Privacy Policy | Dreamphase | GestaltMind Docs

GestaltMind LLC (“we”, “our”, or “us”) operates the Dreamphase mobile application. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our application.

Guest Mode vs. Account Mode

Guest Mode: Dreamphase can be used entirely offline without creating an account. In Guest Mode:

No email address, phone number, or sign-in required
No data transmitted to our servers
All features work locally on your device
AI-powered features are not available (require account)
No terms acceptance required for basic journaling

Account Mode: To use AI-powered features, you must create an account. This Privacy Policy applies to Account Mode usage where data is transmitted to our servers for authentication, subscriptions, and AI processing.

Two optional features can also move data off your device in either mode, and both are described below: AI features (only when you use them) and self-hosted sync (only if you set up your own server).

Privacy-First Design

Important: Dreamphase is designed with privacy as a core principle. Your dream journal entries, recordings, drawings, collections, and personal notes are stored locally on your device. We do not store your dream content on our servers, and we do not have access to it.

Your dream content leaves your device in only two cases: when you choose to use an AI feature (see AI Features and Third-Party Services), and when you choose to connect a sync server that you run yourself (see Optional Self-Hosted Sync).

Information We Collect (Account Mode Only)

Account Information

When you create an account, we collect minimal information through Supabase authentication:

Email address: Used to sign you in and identify your account. If you sign in with email, we send a one-time password (OTP) to that address
Google or Apple sign-in details: If you choose Sign in with Google or Sign in with Apple, Google or Apple gives Supabase an identity token for your account, which includes your email address. With Sign in with Apple you can choose Hide My Email, in which case we receive only the private relay address Apple creates. Apple may also share your name the first time you sign in, and we save it as the display name on your account
Display name: A name for your account, which can be the name you type in your Profile, the name Apple supplies the first time you sign in, or a name your sign-in provider shares. It is stored in your account profile with Supabase so it follows you across devices. If you do not set one, the app shows the first part of your email address instead
Phone number: Only if phone sign-in is offered in your version of the app and you choose it. Phone sign-in is not currently available in the app
Authentication tokens: Managed by Supabase for secure access
Terms acceptance records: When you accept the Terms of Service or this Privacy Policy, we record your account ID, which document and version you accepted, and when

We do not store passwords. Email sign-in uses one-time codes sent to your email. You choose which sign-in method to use.

SMS Consent: If phone sign-in is offered and you provide a phone number, you expressly consent to receive text messages containing OTP codes, sent through Twilio. You can switch to another sign-in method at any time to stop receiving SMS messages. Message and data rates may apply.

Server-Stored Data

Besides your account information, we store only the following on our servers (hosted by Supabase). None of it is dream content or health data:

AI usage metrics: Per-day counts and token totals linked to your account (they are tied to your account ID), plus a one-way hash of your email or phone number, used to prevent abuse of AI features and manage costs. These records never contain the text of your requests or the AI responses
Subscription records: Which platform (Apple or Google) and product you subscribed to, transaction identifiers, subscription status, and renewal and expiry dates. Receipts are stored only as one-way hashes. For Google Play subscriptions we also keep the purchase token Google issues, because we need it to check renewal and cancellation status with Google. We also keep the renewal, cancellation, and refund notifications that Apple and Google send us, with purchase tokens and receipts hashed or removed
Whitelist status: To manage beta access and feature rollouts
Account deletion requests: If you ask us to delete your account, a record of the request and its scheduled date (see Data Retention)
App-generated quotes: For motivational features (not user-created content)

We do not process or store payment card information. All payments are handled by the Apple App Store or Google Play Store.

Local Device Data

The following data is stored on your device and is never stored on our servers:

Dream journal entries and descriptions
Voice recordings
Drawings and sketches
Collections you create to organize your dreams (collections are never sent anywhere, not to AI services and not to a sync server)
Tags, categories, and metadata
Sleep and health data read from Apple Health or Health Connect
All user-created content

Some of this data is sent to third-party AI services when you use an AI feature, and some can be sent to a sync server you run yourself. See AI Features and Third-Party Services, Health Data, and Optional Self-Hosted Sync. Our servers do not store it.

