing is pre-ticked. You can reopen the screen at any time from the privacy settings inside the app, and you can always reach us at support@watereject.org instead. Your choices are passed to our advertising partners using the standard consent signal the advertising industry uses for that purpose, so that a refusal travels with the advert request rather than stopping at our app. We are responsible for choosing which partners are included; each of them is separately responsible for what it does with your data under its own policy.

iOS. Apple requires apps to ask through its App Tracking Transparency prompt before your Identifier for Advertisers can be used to track you across other companies’ apps and websites. If you do not grant that permission, we do not read the IDFA and your data is not used for tracking, whatever you chose on our own screen — the stricter answer always wins. You can change your answer at Settings → Privacy & Security → Tracking.

Android. Settings → Google → All services → Ads lets you reset or delete your advertising ID and opt out of ads personalisation. We honour that setting.

Withdrawing consent. Where we rely on consent you can take it back at any time in the app’s privacy settings, in the same number of taps it took to give, or by emailing support@watereject.org . Withdrawal does not make earlier processing unlawful, but we stop from that point.

Objecting to advertising. You have an absolute right to object to direct marketing, including profiling for it, and we do not make you write a letter to use it: turning off personalised advertising in the app is the objection, and it takes effect immediately. You can also object to the adverts we deliver on the legitimate-interest basis, by the same route or by emailing support@watereject.org .

Who receives data

• Advertising networks and their partners — receive your advertising identifier, approximate location, device and usage data, and purchase events, to select and measure adverts.
• Analytics and crash-reporting providers — receive usage and diagnostic data so we can fix faults and improve the app.
• Google Play and the Apple App Store — process your payments and tell us only whether a purchase or subscription is active. We never receive or store your card number, bank details or billing address. They act for their own purposes under their own privacy policies.
• Hosting and content delivery providers, including Cloudflare (cdnjs) — necessarily handle your IP address to deliver the website.
• Umami (EU-hosted) — website audience measurement only.
• Our email provider — handles messages you send to support@watereject.org .

The advertising and analytics partners built into the apps are listed by name in the privacy settings inside the app. We know that is not much use to somebody reading this before installing, or after uninstalling, so: email support@watereject.org and we will send you the current list, telling you for each partner what it receives, which country it is in, which transfer safeguard applies, and where to find its own privacy policy and rights request form. We will reply to that with the list itself, not with a redirection back to the app.

International transfers

Some of the companies we work with are outside the EEA and the UK, mainly in the United States. Where a provider is certified under the EU–US Data Privacy Framework, transfers rely on the European Commission’s adequacy decision; the UK Extension applies for UK users. Otherwise transfers are made under the European Commission’s Standard Contractual Clauses, or the UK International Data Transfer Addendum, with additional safeguards. This applies to advertising and analytics partners, to our content delivery provider, and to our email and website analytics providers alike. Email support@watereject.org and we will tell you which safeguard applies to a particular partner and how to obtain a copy.

How quickly we respond

There is one deadline per set of rules, and it applies wherever this policy mentions a request.

• EEA, UK and Switzerland. We respond in full within one month of receiving your request, as the GDPR requires. If your request is complex, or you have made several, we may extend by up to two further months, and we will tell you why within the first month.
• US state privacy laws. We respond within 45 days, and may take up to a further 45 days if we tell you within the first 45. If we refuse a request you may appeal by emailing support@watereject.org with “Appeal” in the subject line; we will decide within 60 days, explain our reasoning in writing, and if we deny the appeal give you a link to your state attorney general’s complaint form.
• Anything else. We aim to reply within 30 days, and we try to acknowledge within a few days.

Using any of these rights is free.

Deleting your data

Because we have no account for you, there is no “delete my account” button to press. There are three routes, and we have put them in the order that actually achieves the most.

1. Ask us, and we will pass it on. Email support@watereject.org with “Deletion” in the subject line, tell us your platform, and include your advertising identifier if you can. On Android your current advertising ID is shown at Settings → Google → All services → Ads, and the app also shows it in privacy settings. We will act on the request, pass it to the providers holding data against that identifier, tell you who we contacted, and reply within the deadline set out above.

   Before we act on a deletion, access or correction request we take reasonable steps to check that the request really comes from you, because otherwise anyone who obtained your advertising identifier could delete or read your data. Usually that means asking you to send the request from the device in question, or to confirm a detail only that device would show. We will never ask you to create an account, and we will never ask for identity documents. Opting out of sale and sharing is different: we ask for no verification at all for that, because there is no risk in stopping.

