Privacy Notice

What we collect and why

• Account details (email address, name if you provide one, sign-in identifiers from Google if you use it) - to create and secure your account, and to contact you about the service. Basis: performance of our contract with you.
• Your journal content (dreams, dates, mood and sleep ratings, themes and tags, your own interpretations, life journal entries, and any AI conversations you start) - to provide the service to you. Basis: performance of our contract with you.
• Technical and usage data (IP address, device and browser information, log records, pages viewed, feature usage) - to keep the service secure, prevent fraud and abuse, diagnose faults and improve the product. Basis: our legitimate interests in running a secure, working service.
• Support messages you send us - to answer you. Basis: legitimate interests and, where relevant, our contract with you.
• Marketing preferences, where you opt in to updates. Basis: your consent, which you can withdraw at any time.

Payment card details are never collected or stored by us. They are handled by our Merchant of Record, Paddle.

Who we share data with

• Service providers and subprocessors - hosting, database, email and error-monitoring providers who process data on our instructions.
• Paddle.com Market Ltd, our Merchant of Record, for the sale of subscriptions, subscription management, payments, invoicing, tax compliance and billing-related support.
• Our AI provider, only when you choose to start or continue an AI interpretation. The dream text and notes you include in that conversation are sent for processing so a reply can be generated. If you never use the AI features, your journal content is never sent to an AI provider.
• Professional advisers (legal, accounting) and authorities, where we are required to do so by law.

We do not sell your personal data.

International transfers

Some of our providers operate outside the UK and EEA. Where personal data is transferred outside those areas, we rely on appropriate safeguards such as UK/EU Standard Contractual Clauses or an adequacy decision.

How long we keep it

We keep your account and journal content for as long as your account exists. If you delete an entry it is removed from your journal; if you delete your account, we delete or anonymise your personal data within 30 days, except where we must keep records (for example transaction records for tax purposes) for longer. Technical logs are kept for a limited period for security and diagnostics.

Your rights

Subject to the law that applies to you, you can ask us to give you access to your data, correct it, delete it, restrict or object to how we use it, provide it in a portable format, or withdraw consent you have given. Contact us at support@mydreamdrawer.io and we will respond within one month. If you are in the UK or EEA and you are unhappy with our response, you can complain to your local supervisory authority.

Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit, encryption at rest, access controls, and row-level rules in our database so that journal entries are readable only by the account that created them. No system is perfectly secure, but we work to keep your entries private.

Cookies

We use essential cookies and similar browser storage to keep you signed in and to remember preferences such as your chosen colour theme. These are required for the site to work. We do not use advertising cookies. Our payment provider may set cookies during checkout to process your purchase and prevent fraud. You can clear or block cookies in your browser, but sign-in will not work without the essential ones.

Contact

Questions about this notice, or about your data: support@mydreamdrawer.io.