Privacy Policy

1. Information We Collect

You provide to us

• Account information: email address, display name, and sign-in provider metadata such as the opaque Apple relay email if you use Sign in with Apple and choose to hide your real one.
• Dream content: dream titles, text, audio recordings (which we transcribe then delete), emotion tags, theme tags, and any people you mention.
• Preferences: interpretation style, visual style, biometric-lock preference, research opt-in.
• Social content: friend relationships, dream circles you own or join, per-dream sharing selections, reports you file about other users or dreams.
• Support communications: anything you send us by email.

Collected automatically

• Device and app information: device model, operating system version, app version, language, time zone.
• Usage data: feature interactions, screens viewed, approximate IP address (used only for abuse prevention and coarse geography; never for precise location tracking).
• Crash and performance diagnostics: stack traces, app version, device state, and performance metrics (via Sentry) when diagnostics are enabled. We configure diagnostics to avoid collecting default personal information and do not intentionally send dream content in crash reports.

We do NOT collect

• Precise GPS location.
• Your contacts, calendar, or photo library without an explicit one-time request for a specific purpose (e.g., saving a generated dream image to Photos).
• The IDFA (Apple's advertising identifier). DreamCatcher does not track you across other apps or websites.
• Payment information. Subscriptions are processed entirely by Apple's App Store or Google Play — we never see or store your card details. We use RevenueCat to manage your subscription and receive only your subscription status (such as active, in trial, or expired).

2. How We Use Your Information

• Provide the Service: render your dream journal, run AI image generation and interpretation, and deliver social features.
• Safety and trust: run automated moderation over dream content before save, handle block and report actions, prevent abuse of our AI services.
• Improvement and debugging: diagnose crashes, identify broken features, improve reliability. We do not train AI models on your content.
• Communication: respond to your support requests; send transactional emails (password reset, security alerts); and send account holders occasional product updates about DreamCatcher, which you can unsubscribe from at any time using the link in the email.
• Legal compliance: respond to lawful subpoenas, enforce our Terms, protect our rights and yours.

3. Legal Bases (EU / UK / EEA Users)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your information under the following legal bases:

• Contract: to provide the Service you signed up for.
• Legitimate interest: security, abuse prevention, measuring feature reliability.
• Consent: research opt-in and any purely optional features that require an explicit toggle.
• Legal obligation: compliance with applicable law.

You can withdraw consent at any time in Settings or by contacting us at ian@thedreamcatcher.ai.

4. Service Providers (Processors)

We rely on the following processors to operate DreamCatcher:

• Supabase — database, authentication, object storage, edge functions (United States).
• OpenAI — audio transcription, content moderation, title suggestions, AI image generation, and AI interpretation. Content sent to OpenAI is processed under OpenAI's API data controls and is not used to train OpenAI models by default.
• Apple — Sign in with Apple and App Store distribution.
• Google — Google Sign-In (only when the user chooses that provider).
• RevenueCat — subscription management and entitlement status for in-app purchases (United States). RevenueCat receives your purchase receipts and an app-specific user identifier; it does not receive your dream content.
• Sentry — crash and performance monitoring when enabled. Session replay is disabled for dream-content privacy.
• Vercel — web hosting for the marketing site. Website analytics are collected by Umami, with optional Microsoft Clarity recording as described below.
• Umami — self-hosted aggregate website analytics, including page visits, campaign tags and store-link clicks. We do not send dream text, interpretations, account identifiers or authentication tokens to Umami.
• Microsoft Clarity — optional heatmaps and session recordings on public marketing pages, enabled after consent from visitors aged 18 or older. Dream entry and results are masked, and recording stops when you interact with the dream form. Authentication and shared-dream routes are excluded. Analytics cookies are enabled only after consent; advertising storage remains disabled. You can decline or withdraw through Analytics preferences in the website footer.
• AppsFlyer — install attribution for the DreamCatcher mobile apps. When you install the app, AppsFlyer records which campaign or link, if any, brought you to it, using an app-specific install ID, your IP address and device model. Our subscription processor, RevenueCat, shares trial and purchase events with AppsFlyer together with your account ID and a one-way hashed email address, so we can tell which marketing works. The app does not collect advertising identifiers. For installs that came from a DreamCatcher ad in ChatGPT, AppsFlyer reports the trial or purchase to OpenAI so the ad can be measured.
• OpenAI (ChatGPT Ads) — if you reach our website by clicking a DreamCatcher ad in ChatGPT, OpenAI's measurement pixel records that visit and whether you tap an App Store or Google Play button, so we can tell which ads work. It loads only for visitors arriving from a ChatGPT ad, only on public marketing pages, and not if you declined optional analytics. It uses first-party cookies set by OpenAI's pixel; we do not send dream content, account details or email addresses to OpenAI.
• OpenAI (ChatGPT plugin) — if you connect DreamCatcher to ChatGPT, ChatGPT can read and write your journal on your behalf: dream titles and content, the date you dreamed, your emotions and tags, interpretations and images DreamCatcher generates, the names of your Dream Circles, and the name and email on your account. This happens only for the account you connect, only when you use DreamCatcher inside a ChatGPT conversation, and OpenAI handles that data under its own privacy policy. We do not send other people's dreams, and dreams stay private unless you ask ChatGPT to share one. Accounts created through ChatGPT are tagged so we know the plugin brought you. You can disconnect at any time from ChatGPT's connected apps or by contacting us.