Device Permissions

Dreamphase requests the following permissions on iOS and Android to provide functionality:

Microphone/Audio Recording: To create voice journal entries (stored locally)
Storage/Files: To save your dream entries and media on your device
Health Data: To read sleep, heart rate, and resting heart rate data from Apple Health (HealthKit) or Android Health Connect (optional). See Health Data
Biometric/Face ID/Touch ID: For secure app access using fingerprint, face unlock, or biometric authentication
Notifications: To send reminders for dream journaling
Alarms/Exact Alarms: For scheduled notifications at specific times

All permissions are optional except storage. You control what data the app can access through your device settings (Settings > Privacy on iOS, or App Settings on Android).

How We Use Your Information

We use the minimal data we collect to:

Authenticate your account (email one-time passwords, Sign in with Google, or Sign in with Apple)
Prevent abuse of AI features (which use our API credits)
Verify and manage subscriptions purchased through the App Store or Google Play
Provide AI-powered features through our accounts with Anthropic and OpenAI
Carry out account deletion requests

AI Features and Third-Party Services

Dreamphase offers AI-powered features that use third-party AI services. These features need an account and an internet connection. We ask for your permission in the app before your content is first sent to a third-party AI service. Nothing is sent to an AI service until you agree, and you can use Dreamphase without these features. The permission is asked for each kind of data (dream text and drawings, voice recordings, health summaries), and you can turn any of them off later in Settings under AI Interpretation. If you decline, nothing is sent.

When you use an AI feature, the app sends the request through our Supabase Edge Functions, which forward it to the AI provider. Our servers do not store the content of your requests or the responses. We do not log request content, and the only record we keep is the usage count described under Information We Collect. AI responses are returned directly to your device.

Dream Analysis and Related Features (Anthropic Claude)

The text of the dream you ask about is sent temporarily to Anthropic’s Claude API for processing. Depending on the feature, this can include the title, tags, the names of people you listed, and the dream signs you selected
This applies to dream insights, title suggestions, form autofill, and recurring-theme reports. A theme report sends the text and dates of your recent dreams, covering the period you are analyzing and the period before it
If you are a premium subscriber and attach a drawing to a dream insight request, the drawing image is sent to Claude as well
We do not store or log AI requests containing your dream content
Usage is tracked only to prevent abuse of our API quota

Health Insights (Anthropic Claude)

Health Insights is a premium feature. It runs only when you tap the button to generate an insight, and only after you have agreed to send this data to the AI provider
The app sends a summary of your last seven days of resting heart rate and sleep duration, the dates on which you recorded a dream, the total number of dreams you have recorded, and a few scores calculated on your device from your sleep and dream data. It does not send the text of your dreams
The summary is sent through our Edge Function to Anthropic’s Claude API. We do not store it on our servers; the only server-side record is the usage count
See Health Data for the commitments that apply to this data

Voice Transcription (OpenAI Whisper)

When you use the auto-transcription feature, your voice recording is temporarily sent to OpenAI’s Whisper API for speech-to-text conversion
Audio data is transmitted in base64-encoded format through our Supabase Edge Function
We do not store or retain your audio data on our servers after processing
The transcribed text is returned directly to your device
Voice transcription is a premium-only feature requiring an active account

Once your content reaches Anthropic or OpenAI, their privacy practices and retention policies apply. See their privacy policies linked under Third-Party Services. We use authentication to protect our API accounts from unauthorized use.

Health Data

Dreamphase can read sleep stages, heart rate, and resting heart rate from Apple Health (HealthKit) on iOS or Health Connect on Android, only after you grant permission. You can turn this off at any time in your device settings. Dreamphase uses this data to show how your sleep and heart rate relate to the dreams you journal.

Health data is read and processed on your device and is not stored on our servers
We do not use health data for advertising, and we do not sell it or share it with data brokers, advertising platforms, or information resellers
We do not use health data for marketing or to build profiles about you
Health data is shared with a third party only when you ask for Health Insights (a premium feature) and have agreed to it. In that case the summary described under AI Features and Third-Party Services is sent to Anthropic, solely to generate the insight you requested
Health data is not shared with anyone else, except where required by law

Optional Self-Hosted Sync

Dreamphase can sync your journal with a server that you run yourself. This feature is off by default. It does nothing until you enter your own server address and access token in Sync Settings.

