Privacy Policy

1. Using Dream Memos without an account

You do not need an account to get a reading. When you visit, your browser creates a random device identifier and stores it locally. It is a random string, not a fingerprint: it is not derived from your hardware, your fonts, or your screen size, and it cannot be used to recognise you on any other website. We use it for one purpose — so that a reading you generate is later attached to the right journal. If you clear your browser storage, it is gone and we cannot recover it.

2. What we collect

3. Where your dream text goes

To produce a reading, the text of your dream is sent to the third-party AI model provider that powers Dream Memos. It is also sent to a second, separate model call that screens for content we do not allow. That is the only way the service can work: there is no offline mode.

We do not sell your dreams, we do not publish them unless you explicitly ask us to, and we do not use them to train our own models. The provider's handling of data is governed by its own terms, which we do not control.

When account email is enabled, we use Resend as our primary email provider and Brevo as a backup for verification and password reset messages. The provider handling a message receives your email address and that message, including its short-lived action link. We do not include dream entries, journal content, your password or payment details in these emails.

4. Publishing to the Dream Plaza

Dream Plaza is optional and always starts off. Nothing you write appears there until you press the publish button, and when you do, the dream text you see in the preview becomes public along with the nickname you chose. Anonymous users are shown as an anonymous dreamer. You can unpublish or delete a post at any time, and we remove reported posts that break the rules.

5. Cookies and local storage

We set the following, and nothing else:

Online matching games use a separate first-party cookie, dream_match, to keep a guest game attached to the same browser for up to 24 hours. It is HttpOnly and is not an advertising or cross-site tracking cookie.

We do not run third-party analytics or advertising trackers on this site today.

6. Advertising

Dream Memos is free, and we intend to keep it that way by showing ads. If advertising is enabled, it is served by Google AdSense, which may set its own cookies and use your visit to this and other sites to choose which ads to show. You can review and change how Google personalises ads in your Google Ads settings, and you can opt out of third-party cookies in your browser at any time. We never send the text of your dreams to an advertising network.

7. Children

Dream Memos is not intended for children under 13, and we do not knowingly collect their personal information.

8. Your choices and your rights

9. How long we keep things

Your readings, journal entries, reports and images stay until you delete them. We remove rate-limit records, login attempts, content-check records, reports of abuse and AI call metadata after 30 days; administrator action logs after 90 days; and session records when they expire. Email verification and password reset links expire after 30 minutes; we store only hashed tokens and remove them after use or expiry. Recovery request records are removed after 30 days. Recipient-free email quota metadata is removed after 35 days. Content checks keep a verdict and a fingerprint, rather than an extra copy of your dream or image. A reserved usage record may remain until its unfinished image job is settled. Cleanup runs at startup and every 30 minutes by default while the service is running.

Financial records follow separate refund, dispute, tax and accounting requirements. When you delete your account, we remove its direct link from local order and payment rows, while keeping the transaction references needed for those purposes. Those references can still be linked to you by the payment provider, so these records are not fully anonymous. Backups expire after 14 days. A deleted file can remain in a protected backup until that backup expires. For 30 days we keep encrypted deletion instructions containing record identifiers and timestamps, not dream text or image bytes. Our recovery process replays the current instructions before restored data can be used. Minimal task-version markers also expire after 30 days once no associated task is active.

10. Payments

When you buy a Pro pass or an image credit pack, the checkout runs inside the payment provider's own page, not ours. Waffo acts as merchant of record: it takes the card, issues the receipt and handles tax. Your card number never reaches our server — we could not store it if we wanted to, because we only ever receive an order reference and a "paid" or "refunded" status. What we do store is the order: the product, the amount, the references, and which account it belongs to. That record is what lets us grant what you bought, and refund it if you ask.

11. Security

Traffic is encrypted in transit, passwords are stored only as one-way hashes, and the database is not exposed to the internet. No system is perfect, so we will not claim otherwise — but we do not hold payment card details at all, which removes the most valuable thing there is to steal.

12. Changes to this policy

When this policy changes, the date at the top changes with it. If a change is significant, we will say so on the site rather than quietly editing this page.

13. AI-generated content and images

Readings, dream reports and any follow-up answers on Dream Memos are produced by an AI model, not by a human reader — they are marked on screen and should be read as generated text. If you buy dream image credits, the dream you choose is turned into a visual description and sent to an image-generation model; the resulting image is generated by AI and is stored on our server so that it stays available to you. Generated images are never posted anywhere public unless you choose to share them. Nothing here is a prediction, a diagnosis, or a statement of fact about your future.

14. Contact