Legal

Privacy Policy

How personal information is collected, used, stored, protected, shared, and deleted when you use Dreamote.

Version: 1.1
Status: Final
Effective date: October 26, 2026
Last updated: October 26, 2026

On this page

1. Introduction

Dreamote ("Dreamote", "we", "us", or "our") is a personal dream journaling application that helps users record, organize, explore, and reflect on their dreams.

We understand that dream journals may contain highly personal information. Privacy, data security, transparency, and user control are fundamental principles of Dreamote.

This Privacy Policy explains how personal information is collected, used, stored, protected, shared, and deleted when you use the Dreamote mobile application, our website at https://dreamote.me, and related services (collectively, the "Service").

Data Controller

Dreamote is operated by Tetiana Lytvynenko (LYTVYNENKO TETIANA), a sole proprietor (FOP) registered in Ukraine.

For privacy-related questions and requests, contact [email protected].

2. Age Requirements

Dreamote is intended for individuals aged 16 and older.

Individuals under 16 are not permitted to create an account or use the Service.

During mobile registration, users are informed of the minimum age requirement and must actively confirm that they are at least 16 years old through a mandatory confirmation that is not pre-selected.

Dreamote does not independently verify users' ages or require identity documents for age verification.

We do not knowingly collect personal information from individuals under 16.

If we become aware that an account belongs to someone under 16, we will take appropriate steps to restrict access or delete the account and associated personal information, subject to applicable legal requirements.

If you believe that a person under 16 is using Dreamote, please contact [email protected].

3. Information We Process

The personal information we process depends on how you use the Service and which optional features you choose to enable.

3.1 Account Information

When you create or manage an account, we process information that may include:

Email address;
Display name, if provided;
Unique account identifier;
Authentication and session information;
Preferred language and time zone;
Account creation and update timestamps;
Account status;
Subscription and feature entitlement information.

Authentication is provided using Supabase.

Passwords are handled by the authentication provider. Dreamote does not need to store or access plaintext account passwords to provide journaling functionality.

3.2 Dream Journal Information

Information you choose to record in your journal may include:

Dream titles and descriptions;
Dream dates and entry timestamps;
Emotions, tags, and labels;
Characters, people, places, and other dream-related entities;
Sleep-related factors;
Personal notes and contextual information;
User-edited structured dream information;
AI-generated suggestions and reflections that you choose to retain.

Dream entries may contain intimate or sensitive information, including details about relationships, beliefs, health, personal experiences, or other aspects of your life.

Dreamote does not require you to include such information. You decide what to record.

3.3 Voice Recordings and Transcriptions

If you use voice transcription, the application processes audio recorded through your device microphone.

Audio is sent to OpenAI for speech-to-text processing after you choose to use the feature and provide the relevant permission.

Dreamote does not use voice recordings for advertising or voice identification.

The Service does not maintain a permanent application database of submitted transcription audio. Temporary processing information and technical request records may be retained for limited periods as described in Section 8.

Any transcribed text that you choose to save becomes part of your journal and is handled according to the applicable journal storage settings.

3.4 AI Processing Information

Depending on the optional AI feature requested, Dreamote may process:

Audio submitted for transcription;
Individual dream text submitted for analysis;
Selected journal entries used to generate reflections;
Dream-related themes and structured metadata;
Emotions, tags, characters, and places;
Language and processing preferences;
AI-generated responses;
Technical request identifiers, timestamps, usage status, and quota records.

The specific information sent to OpenAI depends on the selected feature.

We do not automatically transmit your entire dream journal to OpenAI merely because you have created an account or enabled cloud synchronization.

3.5 Support Information

If you contact Dreamote support or submit a bug report, we may process:

Your message and email address;
Application version;
Operating system and device platform;
Technical error or reference identifiers;
Information you voluntarily include in your correspondence.

Please do not include passwords, payment card details, or unnecessary sensitive dream content in support requests.

3.6 Technical and Security Information

To operate and protect the Service, we may process limited technical information, including:

Authentication and session identifiers;
Request timestamps;
Error and response codes;
Synchronization status and revision information;
Application version and platform;
AI request and subscription usage records;
Network information and security-related logs processed by infrastructure providers.

