Privacy Policy

DreamJournal.ai (“we,” “us,” or “our”) operates the DreamJournal.ai website, mobile application, and related services (collectively, the “Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our Service.

We are committed to protecting your privacy and complying with the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA), and other applicable data protection laws.

1. Data Controller

The data controller responsible for your personal data is:

DreamJournal.ai
Email: privacy@dreamjournal.ai

2. Data We Collect

2.1 Information You Provide

• Account information: email address, display name, and avatar when you create an account (via Clerk authentication).
• Dream content: dream text, audio recordings, drawings, tags, and metadata (emotional tone, intensity, lucidity level, clarity) that you choose to enter.
• Conversations: messages exchanged with Lucy, our AI dream assistant.
• Waitlist and campaign data: email address and optional dream text when you join our waitlist.
• Payment information: billing details processed by our payment provider (Gumroad). Subscriptions started before we switched to Gumroad may still be processed by LemonSqueezy. We do not store your credit card numbers.
• Channel connections: Telegram user ID when you link a messaging channel.

2.2 Information Collected Automatically

• Device and usage data: IP address, browser type, operating system, referring URLs, pages visited, and timestamps.
• Analytics data: anonymized usage patterns, feature interactions, and performance metrics.
• Cookies and similar technologies: we use essential cookies for authentication and preferences. See Section 8 for details.

2.3 Information Generated by the Service

• AI-generated analysis: dream elements (people, locations, symbols) extracted by our AI, sentiment analysis, and vector embeddings used for search and pattern detection.
• Transcriptions: text generated from audio recordings you submit.

3. How We Use Your Data

We process your personal data for the following purposes and legal bases:

4. How We Share Your Data

We do not sell your personal data. We share data only in the following circumstances:

• Service providers: we use trusted third-party providers to operate the Service, including:
  • Clerk — authentication and user management
  • Gumroad: payment processing. Subscriptions started before we switched to Gumroad may still be processed by LemonSqueezy.
  • AWS / S3-compatible storage — secure file storage for attachments
  • OpenRouter / AI providers — AI processing for dream analysis and Lucy conversations
  • Runware — image generation
• Legal requirements: when required by law, regulation, legal process, or governmental request.
• Business transfers: in connection with a merger, acquisition, or sale of assets, with prior notice to you.
• With your consent: when you explicitly share dreams or content publicly.

5. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States. When we transfer data outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or reliance on an adequacy decision.

6. Data Retention

We retain your personal data for as long as necessary to provide the Service and fulfill the purposes described in this policy:

• Account data: retained while your account is active and for 30 days after deletion to allow recovery.
• Dream content: retained while your account is active. Deleted within 30 days of account deletion.
• AI-generated data: deleted when the associated dream content is deleted.
• Payment records: retained for up to 7 years as required by tax and accounting regulations.
• Waitlist data: retained until the waitlist is no longer active or you request removal.

7. Your Rights

Under the GDPR and applicable data protection laws, you have the following rights:

• Access: request a copy of your personal data.
• Rectification: request correction of inaccurate data.
• Erasure: request deletion of your data (“right to be forgotten”).
• Restriction: request restriction of processing.
• Data portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interests.
• Withdraw consent: withdraw consent at any time where processing is based on consent.
• Lodge a complaint: file a complaint with your local data protection authority.

To exercise any of these rights, contact us at privacy@dreamjournal.ai. We will respond within 30 days.

California Residents (CCPA)

If you are a California resident, you have the right to know what personal data we collect, request deletion, and opt out of the sale of personal data (we do not sell your data). You may exercise these rights without discrimination.

8. Cookies and Tracking

We use the following types of cookies:

• Essential cookies: required for authentication, security, and core functionality. These cannot be disabled.
• Preference cookies: store your settings such as theme preference (light/dark mode).
• Analytics cookies: help us understand how you use the Service. These are only set with your consent.

You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent the Service from functioning correctly.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including encryption in transit (TLS) and at rest, access controls, regular security assessments, and secure infrastructure. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

10. Children's Privacy

The Service is not intended for children under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16, we will take steps to delete that data promptly. If you believe a child under 16 has provided us with personal data, please contact us at privacy@dreamjournal.ai.

11. AI Processing

Our Service uses artificial intelligence to analyze dream content, generate insights, and power Lucy, our conversational AI assistant. This processing involves:

• Extracting entities (people, locations, symbols) from dream text.
• Generating vector embeddings for semantic search and pattern detection.
• Producing conversational responses based on your dream history.

AI-generated outputs are provided for informational and reflective purposes only. They do not constitute medical, psychological, or professional advice. You retain ownership of your dream content; we use it only to provide and improve the Service as described in this policy.

Under the GDPR, you have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. Our AI features are designed to assist and inform, not to make decisions with such effects. If you have concerns, contact us.

12. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a prominent notice in the Service at least 30 days before changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, contact us:

DreamJournal.ai
Email: privacy@dreamjournal.ai