2. Cut the link yourself, for the future. On Android, Settings → Google → All services → Ads → Delete advertising ID replaces your ID with zeros, so partners can no longer match new data to you. On iOS there is no user-facing way to reset the IDFA; turning off “Allow Apps to Request to Track” at Settings → Privacy & Security → Tracking stops apps receiving it from that point on.

   Be clear about what this does. It stops future advertising data being joined to your device. It does not delete the profiles advertising partners have already built against your previous identifier — only a deletion request, route 1, can do that. Uninstalling the app removes what is stored on the device and likewise has no effect on data a partner already holds.

3. If you cannot supply an identifier. We are not refusing your request. We are telling you that, without an identifier, we have no way to find data that relates to you. An advertising identifier is personal data, and what our partners hold against yours is your personal data — we do not pretend otherwise. If you can supply the identifier later, or give us anything else that lets us match a record, we will act on the request. Under Art. 11(2) and Art. 12(2) GDPR we must, and will, act as soon as identification becomes possible.

Your rights in the EEA and the UK

You have the right to access your data, to have it corrected, to have it erased, to restrict processing, to object to processing, to data portability, and to withdraw consent. You also have an absolute right to object to direct marketing, including profiling for it.

If we erase, correct or restrict your data we will tell each recipient we passed it to, unless that is impossible or would take disproportionate effort, and we will tell you who those recipients were if you ask.

We do not make decisions about you by automated means alone that produce legal effects or similarly significantly affect you, so the right in Art. 22 does not arise. Choosing which advert to show is not a decision of that kind.

Because we hold no account and nothing you have typed in, there is usually very little to port — but if there is, we will provide it in a common machine-readable format. To use any right, email support@watereject.org and say which right you want to use. Response times are set out above. If we genuinely cannot tell which data is yours, we will ask for the information described in the section on deletion.

Your advertising choices stay as you set them until you change them or until our consent tool asks you again, which it does periodically and always when our purposes or our list of partners change. You can change them sooner at any time in the app’s privacy settings.

If you think we have handled your information wrongly, please tell us first — we would like the chance to put it right. You may also complain to the data protection authority where you live, work, or where the problem occurred; you can find yours via the EDPB members list . In the UK it is the Information Commissioner’s Office . You can also go to court.

Your US state privacy rights

We extend the rights below to everyone in the United States rather than only to residents of states whose laws require them.

Our mobile apps show advertising. To do that, we and our advertising partners use your device advertising identifier, approximate location, device and usage data, and the fact that you have made a purchase. Under California law and several other US state privacy laws this counts as selling and sharing personal information for cross-context behavioural advertising — that is, using what you do in our app to help choose the adverts you are shown elsewhere — even though we receive no direct payment for the data itself. We would rather say that plainly than rely on a technicality. We do not sell or share personal information in any other way: we have no subscriber lists and no contact details to sell, and watereject.org sells and shares nothing at all.

You have the right to know what we collect and who receives it, to a portable copy, to correction, to deletion, to opt out of sale, sharing and targeted advertising, and to opt out of profiling that produces legal or similarly significant effects — we do not carry out profiling of that kind. You will never be discriminated or retaliated against for exercising any of these rights: the app works the same whether or not you opt out.

Do Not Sell or Share My Personal Information. There are three ways to make that request, and all of them have the same effect.

• Turn off personalised advertising in the app’s privacy settings.
• Delete or reset your device advertising identifier — Android: Settings → Google → All services → Ads → Delete advertising ID; iOS: Settings → Privacy & Security → Tracking, and turn off “Allow Apps to Request to Track”.
• Email support@watereject.org with “Do Not Sell or Share” in the subject line. You can do this without installing the app, and after uninstalling it.

When you opt out, we stop passing your advertising identifier, your approximate location, your device and usage data, your diagnostic data and any purchase signal to advertising partners, and we tell our advertising partners to stop as well. The opt-out covers everything the table above marks as sold or shared, not a part of it. We do not require verification for an opt-out and we will never ask you to create an account to make any request. You may use an authorised agent; we may ask for proof that you authorised them.

Response times and appeals are set out in the section on how quickly we respond.

Preference signals. If your browser sends a Global Privacy Control signal we treat it as a valid opt-out of sale and sharing for that browser. Do Not Track was never given an agreed meaning and we do not respond to it. There is no equivalent signal for native mobile apps, which is why the routes above exist and why we honour your Android ads settings and Apple’s tracking prompt. Third parties can and do build profiles across other apps and websites from your advertising identifier — that is exactly what opting out turns off.