Dreamote does not use third-party advertising trackers to create behavioral advertising profiles or sell personal information for targeted advertising.

4. Purposes and Legal Bases for Processing

We process personal information for specific purposes.

Where the General Data Protection Regulation (GDPR) applies, the principal purposes and legal bases are:

Purposes and legal bases for processing
Purpose	Legal basis
Account registration, authentication, journal functionality, and user-requested storage	Performance of a contract
Optional cloud synchronization requested by the user	Performance of a contract; consent where required
Optional AI transcription, dream analysis, and reflections	Consent, including explicit consent where required for sensitive information
Future aggregated dream statistics based on predefined shared categories	Consent where required, including explicit consent for special-category data where applicable; otherwise another valid legal basis established before activation
Premium subscriptions, entitlements, and usage limits	Performance of a contract
Customer support and handling user requests	Performance of a contract or legitimate interests, depending on the request
Fraud prevention, service security, technical reliability, and abuse prevention	Legitimate interests in protecting the Service and its users
Compliance with tax, accounting, or other applicable legal obligations	Legal obligation
Processing necessary to establish, exercise, or defend legal claims	Legitimate interests or another applicable legal basis

Our legitimate interests include maintaining service integrity, protecting accounts, resolving technical issues, and preventing misuse. We consider applicable privacy rights when relying on these interests.

Dream journal information may reveal special categories of personal data under applicable law. Where processing such information requires an additional legal condition, we rely on an applicable condition, including explicit consent where required.

You may withdraw consent for optional processing through available controls or by contacting us.

Withdrawing consent does not affect processing that was lawful before withdrawal. It may make the corresponding optional feature unavailable.

5. Local Storage, Encryption, and Cloud Synchronization

5.1 Local-First Design

Dreamote is designed around local storage.

Journal information is stored in a local database on your device.

Core journaling functions, including creating and editing dream entries, searching, and reviewing statistics, can operate without sending dream content to an external AI provider.

Certain features may require an internet connection, including authentication, cloud synchronization, subscription validation, and AI processing.

5.2 Optional Cloud Synchronization

Cloud synchronization is optional.

When enabled, synchronization transfers journal information between the device and our cloud infrastructure.

Dreamote uses encryption mechanisms designed to protect synchronized journal content and related metadata, including dream-related tags, emotions, factors, and entities.

Cloud storage and synchronization infrastructure are provided through Supabase.

Cloud synchronization may also require processing account identifiers, synchronization metadata, revision information, timestamps, and other technical records.

Not all technical metadata is necessarily encrypted in the same way as journal content.

Enabling Cloud Sync does not by itself guarantee that you can fully recover your journal on a new or replacement device. Recovery depends on the availability of the relevant keys, account access, and a working synchronization path. Dreamote does not currently represent new-device Cloud Sync recovery as end-to-end verified.

5.3 Encryption Limitations

We use encryption and access-control measures to protect journal information.

However, we do not describe our synchronization architecture as end-to-end encrypted.

Local journal data on the device is protected using a local encryption key (LEK) that is bound to the device and is not exported with journal files.

If the LEK becomes unavailable — for example because the application data is cleared, the application is reinstalled or uninstalled without a usable recovery path, the device is lost or reset, or the key material is otherwise destroyed — locally stored dream journal information on that device may become permanently unreadable.

Cloud Sync does not automatically guarantee complete recovery of your journal on a replacement device. Dreamote does not promise that journal content can be recovered on a new device solely from cloud synchronization where the necessary keys or a verified recovery path are unavailable.

Depending on the feature and operational requirements, certain information may be processed by authorized server-side components or external processors.

When you explicitly request an AI feature, the relevant information is made available for processing by the selected AI provider.

5.4 Cloud Data Location

Our primary production Supabase database is hosted in the West EU (Ireland) region.

This does not mean that every processing activity, infrastructure component, or service provider operates exclusively within Ireland or the European Union.

International processing is described in Section 11.

