Privacy Policy

Undreamt (“we”, “us”, “our”) makes a dream journal app that reflects with you, not for you. This page explains what we collect, why, and how you stay in control of it. If you take nothing else from it: your dream entries live on your device unless you choose otherwise, and only the entry you ask us to reflect on is ever sent anywhere.

Who we are

Undreamt is operated by Undreamt, Meadow Close, Blackrock, Dublin, Republic of Ireland. You can reach us atsupport@undreamt.app. Undreamt is the data controller for the personal data described here.

What we collect and why

• Dream text and transcripts: stored locally, encrypted at rest. It only leaves your device when you ask us to reflect on that entry, or as encrypted backup if you're on the Full plan. You can edit, export or delete it at any time.
• Audio recordings: stored locally, encrypted at rest, transcribed on your device where your platform allows it. Never uploaded, on either plan, even for backup.
• Reflection answers and actions: stored locally, encrypted at rest. Included in an analysis request only for that session.
• Tags, dream signs and settings: stored on your device only, never uploaded.
• Account details: if you sign in with Apple or Google (needed for backup on the Full plan), we hold the identity details your provider gives us, typically your name and email, kept separate from your encrypted journal data.
• Payment and subscription status: handled by Apple, Google and RevenueCat. We never see or store your card details.
• Waitlist signup: your email address, if you join the waitlist, held by Formspree until we contact you about launch.
• Product analytics: anonymous, aggregated app usage events (for example, entry saved, reflection completed) via Aptabase, only if you opt in. Never contains dream content.
• Website analytics: anonymous, cookieless pageview data via Plausible, hosted in the EU.

Sending an entry for reflection

When you ask Undreamt to reflect on a dream, the text of that entry, and nothing else (no name, email or device ID), is sent to our AI provider, Anthropic (the company behind Claude), through its EU-region API under a zero-retention agreement: your entry is not stored or used to train any model. You can turn this feature off entirely and use Undreamt as a private local journal only.

Legal basis for processing (GDPR)

• Local-only journal features: no processing by us at all. The data never leaves your device.
• Sending an entry for reflection: your explicit consent, given each time you choose to analyse an entry.
• Account and backup: performance of our contract with you, for providing the Full plan you subscribed to.
• Anonymous analytics: your consent, where you've opted in, or our legitimate interest in understanding aggregate, non-identifying app usage.

Who we share data with

We share limited data with the service providers who help us run Undreamt, never with data brokers or advertisers, and never to sell it:

• Apple / Google: sign-in and payments.
• RevenueCat: subscription entitlement.
• Anthropic (Claude): AI reflection via its EU-region API, under a zero-retention agreement, for reflection requests only.
• Cloudflare: website hosting.
• Supabase: app backend (accounts and encrypted backup), hosted in the EU.
• Formspree: waitlist form.
• Aptabase: in-app analytics.
• Plausible: website analytics.

We don't sell your data, and we don't use your dream content to train any AI model, ours or anyone else's.

International transfers

Our app backend and AI processing run in the EU. Some of the providers above, including Anthropic, Supabase, Apple and Google, are companies based outside the EU/EEA. Where any transfer of personal data outside the EU/EEA happens, it is covered by standard contractual clauses or equivalent safeguards.

How long we keep data

• Local journal data: for as long as it's on your device, until you delete it.
• Cloud backup (Full plan): kept until you delete the entry, downgrade, or close your account.
• Waitlist emails: until launch, or until you unsubscribe, whichever comes first.
• Reflection requests: not retained by our AI provider under the zero-retention agreement, and not stored on our own servers.

Your rights

Under GDPR, you can ask us to give you access to your data, correct it, delete it, export it, or restrict or object to how we process it, and you can withdraw consent at any time. Most of this you can already do yourself in the app: delete or export any entry in one tap. For anything else, email support@undreamt.app. If you're not satisfied with our response, you can complain to the Data Protection Commission in Ireland or your own local supervisory authority.

Children

Undreamt is not directed at children and isn't intended for use by anyone under 16. We don't knowingly collect data from children.

Security

Journal data is encrypted at rest and in transit. Backend services follow least-privilege access, and no credentials are stored in the app itself.

Changes to this policy

We'll update this page if what we collect or why changes, and update the date at the top. We'll flag material changes in the app.

Contact

Questions about this policy or your data: support@undreamt.app.