Privacy Policy

Protecting your personal data matters to us. We process data solely within the bounds of the law (GDPR, German BDSG). This statement explains the nature, scope and purpose of our processing and your rights.

1. Controller

The controller responsible for data processing on this website is:

For any data protection questions you can reach us at the email address above. We have not appointed an external data protection officer, as there is no legal obligation to do so.

2. Account and usage data

On registration and use we process: email address, password (only as a cryptographic hash, never in plain text), and optionally name, year of birth and preferred language. The purpose is providing your account and performing the contract. The legal basis is Art. 6 (1) (b) GDPR (contract).

3. Dream content and analyses

The dream texts you enter and the analyses generated from them are stored linked to your account. By their nature, dream texts may touch upon special categories of personal data within the meaning of Art. 9 GDPR (e.g. indications of health or beliefs). This processing is carried out solely on the basis of your explicit consent (Art. 9 (2) (a) in conjunction with Art. 6 (1) (a) GDPR), which you give during registration and can withdraw at any time with effect for the future.

Dream texts and analyses are stored encrypted in our database (AES-256-GCM). You can delete individual dreams in your account at any time.

4. AI-assisted analysis

To produce the analysis, the dream text is transmitted to a specialised AI service provider that processes the analysis on our behalf. The transfer is based on your consent (Art. 6 (1) (a), Art. 9 (2) (a) GDPR). Processing may also take place via service providers outside the European Union; in that case we ensure an adequate level of protection through appropriate safeguards (in particular EU standard contractual clauses) or base the transfer on your explicit consent pursuant to Art. 49 (1) (a) GDPR.

The analysis serves self-reflection only. There is no automated decision-making producing legal effects or similarly significant effects within the meaning of Art. 22 GDPR.

5. Payment processing

For paid subscriptions we use the payment provider Stripe (Stripe Payments Europe Ltd.). Your payment details (e.g. card or bank data) are processed directly by Stripe; we ourselves do not receive full payment-instrument data, only information about the status of your subscription. The legal basis is Art. 6 (1) (b) GDPR. Stripe's privacy notices apply in addition.

6. Hosting and server logs

Our application is operated by a hosting provider with servers in Germany, processing data as a processor on our behalf. On access the server collects technically necessary data (e.g. time of access); IP addresses are stored solely in pseudonymised (hashed) form for abuse and limit control. The legal basis is our legitimate interest in secure, stable operation (Art. 6 (1) (f) GDPR).

7. Cookies

We use strictly necessary cookies only: a session cookie for sign-in and a cookie to protect against cross-site request forgery (CSRF). These are required for operation (§ 25 (2) German TDDDG) and do not require consent. We currently do not use tracking or analytics cookies.

8. Email

To manage your account we send transactional emails, e.g. for password resets, to welcome you after subscribing and to confirm a requested withdrawal. The legal basis is Art. 6 (1) (b) GDPR.

For confirmed withdrawals, we receive an internal notification with the details required for manual review and reimbursement, in particular name, email address, plan and Stripe references. The legal basis is contract processing and compliance with legal obligations.

9. Retention period

We store your data for as long as your account exists. If you delete your account, the associated account and dream data are deleted, unless statutory retention obligations (e.g. commercial and tax retention periods for invoice data) require otherwise.

10. Your rights

Under the GDPR you have the following rights:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR)
• Withdrawal of given consent with effect for the future (Art. 7 (3) GDPR)

To exercise these rights, an informal message to the email address above is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI).

11. Minors

Our service is not directed at children. Persons under 16 should not submit personal data without the consent of a parent or guardian.

12. Changes

We update this privacy policy when the legal situation or our service changes. The version published here at the relevant time applies.

As of: June 2026