Legal
Privacy Policy
Undreamt (“we”, “us”, “our”) makes a dream journal app that reflects with you, not for you. This page explains what we collect, why, and how you stay in control of it.
If you take nothing else from it: your dream entries live on your device unless you choose otherwise, and only the entry you ask us to reflect on is ever sent anywhere.
Who we are
Undreamt is operated by Undreamt, Meadow Close, Blackrock, Dublin, Republic of Ireland. You can reach us at [email protected]. Undreamt is the data controller for the personal data described here.
What we collect and why
- Dream text and transcripts
- Stored locally, encrypted at rest. It only leaves your device when you ask us to reflect on that entry, or as encrypted backup if you're on the Full plan. You can edit, export or delete it at any time.
- Audio recordings
- Stored locally, encrypted at rest, transcribed on your device where your platform allows it. Never uploaded, on either plan, even for backup.
- Reflection answers and actions
- Stored locally, encrypted at rest. Included in an analysis request only for that session.
- Tags, dream signs and settings
- Stored on your device only, never uploaded.
- Account details
- If you sign in with Apple or Google (needed for backup on the Full plan), we hold the identity details your provider gives us, typically your name and email, kept separate from your encrypted journal data.
- Payment and subscription status
- Handled by Apple, Google and RevenueCat. We never see or store your card details.
- Waitlist signup
- Your email address, if you join the waitlist, held by Formspree until we contact you about launch.
- Contact form
- Your name (if you give it), your email address and your message, if you contact us through the website. Sent through Formspree to our support inbox.
- Product analytics
- Anonymous, aggregated app usage events (for example, entry saved, reflection completed) via Aptabase, only if you opt in. Never contains dream content.
- Website analytics
- Anonymous, cookieless pageview data via Plausible, hosted in the EU.
Sending an entry for reflection
When you ask Undreamt to reflect on a dream, the text of that entry, and nothing else (no name, email or device ID), is sent to our AI provider, Anthropic (the company behind Claude), through its EU-region API under a zero-retention agreement: your entry is not stored or used to train any model. You can turn this feature off entirely and use Undreamt as a private local journal only.
Legal basis for processing (GDPR)
- Local-only journal features
- No processing by us at all. The data never leaves your device.
- Sending an entry for reflection
- Your explicit consent, given each time you choose to analyse an entry.
- Account and backup
- Performance of our contract with you, for providing the Full plan you subscribed to.
- Anonymous analytics
- Your consent, where you've opted in, or our legitimate interest in understanding aggregate, non-identifying app usage.
International transfers
Our app backend and AI processing run in the EU. Some of the providers above, including Anthropic, Supabase, Apple and Google, are companies based outside the EU/EEA. Where any transfer of personal data outside the EU/EEA happens, it is covered by standard contractual clauses or equivalent safeguards.
How long we keep data
- Local journal data
- For as long as it's on your device, until you delete it.
- Cloud backup (Full plan)
- Kept until you delete the entry, downgrade, or close your account.
- Waitlist emails
- Until launch, or until you unsubscribe, whichever comes first.
- Contact messages
- Only as long as we need to answer your message.
- Reflection requests
- Not retained by our AI provider under the zero-retention agreement, and not stored on our own servers.
Your rights
Under GDPR, you can ask us to give you access to your data, correct it, delete it, export it, or restrict or object to how we process it, and you can withdraw consent at any time. Most of this you can already do yourself in the app: delete or export any entry in one tap. For anything else, email [email protected]. If you're not satisfied with our response, you can complain to the Data Protection Commission in Ireland or your own local supervisory authority.
Children
Undreamt is not directed at children and isn't intended for use by anyone under 16. We don't knowingly collect data from children.
Security
Journal data is encrypted at rest and in transit. Backend services follow least-privilege access, and no credentials are stored in the app itself.
Changes to this policy
We'll update this page if what we collect or why changes, and update the date at the top. We'll flag material changes in the app.
Contact
Questions about this policy or your data: [email protected].