When you turn it on, the app sends your dream entries, tags, locations, people, and AI insights to the server address you entered, and downloads them from it. Voice recordings and drawing files are not uploaded. Collections are not synced
That server is operated by you or by whoever you choose. It is not operated by GestaltMind, and we do not receive this data
How that data is stored and protected on your server is up to you or its operator. Our self-hosting guide explains how to run one
Sync does not send data to Anthropic, OpenAI, or any other third party

Data Storage and Security

We implement security measures to protect the minimal data we store:

Encrypted data transmission (SSL/TLS)
Supabase-managed authentication with industry-standard security
No dream content or personal journal entries stored on our servers
Local device storage uses your device’s native security features

Since your dream data stays on your device, we recommend:

Using device encryption and screen lock
Enabling biometric authentication in the app
Regularly backing up your device to prevent data loss

We do not sell or trade your personal information, and we do not share it for advertising. Limited sharing occurs only in these circumstances:

Supabase: Hosts our authentication, database, and Edge Functions
Google and Apple: If you use Sign in with Google or Sign in with Apple, they verify your identity and share your email address (or Apple’s private relay address) with us
Twilio: SMS delivery service that sends one-time passwords to your phone number (only if phone sign-in is offered and you choose it)
Anthropic: Dream analysis requests, and Health Insights summaries if you request them and have agreed, are processed through their Claude API (not stored by us)
OpenAI: Voice recordings are processed through their Whisper API for transcription (not stored by us)
Apple/Google: Subscription purchases are processed through the App Store or Play Store. We receive subscription status and transaction identifiers and notifications, not payment card information. To verify a purchase, our servers contact Apple or Google with the transaction identifier
Legal Requirements: When required by law or to protect rights and safety

Your Privacy Rights

You have the right to:

Access: Request a copy of the minimal data we store (email or phone number, display name, usage metrics, subscription records)
Deletion: Request deletion of your account and server-side data at any time from the app (see Data Retention)
Export: Your dream data is already on your device, back it up anytime
Control: Manage device permissions through your device settings
Authentication Method: Choose how you sign in: email one-time password, Sign in with Google, or Sign in with Apple

To exercise these rights or for questions, contact us at info@gestaltmind.dev.

Data Retention

Server-side data retention:

Email address, phone number, and authentication data: Retained while your account is active
Usage metrics: Retained while your account is active. When your account is deleted, they are disconnected from your account, and the remaining records, which include the one-way hash of your email or phone number, are removed after 90 days
Subscription records: Retained while your account is active to verify feature access
Terms acceptance records: Retained while your account is active

Account deletion: When you request account deletion in the app, your account is scheduled for deletion with a 30-day grace period. During the grace period, AI features are disabled, and you can cancel the request. When the grace period ends, we permanently delete your account, including your email address or phone number, authentication data, subscription records, and terms acceptance records. Records of subscription notifications from Apple and Google are kept after deletion, with the link to your account removed. Apple and Google also keep their own purchase records under their own retention policies.

You can also choose to delete the dream data on your device from within the app. Otherwise, local device data remains on your device until you uninstall the app or clear app data. If you use self-hosted sync, data on your sync server is controlled by whoever runs it.

Children’s Privacy

Dreamphase is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.

Third-Party Services

Dreamphase integrates with the following third-party services:

Supabase: Authentication, database, and Edge Functions, Privacy Policy
Google Sign-In: Optional sign-in, Privacy Policy
Sign in with Apple: Optional sign-in, Privacy Policy
Apple App Store and Google Play: Subscription purchases and notifications
Twilio: SMS delivery for one-time password authentication, only if phone sign-in is offered, Privacy Policy
Anthropic Claude: AI-powered dream analysis and Health Insights, Privacy Policy
OpenAI Whisper: Voice transcription, Privacy Policy
Apple HealthKit: Sleep and health data integration on iOS (optional, read on your device; see Health Data)
Google Health Connect: Sleep and health data integration on Android (optional, read on your device; see Health Data)

We encourage you to review their privacy policies. We are not responsible for third-party privacy practices.

International Data Transfers

The minimal data we collect (account, usage, and subscription records) may be processed by Supabase servers in various locations. Supabase provides appropriate safeguards for international data transfers. Your dream content and health data do not leave your device except when you use AI features (which send data to Anthropic or OpenAI through our servers) or, for dream content, when you connect a sync server that you run yourself.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy in the app and updating the “Last Updated” date. Your continued use of Dreamphase after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions or concerns about this Privacy Policy, please contact us:

GestaltMind LLC
Email: info@gestaltmind.dev
Website: gestaltmind.dev