5.5 Aggregated Dream Statistics

Dreamote may introduce global statistics showing broad patterns across users’ dreams. If this feature is activated, statistical processing will be limited to structured associations between dream entries and predefined, shared catalog categories, such as emotions, places, characters, and sleep-related factors.

For example, Dreamote may calculate how often a predefined emotion is associated with dreams or how shared sleep-related factors correlate with predefined dream categories.

Dream titles, narrative descriptions, personal notes, audio recordings, transcriptions, and free-text journal content will not be used to produce global statistics. User-created names, custom tags, and other free-text categories will not be included unless a separate privacy assessment and appropriate notice and permissions are provided.

The underlying associations between a dream, a category, and an account may constitute personal information even when dream text is excluded. Dreamote will not treat the removal of direct identifiers alone as sufficient anonymization.

Public global statistics will contain only aggregated results, without account identifiers, individual dream identifiers, individual users’ category histories, or identifiable dream-to-category associations. Before publication, we will apply safeguards against re-identification, including restrictions on small groups and rare combinations.

If collecting or deriving these statistics requires processing personal information, Dreamote will establish the appropriate legal basis and provide any required notice and consent before activating the processing. Optional consent-based statistical processing will not be a condition of using the core dream journal.

This future statistical feature is separate from optional AI processing. Global statistical calculations will not require sending dream narratives to OpenAI.

We may retain genuinely anonymized aggregate statistics after individual account deletion where they can no longer reasonably be linked to an identifiable person. Personal-level statistical source records, if created, will be subject to the applicable deletion and retention procedures.

6. Optional Artificial Intelligence Features

Dreamote offers three distinct optional AI-powered features using OpenAI.

You can use the core dream journal without using these features.

Each feature has its own explanation of the information being processed, and the relevant user permission or consent is obtained before submission where required.

6.1 Voice Transcription

Voice transcription allows you to convert spoken descriptions of dreams into written text.

When you activate this feature:

Your device microphone is used with the appropriate operating-system permission;
Audio you choose to record is sent to OpenAI;
OpenAI processes the audio to generate a transcription;
The resulting text is returned to Dreamote for your review and possible inclusion in a journal entry.

Voice transcription is voluntary and can be avoided by entering dreams manually.

6.2 Dream Analysis

Dream Analysis provides optional AI-generated suggestions for an individual dream.

When you request analysis, Dreamote sends the selected dream text and relevant processing context to OpenAI.

Suggestions may include:

Dream titles;
Emotions and themes;
Tags and labels;
Characters and places;
Other structured dream-related information.

You can review the suggestions before choosing how to use them.

AI-generated content may be inaccurate or incomplete.

6.3 Dream Reflections

Dream Reflections provides optional insights about patterns across selected journal information.

When you request a reflection, Dreamote may use up to 30 eligible dream entries, subject to the feature's processing rules.

Information sent for reflection processing may include selected dream content and structured information about recurring themes, emotions, characters, places, and tags.

The complete journal is not automatically transmitted as one dataset for every reflection request.

The resulting reflection is intended for personal exploration and self-reflection.

It does not constitute a medical diagnosis, psychological assessment, therapeutic recommendation, or professional advice.

6.4 OpenAI Data Handling

Dreamote uses OpenAI's API to provide these optional features.

Our OpenAI API organization is configured not to opt in to the use of API inputs, outputs, feedback, or related data for training or improving OpenAI models.

For dream analysis and reflection requests using the Responses API, Dreamote uses store: false.

This setting does not mean that OpenAI has no temporary access to submitted information or that all provider-side retention is disabled.

OpenAI may process and temporarily retain information for security, abuse prevention, legal compliance, or other purposes permitted under its applicable API policies.

Dreamote does not represent that its API integration operates under a Zero Data Retention arrangement.

The information submitted for an AI request is limited according to the purpose of the selected feature.

Voice Transcription, Dream Analysis, and Dream Reflections are separate optional features.

Dreamote provides feature-specific privacy disclosures and consent controls where required.

Declining an optional AI feature does not prevent you from using the core journal.

Previously saved AI-generated information remains part of your journal until you edit or delete it, subject to the applicable storage and account deletion procedures.

