A dream journal only works if you are honest in it, and you can only be honest in it if you know where the words go. This document is written to be read rather than to be survived.
Who we are
Dreamia is operated by Rhys Watts, a sole proprietor based in British Columbia, Canada. We are the controller of the personal information described here.
Contact us at hello@getdreamia.com about anything in this policy, including a request to see or delete your data.
This website and the Dreamia app
This policy distinguishes the public marketing website from the Dreamia app. The website does not provide app accounts or a user dashboard. Its download links lead to the iOS beta or the web app.
The website uses Vercel Analytics to measure visits and page use. If you choose to ask Mia a question on an editorial page, the question, recent conversation and page text are sent through our server to OpenAI to generate a response. Those requests set store: false. Do not include sensitive information you do not want processed for that response.
Website Mia uses a signed cookie containing usage timestamps to limit requests; the cookie expires after 24 hours. The website also remembers locally when you dismiss Mia’s introductory prompt. The website preview is separate from your private app journal.
The Dreamia app
What we collect
| Account | Email address, and a password we never see in readable form. A display name, date of birth, and time zone if you give them. Optionally, how you heard about us. |
|---|---|
| Your journal | The dreams and waking moments you write, their titles, the time you recorded them, and everything Dreamia derives from them: the reading, the emotional reading, the symbols drawn, and the cards you have collected. |
| Memory | Short facts Dreamia keeps so readings make sense over time — that you started a new job, that a place matters — and the people you have named along with how you described them ("Matt is a friend"). Only what you stated yourself; nothing is inferred. You can see all of them, edit them, and delete any of them, on the Memories screen. |
| Subscription | Whether you are on the free or paid tier, and the identifiers Apple gives us to confirm it. We never receive your card details. Apple handles payment and does not share them with us. |
| Notifications | If you ask to be notified when a reading is ready, Apple issues a device token that we store against your account so the notification can reach your phone. Turning notifications off in iOS Settings stops it being used. |
| Usage | Counts of readings and research lookups, to apply the limits of your tier. |
The Dreamia app does not collect your location, contacts, photos, or advertising identifiers. The app has no analytics SDK, advertising network, or tracking across other apps or websites. Website analytics are described separately above.
Date of birth
Used to place your zodiac sign and to confirm you are old enough to use Dreamia. It is not shown to other app users.
Where your dreams go
This is the part most worth understanding, so it is stated plainly.
To produce a reading, the text of your dream is sent to an AI provider. There is no way to interpret a dream without a model reading it, so this is the one place your words leave our systems. Today that provider is:
- OpenAI — writes your reading, asks the follow-up questions, holds your conversations with Mia, and runs symbol research — privacy policy
If OpenAI cannot be reached — an outage, a timeout — the same request is retried through OpenRouter, which routes it to the same OpenAI model. It is a second road to one destination, not a second opinion, and it carries the same text under the same rules. Nothing is sent through it while the direct route is working. (privacy policy)
Your journal is not training data
This is the question people actually mean when they ask where their dreams go, so it is answered on its own.
- We do not train any model on your journal. Not a model of our own, and not by handing your entries to anyone else to train on.
- Our AI provider does not train on it either. Dreamia uses OpenAI through its API under business terms, where content sent by a developer is not used to train or improve OpenAI's models. That is the default for the API, not a setting we could forget to tick. Every failover request also requires a zero-retention endpoint and denies provider data collection in code, rather than relying only on an account setting.
- It is processed, and then it goes. Your entry is sent so a reading can be written and returned. The provider may keep a copy briefly — currently up to 30 days — solely so abuse of the service can be investigated, and then deletes it. It does not become part of a dataset, a model, or a product.
- We do not read your journal in normal operation. Dreamia has no staff-facing journal browser. As with any hosted service, a tightly limited number of authorised infrastructure administrators may be technically able to access stored data when necessary for security, support, reliability, or a legal obligation. Access is not used for advertising or model training.
- We never sell your journal or disclose it for advertising. It is disclosed only to the service providers described here when needed to run Dreamia. There is no advertising network or cross-app tracking.
When Dreamia researches a symbol, your dream is not sent. A separate step first reduces the dream to generic symbol words — "spider", "falling", "a locked door" — and only those words reach the web search. Names, relationships, employers, places, quotations and any private detail are stripped before that step runs. The research that comes back is about the symbol in general, and is stored in a shared library that contains nothing personal.
