SOULDREAM

SoulDream Privacy Policy

Effective date: [launch date]

Your dreams are private, and we treat them that way. This policy explains what we collect, how we use it, and the rights you have.

Because a dream's content can reveal information about your emotional or mental state, we treat your dream text and emotion data as sensitive personal data and process it only with your explicit consent.

1. Information We Collect

  • Dream content: the dream text and dates you record, and the AI-generated interpretations, emotions, and theme tags
  • Guest account identifier: a pseudonymous account identifier randomly generated by Firebase (it contains no name or email, but does distinguish one account from another); if you choose to link an email, Google, or Apple account, we collect your email address solely for account identification and sign-in
  • Profile (optional): the nickname and avatar you choose to set, and the gender (male / female) and age range (16–24 / 25–39 / 40–59 / 60+) you may optionally provide, clearable at any time. If you enable cloud sync, these settings — except your avatar — are backed up to our cloud database as well (the avatar always stays on your device and is never uploaded)
  • Usage information: your Feather balance and usage records (for fair-use management)
  • Technical data: standard technical logs (such as IP address and request time) generated when your device contacts our servers, kept by our infrastructure provider for up to 180 days. If we add crash reporting or usage analytics in the future, we will update this policy first
  • Your communications with us: when you contact us by email, we process the email address and content you provide, solely to respond to and handle your request; correspondence is kept for up to 12 months after your request is resolved

Beyond what is expressly listed above, we do not collect: your real name, phone number, contacts, or precise location.

2. How We Use It

  • To generate your dream interpretations and analysis
  • To keep the service running and prevent abuse
  • To improve the product experience

We do not sell your personal information.

We do not use your dream content for ad serving or targeted advertising. Anonymous, aggregated statistics that identify no individual (for example, "30% of users dreamed of flying this month") are outside this restriction and may be used for product communication and research.

3. Where Your Dream Data Lives

Your dreams are stored primarily on your own device. When you use AI interpretation, the dream text is sent over an encrypted connection to our servers for processing; the finished interpretation, together with the scene summary described in Section 5, may be cached briefly on our servers (up to 30 minutes) so it can be recovered if your connection drops, and is then deleted automatically. If you have generated a dream painting, we additionally cache that generation record (the painting's download link, the model used, and that scene summary — never the dream text) for up to 24 hours, so that you can retrieve the same painting without being charged twice if you leave mid-way or the app is closed by the system. The generated painting itself is stored long-term in our cloud storage until you delete your data. ⚠️ The painting's access link carries a random token, so anyone who has the link can view that painting without signing in — this is what lets you share it, but it also means a leaked link is effectively public. Please share it with that in mind. If you enable cloud sync/backup (where available), your dreams are stored in our cloud database so they can be restored across devices (encrypted at rest by our infrastructure provider, with keys managed by them; we do not add a further application-level layer on top). Account and usage records, and (if enabled) cloud-synced dreams, are kept until you delete your data.

About on-device storage: dreams are held in a database file on your phone, protected by the operating system's own app sandbox, but we do not currently add a further layer of application-level encryption on top of that. If your device is unlocked and obtained by someone else, dream content could be read. Please set a lock screen passcode.

4. Third-Party Processing and Cross-Border Transfers

The dream text we send carries none of your name, email, or account identity, and is accompanied by the gender and age range you may optionally provide (used solely so the "you" in your dream paintings matches you).

⚠️ We do not rewrite the dream text itself: if you have written a real name, place, or other identifying detail into your dream, it is sent along with the text exactly as you wrote it. If you would rather certain details never leave your device, leave them out when recording — or simply never tap Interpret, in which case the dream never leaves your phone.

Interpretations are generated by third-party AI providers: OpenAI (GPT models) is used primarily, and DeepSeek is used when OpenAI is unavailable. The same providers also generate the scene summary described in Section 5.

  • OpenAI: under its current API policy, content submitted through the API is not used to train its models by default; request records are retained for up to 30 days for abuse monitoring and then deleted. Data is stored in the United States.
  • DeepSeek: its privacy policy (which governs its API) permits using content to "train and improve our technology, such as our machine learning models", and offers a training opt-out on request. We therefore cannot guarantee, for content processed by DeepSeek, that it will not be used to improve their models. Data is stored in China.