8. Data Retention

We retain personal information only as long as reasonably necessary for the relevant purpose, subject to applicable legal requirements and the retention practices described below.

8.1 Account Information

Account information is generally retained while the account remains active.

When an account is deleted, associated account information is removed from active systems through the account deletion procedure, subject to limited exceptions described below.

8.2 Journal Data

Local journal information remains on your device until you remove it, delete the account and complete the applicable local cleanup process, or otherwise clear the application data.

Encrypted synchronized journal information is retained in active cloud systems while needed for the synchronization service.

When you delete relevant journal information or your account, applicable active cloud records are removed according to the deletion procedures.

8.3 Voice Transcription

Temporary transcription text is subject to automated cleanup designed to remove it after approximately 15 minutes.

Associated technical transcription request records are generally scheduled for deletion after two days.

Cleanup depends on successful execution of the applicable maintenance procedures. These time periods describe the application's operational retention targets and do not determine the separate retention practices of OpenAI.

8.4 AI Request and Usage Records

Technical records associated with AI requests, request status, quotas, and operational reliability are retained temporarily according to the applicable maintenance schedules.

These records are limited to information necessary for their operational purposes.

AI-generated information saved in your journal remains available until you edit or delete it, including after a Premium subscription expires, unless another applicable retention or deletion rule requires its removal.

8.5 Support Correspondence

We generally retain support correspondence for no longer than 90 days after the matter is closed, unless longer retention is necessary for legal, security, dispute-resolution, or other legitimate purposes.

Copies may temporarily remain within email delivery systems or mailboxes according to the providers' retention practices.

8.6 Account Deletion Records

Limited records relating to account deletion may be retained temporarily to confirm processing, prevent duplicate deletion attempts, investigate errors, and maintain security.

These records are not intended to preserve the deleted user's dream journal.

8.7 Backups and Provider Records

Deletion from active systems may not immediately remove all copies from backups, security logs, or third-party systems.

Such information may remain temporarily under applicable backup rotation, security retention, legal obligations, or provider policies.

Where information is retained after account deletion, we restrict its use to the applicable purpose and do not treat it as an active dream journal.

9. Account and Data Deletion

9.1 How to Delete Your Account

You can delete your Dreamote account through:

The Dreamote mobile application, using the account settings;
The website at https://dreamote.me/delete-account.

Open the account deletion page

Account deletion requires identity verification and may require recent password authentication and additional authentication factors.

9.2 What Happens When an Account Is Deleted

After successful server-side account deletion, Dreamote removes the account and associated information from active systems, including, as applicable:

The authentication account;
The user profile;
Cloud-stored dream entries;
Synchronized journal content and encrypted metadata;
Associated tags, emotions, factors, and dream entities;
User-specific synchronization records;
Related subscription entitlement records stored in Dreamote systems;
Other account-scoped records subject to the deletion procedure.

Limited deletion records and information that must be retained for legitimate legal, security, or operational purposes may remain temporarily.

A deletion request is considered completed only after the server confirms the corresponding account deletion operation.

9.3 Local Information on Devices

When deletion is completed from the mobile application, the application performs the applicable local cleanup procedure.

When deletion is completed through the website, a device that was previously signed in may still contain locally stored account data until it detects and processes the deletion.

Dreamote uses local cleanup and recovery mechanisms designed to remove associated local journal information, encryption material, synchronization state, and cached account data after a remote account deletion is recognized.

When a device is offline, cleanup may be delayed until the application is reopened or connectivity is restored.

If the application is no longer available or automated cleanup cannot be completed, you may need to clear the application's local storage or uninstall the application according to your device's available controls.

9.4 Exported Files

Account deletion does not automatically remove journal files, images, JSON exports, or other copies that you have previously saved outside Dreamote.

You are responsible for managing those external copies.

Where Dreamote provides journal export, dream entries are exported as readable JSON (or similar structured plaintext). Exported dream files are not encrypted by Dreamote’s local encryption key.

The local encryption key (LEK), related data-encryption keys (DEK), and subscription or entitlement information are not included in ordinary journal exports. Anyone with access to an exported dream file can read its contents. You should store exported files securely.