Everyone else who touches it
| Supabase | Hosts the database and handles sign-in. Your journal is stored here, protected by row-level security so that other app accounts cannot read it. |
|---|---|
| Resend | Sends account emails — confirmation and password reset. Receives your email address only. |
| Apple | Handles subscriptions and payment. We receive confirmation of your subscription status, never your payment details. |
| OpenRouter | A backup route to the same AI model, used only when OpenAI is unreachable. Every request requires a zero-retention endpoint and denies provider data collection, so the request fails rather than route somewhere that may retain or train on it. |
| Capgo | Delivers app updates to your phone. Receives your device's update identifier, app version and platform so it can tell whether an update applies. It never receives your journal, your account, or your email. |
| RevenueCat | Reconciles subscription status between Apple and your account, once paid subscriptions are live. |
If we ever change AI providers, this list is updated before any data starts flowing to a new one.
On your device
Dreamia keeps a copy of your journal on your phone so it works without a connection, and syncs when you are back online. That copy is stored in the app's own storage and is not separately encrypted by us. It is protected by your device's own encryption and passcode, which is why a passcode on your phone matters. Deleting the app removes it.
Optional Shared dreams
The following applies when you choose to enable Shared dreams. Existing reading links continue to behave as described below.
Shared dreams is an optional space for people aged 18 and over. Joining does not publish your journal. We store the date of birth you declare for eligibility, your chosen display name and optional handle, profile description, avatar and header choices, and any profile or cover photos you choose to upload. We keep dated acceptance and withdrawal records, including the policy versions and statements presented, your age declaration, and your privacy acknowledgement. Your birth date is never part of a social profile. Age declaration is not identity verification.
New shares contain only the title, recap and cards you review before sharing. They do not include your original journal entry, private memory, or personal interpretation. Editing your journal does not change a shared version; updating that version is a separate action. You may choose specific Dreamia accounts or anyone holding the link. A newly created “Anyone with this link” share can be read without an account only after the author separately acknowledges guest access and messaging-preview retention. We record that acknowledgement, its notice version and its time. Guest readers see the reviewed title, recap, chosen cards and the author’s sharing name/handle, not private journal content or conversations. Guest reading does not verify a reader’s age. Existing account-restricted links keep that boundary; an author creates a new guest share to change it. Selected-person shares require the selected account. Eligible adult account holders may read an authorised restricted share without turning on social participation.
We store your chosen recipients, saved-share references, reactions, replies, blocks and reports to provide these features. Replies are private between the author and each recipient by default. An author can instead explicitly create a group conversation with two to four selected recipients, plus the author. Group members can see each other’s identities and the group’s shared reply history while they have access. A group does not expose earlier private replies; changing from private replies to a group or adding members after publication requires a new share. Leaving a group or being removed stops future access through Dreamia, but does not recall messages or images other members have already copied. Your profile can be found by exact handle by other participants when your profile audience permits it and neither account has blocked the other. You can choose profile, photo and cover audiences: eligible participants, people with an active sharing connection, or only you. Photos and covers default to people you share with. They are stored privately and downloaded only after an account and audience check; choosing “eligible participants” does not publish a photo on the open web. The profile audience also limits photo access. A display name or handle may still appear beside a dream or reply someone is authorised to see. Received dreams and replies are not added to your private journal or Mia’s personal memory.
Replying or reacting to a link share also keeps a reference in your Shared dreams so that later replies can reopen it. Joining from a shared link can keep the same reference. This does not copy the dream into your journal or prevent the author from revoking access.
In-app notifications tell you about authorised replies and reactions. We store the recipient, actor, publication/comment references, reaction emoji where applicable, creation time and read time. Notifications are visible only while access remains permitted, expire from the activity list after 90 days, and are removed by scheduled cleanup. Associated account, post or comment deletion can remove them sooner, and turning off Shared dreams removes notifications to or from that account. These in-app notices do not subscribe you to email. You can separately choose device alerts for replies and reactions and control that permission in your device settings. iPhone alerts are delivered through Apple Push Notification service and use a generic activity message, without dream titles, reply text or the other person’s identity. Delivery is not guaranteed.
Uploaded photos are processed on your device into resized JPEG images before upload. You can replace or remove them. Restricting an audience stops future authorised downloads; it cannot erase images already copied or captured by another person.