Both providers may retain request records to provide the service and for security review, abuse prevention, and legal compliance; specific retention periods and handling are governed by the privacy terms applicable to their API services. Because these providers are located outside your country, the laws protecting your data there may differ from those where you live. We also use Google Firebase (authentication, cloud functions, database). Maintaining the theme vocabulary: when the AI proposes a theme word for your dream that is not yet in our standard vocabulary, that word alone (a few characters, for example "monk" — carrying no dream content and no account identifier) is sent to OpenRouter (United States) to compute a word embedding and to DeepSeek to propose a standard form, so the shared vocabulary can grow for everyone. Before your first AI interpretation, we ask for your explicit consent separately in the app; AI interpretation only ever happens when you tap for it — you can simply record and never tap. ("Record-only mode" under Me is a writing preference: with it on, finishing a dream saves it straight to your journal instead of taking you to the interpretation screen; it does not change the rule above.)

5. Share-Image Generation

When the scene summary is generated. So that share-image generation does not keep you waiting, we generate a one-sentence scene summary at the time you request an AI interpretation. It is processed by the same AI providers described in Section 4, which means the dream text is sent once more for this purpose (a request separate from the interpretation itself). If a dream has no summary ready — for example because it was interpreted before this feature existed, or because you later changed your gender or age range — we generate one at the moment you tap Create share image, and the dream text is sent again then. The resulting summary is stored on your device, and backed up along with the dream if you have enabled cloud sync. If you never use AI interpretation, no scene summary is generated.

How the image is made. When you generate a share image, we send only that dream's emotions, theme tags, and that de-identified scene summary (never the dream text itself, and never your identity) to an image-generation provider for processing. If you have provided a gender or age range, the figure representing "you" in the scene summary is drawn accordingly — only ever as a figure seen from behind, with no other identifying information.

Image-generation providers. We try the following in order: first, through OpenRouter (United States) to an image model from Black Forest Labs (Germany); if that model refuses or is unavailable, Replicate (United States) running the Qwen image model developed by Alibaba; and if that is also unavailable, back through OpenRouter to an image model from Google (United States).

The level of protection differs by route, and we state it as it is:

  • The two routes through OpenRouter (Black Forest Labs, Google): we declare on every single request that we do not consent to the content being used for training. When a route cannot serve us because of that declaration, we let the generation fail rather than switch to a route with weaker protection. According to OpenRouter's policy labelling for these two routes, request records are deleted after at most 30 days (the Black Forest Labs route); the Google route retains nothing at all. (This is OpenRouter's labelling of that endpoint; we have not yet obtained written confirmation of how binding it is on the upstream providers.)
  • The Replicate route: Replicate publishes a per-model statement on its model pages that the model does not use inputs and outputs for training, and states that inputs and outputs of API predictions are deleted automatically after 1 hour. We rely on that published statement alone — unlike the two routes above, we cannot enforce it at the request level. The model was developed by Alibaba and is invoked through Replicate; we cannot independently verify how Replicate executes the model on its backend, and we therefore make no guarantee about where upstream processing takes place.

Because these providers are located outside your country, the laws protecting your data there may differ from those where you live.

6. Your Rights

  • Export: export all of your dreams at any time from the "Me" tab
  • Delete: delete all of your data in one step from the "Me" tab — your dreams, generated paintings and account records are removed from our cloud, and this is irreversible. This works whether or not you have linked an email account (guest accounts can delete their cloud data the same way) (interpretation and generation records still within their cache window are deleted automatically at expiry)
  • Three exceptions, stated plainly: (1) consent records (when you accepted which version of our terms) are retained as a compliance record required by law and are not removed on account deletion — they contain none of your dreams; (2) content feedback you chose to submit (including the dream attached to it, if you ticked that box) is retained for up to 24 months to handle and trace that report; (3) the deletion itself leaves a deletion record (account identifier and timestamp only, no content), removed automatically after 7 days
  • You may also contact us by email to exercise these rights
  • Depending on where you live, you may have additional rights (such as access, correction, objection, and lodging a complaint with your local data-protection authority) — contact us by email to exercise them

7. Data Security

All data is encrypted in transit (HTTPS); AI provider access keys are kept server-side only.

Data breach notification: if a personal-data breach occurs that is likely to cause you significant harm, we will notify the relevant authority as soon as practicable (and within 72 hours where required by applicable law), and notify affected users without undue delay.

8. Children's Privacy

SoulDream is not directed at anyone under 16. If we learn that we have collected such information in error, we will delete it promptly.

9. Changes to This Policy

If this policy changes materially, we will notify you in the app.

10. Website & Waitlist

Our website (souldream.app) uses no cookies, analytics, or tracking. If you join the launch waitlist, we use the email you provide only to notify you about the launch; you can ask us to remove it at any time.

11. Contact Us

SoulDream is operated by [legal entity / sole proprietor name], Malaysia.

📧 support@souldream.app

This policy is executed in English. Versions in other languages are provided for convenience only; in the event of any inconsistency, the English version prevails.