We are not required to publish annual request metrics, because we do not handle the personal information of 10 million or more California consumers in a year.

Children

The Service is not directed to children under 13 and we do not knowingly collect their personal information. We do not offer personalised advertising to anyone under 16, or under the higher age of digital consent set by the country where they live. If you are under 18, use the Service with the involvement of a parent or guardian. The same wording appears in our Terms and Conditions , and neither document sets a different age from the other.

How that is enforced today, stated honestly. The apps carry all-ages store ratings and the tone player itself is harmless to see. We do not currently ask your age, so what stands between a child and an advertising consent screen is this policy and the parental controls in the app stores. We do not treat a child’s tap on a consent screen as valid consent, and we do not treat it as parental authorisation for anything. If we learn that a device is used by somebody below the age of consent where they live, we stop treating advertising consent recorded on that device as valid and we act on a deletion request as described above. We are adding a neutral age question before the advertising choice so that this does not depend on a child reading a policy; until it ships, we are not going to claim more protection than we have.

If you are a parent or guardian and believe your child has used the Service, email support@watereject.org . You have three separate rights and we will act on all three: to ask what personal information has been collected from your child and to review it; to refuse to allow any further collection or use of it; and to require us to delete it. We will tell you which advertising partners we contacted and what each of them confirmed. We will not require you to create an account, and we will not ask you for more information than we need to act on the request. Because we hold no accounts, deleting the device advertising identifier in the device settings is also the fastest way to stop anything further.

United Kingdom. Because the apps carry an all-ages rating, we treat them as likely to be accessed by children in the UK and we apply the ICO’s Age Appropriate Design Code. Personalised advertising is off unless somebody actively turns it on — it is never pre-ticked and never assumed — and we do not use nudges, colouring or wording that pushes anyone towards accepting it.

Security

Data sent between the app or website and the services we use is encrypted in transit using HTTPS/TLS. We hold no accounts, no passwords and no payment details, which removes most of what an attacker would want, and we keep the number of components built into the app to a minimum. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We hold no security certification and make no claim to one.

How long data is kept

We keep very little ourselves.

• Your privacy choices stay on your device until you change them or uninstall.
• Analytics events are kept by our analytics provider for the shortest retention period that provider allows us to set. We will tell you the current figure if you ask.
• Crash reports are deleted by our crash-reporting provider on that provider’s own fixed cycle. We cannot lengthen or shorten it, and it runs whether or not the underlying fault has been fixed. We do not promise to delete a crash report the moment a bug is fixed, because no crash-reporting tool works that way.
• Advertising identifiers and approximate location are never stored in any database of ours. They are passed to advertising partners when an advert is requested, and each partner applies its own retention period under its own privacy policy. We will tell you what those periods are for the partners currently in the apps if you ask.
• Purchase records sit with Google and Apple, who are the sellers. We see only a current entitlement status. The settlement reports they give us are aggregate figures that do not identify you, and we keep those for as long as accounting rules require.
• Website statistics are aggregate counts with no identifier attached.
• Emails you send us are deleted once the matter is closed and we no longer need them; where the email was a privacy rights request, we keep a record that we handled it for as long as we may need to show that we did.

Changes to this policy

We review this policy at least once a year and update the date at the top whenever we do, even if nothing else changed. If we make a material change — a new category of information, or a new kind of recipient — we will show a notice inside the app and on the watereject.org homepage before it takes effect and keep it up for at least 30 days. Where a change requires your consent, we will ask you again. Minor clarifications take effect when posted, and changes are never retrospective.

Accessibility and language

We have written this policy in plain English and tried to keep it readable on a small screen and with assistive technology. It is published in English, German, French and Spanish. If you would like it in another language, or you have difficulty reading or using it, email support@watereject.org and we will provide the information in another format.

Rights that override this policy

Nothing in this policy limits any right you have under the privacy or consumer protection law that applies where you live. If you are a consumer in the EEA or the UK, the mandatory rules of your country of residence continue to apply and you can bring proceedings before the courts of the place where you live. Where those laws give you rights beyond what is described here, those rights apply.

Contact us

For any privacy question, or to exercise any of the rights described above, email us at:

support@watereject.org

Response times are set out in the section on how quickly we respond. Your use of the apps and the website is also governed by our Terms and Conditions .