You can revoke a share, remove selected recipients, or turn off Shared dreams. Turning it off hides your profile, withdraws your shares, and removes your saved shares, follows and contributions. Protective blocks and eligibility records remain with your account, along with consent history and stored profile choices/photos. Photos are hidden from other participants while sharing is off. Re-enabling does not restore withdrawn shares. Revocation stops future access through Dreamia; it cannot remove screenshots, exported images, or text someone already copied. Messaging and preview services can also cache the title and link preview of an explicitly guest-readable share after revocation. Account-restricted, legacy and unavailable links use a generic Dreamia preview; their private dream titles are not included in that metadata.
Earlier reading links may include the interpretation approved under the old sharing flow. Their preview can be viewed without an account, and any signed-in holder can read the shared interpretation. You can still copy or revoke these links, but cannot silently refresh them with new journal content.
Reports are available only to authorised administrators for handling safety, privacy and abuse concerns. A report includes the reviewed shared version as it appeared when reported, so later edits do not replace that evidence. Reports are removed when the associated social post or reporting account is deleted. Public discovery and following are not enabled in this release. Private journal content is not used for community trends.
We record content-free social activity, such as joining or leaving, publishing or revoking a share, authorised reads, saves, reactions and replies, to understand use and return visits. Records contain account identifiers, an event type, dates and, where relevant, a publication identifier; they do not contain dream text, reply text, email, birth date or share tokens. They are account-linked, not anonymous. The retention window is 90 days, with older records removed by scheduled cleanup; account deletion removes that account’s events. Turning sharing off or resetting the journal does not immediately erase this activity history.
Safety reviewers must give a reason to open report evidence or take a moderation action. We retain audit records of the reviewer, reason, decision, time and relevant state. Deleting an account removes its social consent history, restrictions and moderation retry records, and clears the audit record’s direct account reference. Decision records and staff-written notes remain; this is not a promise that every note is anonymous. Reviewers should not copy journal or report content into these notes. Temporary moderation retry records also have a 90-day cleanup window.
How long we keep it
- Your journal — until you delete it, or until you delete your account.
- Reset Dreamia — available in Profile. This permanently removes your entries, readings, memory, cards, patterns, people and shared links from your account. It clears each signed-in device when it next syncs, while keeping your login, personal details and plan. A reset also clears social posts, replies, reactions, reports and received/saved references; your social identity and uploaded profile media, follows, protective blocks, consent history, restrictions and anti-abuse counters will remain with your account. Content-free social activity remains subject to its retention window.
- Your account — deleting it in Profile removes your entries, memory, collection and profile immediately and permanently. It also removes uploaded social profile and cover photos. It is not recoverable, and we do not keep a shadow copy of your journal. The limited billing and moderation audit records described here are separate exceptions.
- Billing records — retained as long as Canadian tax law requires, separately from your journal.
Deleting your Dreamia account does not cancel an Apple subscription. Only Apple can do that, in Settings → your name → Subscriptions. The app links you there before deletion.
Your rights
Wherever you live, you can ask us to show you what we hold, correct it, export it, or delete it. Write to hello@getdreamia.com and we will respond within 30 days.
Under Canadian law (PIPEDA) you may also complain to the Office of the Privacy Commissioner of Canada. In the EEA or UK you have the rights granted by the GDPR, including the right to complain to your local supervisory authority; our lawful basis is the contract between us for the account itself, and your consent for the AI processing that produces a reading. In California, you have the rights granted by the CCPA. We do not sell or share personal information as those laws define it.
Children
Dreamia is not for anyone under 13, and we do not knowingly collect information from them. If you believe a child has created an account, write to us and we will delete it.
Where your data lives
Our database is hosted by Supabase, and our AI providers operate in the United States. Using Dreamia means your information is processed outside Canada, including in the United States, where it may be subject to the laws of those countries.
Security
Access to your journal is enforced at the database level, so one account cannot read another's entries even if the app is modified. Traffic is encrypted in transit and the hosted database is encrypted at rest. AI provider keys are held server-side and never shipped in the app. Journal text must be processed by our servers and the AI provider when you request a reading or use Mia, so Dreamia is not end-to-end encrypted. No system is perfect, and we will tell you promptly if a breach affects you.
Changes
If this policy changes materially, we will say so in the app before the change takes effect. The date at the top always reflects the current version.