Ordinary import and export restore or transfer journal content you choose to load from a supported export file. They are not a complete backup of all application data, account records, encryption keys, or subscription entitlements, and they do not substitute for Cloud Sync.

9.5 Subscriptions

Deleting your Dreamote account does not automatically cancel a subscription billed through Apple or Google.

You should cancel an active subscription through the relevant App Store or Google Play subscription management settings.

9.6 Deletion Assistance

If you experience difficulties deleting your account, contact [email protected].

We may ask you to verify your identity before processing a privacy-related request.

10. Data Security

We apply technical and organizational measures designed to protect personal information.

These measures include, where applicable:

Encrypted network connections;
Protected authentication and session management;
Database access-control policies;
Account-scoped authorization;
Encryption of local journal information using a device-bound key, and encryption mechanisms for synchronized journal content where Cloud Sync is enabled;
Restricted access to server-side credentials;
Additional identity verification before account deletion;
Secure handling of synchronization and account state;
Measures designed to prevent sensitive journal information from appearing in diagnostic logs;
Procedures for handling technical failures and incomplete deletion operations.

Access to personal information is limited according to operational responsibilities and technical controls.

No electronic storage or transmission system can guarantee absolute security.

Users should take reasonable measures to protect their devices, passwords, accounts, and externally exported journal files.

11. International Data Transfers

Dreamote is operated from Ukraine and uses service providers that may process personal information in different jurisdictions.

Our primary production database is hosted in Ireland.

However, account services, website hosting, AI processing, subscription management, email delivery, security operations, and other infrastructure activities may involve processing outside Ukraine or the European Economic Area.

Where required by applicable data protection law, international transfers are carried out using appropriate legal mechanisms and safeguards, which may include adequacy decisions or approved contractual protections.

You may contact [email protected] to request further information about safeguards applicable to your data.

12. Your Privacy Rights

Depending on your location and applicable law, you may have rights to:

Access personal information held about you;
Correct inaccurate or incomplete information;
Request deletion of personal information;
Receive eligible personal information in a portable format;
Restrict certain processing;
Object to certain processing;
Withdraw consent where consent is the applicable legal basis;
Lodge a complaint with a competent data protection authority.

Dreamote provides features to edit, delete, and export journal entries (including plaintext JSON dream export where available).

The journal export feature may not include every category of account-related or technical information held by the Service or its providers.

Requests for additional personal information may be submitted to [email protected].

We may need to verify your identity before responding.

Where the GDPR applies, we respond within the applicable statutory time limits, including any extensions permitted by law.

You may lodge a complaint with a competent supervisory authority, including the authority responsible for your country of habitual residence, place of work, or the location of an alleged infringement where applicable.

We do not use AI-generated dream reflections to make decisions that produce legal or similarly significant effects concerning users.

13. Children's Privacy

Dreamote is not intended for children under 16.

During mobile account registration, users must actively confirm that they meet the minimum age requirement through a mandatory confirmation that is not pre-selected.

We rely on this confirmation and do not independently verify users' ages.

If we learn that a person under 16 has registered or provided personal information, we will take appropriate steps in accordance with applicable law.

Parents or guardians may contact [email protected] regarding concerns about a child's personal information.

14. Changes to This Privacy Policy

We may update this Privacy Policy when our features, service providers, technical architecture, legal obligations, or information processing practices change.

The current version is available at https://dreamote.me/privacy.

When we update the Policy, we will revise the "Last Updated" date.

Where required by applicable law, we will provide additional notice or obtain consent before introducing material changes to relevant processing activities.

Continued use of the Service does not replace any consent that is legally required.

15. Contact Us

For questions, privacy requests, concerns about personal information, or inquiries regarding this Privacy Policy:

Dreamote

Data Controller: Tetiana Lytvynenko (LYTVYNENKO TETIANA)

Legal Status: Sole proprietor (FOP), Ukraine

Privacy Email: [email protected]

Website: https://dreamote.me

We aim to handle privacy requests transparently and in accordance with applicable data protection law.