Each processor is bound by a contract that limits its use of your data to the services it provides to us.

5. Data Sharing and Visibility

We do not sell your personal information, and we do not share your dream content with advertisers. The only content ever visible to other users is what you deliberately set to "Public" or share into a specific Dream Circle.

You retain full control over the visibility of every dream. You can change any dream's visibility at any time. Deleting a dream removes it from every context it was shared into.

6. Data Retention

We keep your data for as long as your account is active or as needed to provide the Service. Specifically:

• Audio recordings: deleted immediately after transcription.
• Dream content, tags, emotions: retained until you delete the dream or your account.
• Crash diagnostics: retained for the period supported by our diagnostics provider and plan, currently up to 90 days.
• Deleted accounts: profile, dreams, friendships, and circle memberships are permanently removed within 30 days.

7. Your Rights

Everyone

You can always:

• Access and edit your dreams and profile from within the app.
• Export your data by emailing us at ian@thedreamcatcher.ai; we will send a machine-readable copy within 30 days.
• Delete individual dreams from the Dream Detail screen.
• Delete your entire account from Settings > Delete Account in the iOS or Android app, or by emailing us. Deletion is irreversible and removes all dreams, relationships, and circle memberships.

California residents (CCPA / CPRA)

You have the right to know what categories of personal information we collect, request access or deletion, opt out of "sale" or "sharing" (we do neither), and not be discriminated against for exercising these rights.

Colorado residents (Colorado Privacy Act)

You have the right to access, correct, or delete your personal data, obtain a portable copy, and opt out of the sale of personal data and of profiling for decisions with legal or similarly significant effects. We do not engage in either.

EU / UK / EEA residents (GDPR / UK GDPR)

You have rights of access, rectification, erasure, restriction, objection, and data portability. You have the right to lodge a complaint with your supervisory authority. To exercise any of these rights, email ian@thedreamcatcher.ai.

8. Security

We protect your data with HTTPS in transit, row-level security on our database, secure on-device session storage, and standard hashing on any credentials you create. No system is perfectly secure; if we become aware of a breach that affects you, we will notify you without undue delay as required by applicable law.

9. Children's Privacy

The DreamCatcher marketing website is intended for adults aged 18 and older. Optional website session recording is available only to visitors who confirm they are 18 or older and consent. App-store age ratings are separate from this website audience policy. The DreamCatcher app is not directed to children under 13. We do not knowingly collect personal information from anyone under 13. If we learn we have done so, we will delete the information promptly. If you believe a child under 13 is using the Service, please contact us.

10. International Transfers

We are based in the United States. If you are located outside the U.S., your information will be transferred to and processed in the U.S. We rely on Standard Contractual Clauses with our EU-based users' data where required.

11. Mobile App Specifics

When you use DreamCatcher on iOS or Android, certain permissions may be requested:

• Microphone — only when you tap "Record with voice" to capture a dream. Audio is uploaded to our transcription service, converted to text, then discarded.
• Biometric lock — only if you enable biometric lock in Settings. The biometric check happens entirely on your device; we never see biometric data.
• Photo Library add permission — only when you explicitly save a generated dream image to your photo library.

DreamCatcher does not use Apple's advertising identifier (IDFA) and does not track you across other apps or websites. There is no App Tracking Transparency prompt because we do no tracking.

12. AI-Generated Content

When you use voice transcription, moderation, title suggestion, AI image generation, or AI interpretation features, the relevant audio or dream text is sent to our AI provider (OpenAI) for processing. Outputs are returned to you and, where relevant, stored with the dream. We do not use your dream content to train any AI model. OpenAI states that API data is not used to train or improve its models by default, but API inputs and outputs may be retained in abuse-monitoring logs for a limited period unless stricter retention controls apply.

AI-generated interpretations are for personal reflection and entertainment only. They are not medical, psychological, or clinical advice and should not be used to make important decisions.

13. Changes to This Policy

We may update this Privacy Policy as our platform evolves. We will post the updated version with a new "Last updated" date. For material changes, we will also notify you in-app or by email before the change takes effect.

14. Contact Us

For any privacy-related questions, requests, or concerns:

Project Win LLC Email: ian@thedreamcatcher.ai