Privacy Policy

1. Who is responsible

The data controller is Calarasanu Andrei, an individual operating Somniscient from the Republic of Moldova. Somniscient is offered to people in the European Union, so the GDPR applies to everything described here even though the operator is based outside the EU; your data itself is stored in the EU (section 4). For anything in this policy, including requests to exercise your rights, write to support@somniscient.com. We do not have a Data Protection Officer; the controller answers these requests personally.

2. What we collect

Account

Your email address, display name and language. With email sign-up we store a bcrypt hash of your password, never the password itself. With Google sign-in we receive your email address and name from Google and store no password. We record when you accepted these terms and which version.

Dream journal

The dream text you submit, your answers to follow-up questions, the AI-generated readings, extracted symbols, tags, images generated for your dreams, weekly insights and cross-dream analyses. Dreams frequently touch on health, emotions, relationships, sexuality or beliefs. Where they do, this is special-category data under Article 9 GDPR, and we process it only because you choose to submit it for interpretation (see section 3).

Personal context (optional)

Settings lets you describe your life circumstances so readings fit you better. This text is sent to the AI providers with your dreams. It is entirely optional and you can clear it at any time.

Voice input

Dictation uses your browser's built-in speech recognition. The audio is handled by your browser and its vendor (for Chrome, Google) under their terms; only the resulting text reaches us. We never receive or store recordings.

Guest readings

You can get one reading without an account. The dream text and reading are stored under a random token kept in your browser, with no link to your identity. Guest readings that are not claimed by an account are erased after 30 days. To limit abuse we keep a count per IP address for 48 hours.

Product analytics

We record which steps of the product are used (for example that a reading was opened, or a question skipped), tied to your account or guest session id. These events contain no dream text, IP address or browser details. Google Analytics is loaded only if you accept it in the cookie banner (section 6).

Technical logs

Our web server records each request with your IP address, browser identifier (user agent), the page requested and the time. These logs exist for security, abuse prevention and traffic measurement and are kept for 120 days. The application log records errors and events by internal user id; email addresses in it are masked.

Payments

Paid plans are sold through Dodo Payments, which acts as merchant of record and handles your card details. We store your Dodo Payments customer id, subscription id and plan status only. We never see your card number.

3. Why we process it and on what legal basis

• Providing the service (account, storing and displaying your journal, generating readings, sending verification and password-reset emails): performance of our contract with you, Article 6(1)(b).
• The dream reminder email: one email, a few days after you sign up, asking what you dreamed. Sent only if you ticked the reminder box when creating your account or switched it on in Settings: your consent, Article 6(1)(a). You can withdraw it at any time in Settings or with the unsubscribe link in the email. We record when you gave consent and when the email was sent.
• Interpreting your dreams with AI, including any sensitive content they contain and your optional personal context: your explicit consent, Article 9(2)(a), given when you submit a dream for interpretation. You withdraw it by deleting the dream, clearing your personal context, or deleting your account.
• Analytics cookies: consent, Article 6(1)(a), which you give or refuse in the cookie banner and can change at any time via "Cookie settings".
• Security, abuse prevention, error monitoring and traffic measurement (server logs, guest rate limit, product events): our legitimate interest in running a reliable and safe service, Article 6(1)(f).
• Billing records: legal obligation, Article 6(1)(c), to the extent tax and accounting law requires.

We do not sell personal data, do not use your dreams for advertising, and do not make automated decisions with legal or similarly significant effects. AI readings are for reflection, not decisions.

4. Who processes your data for us

We use the following processors. Each is bound by a data processing agreement or equivalent contractual terms, and each receives only what its task requires.

• OpenAI (United States): generates your readings, follow-up questions, weekly insights and cross-dream analyses. It receives your dream text, your answers, your optional personal context and, for insights and analyses, several of your past dreams. It never receives your name or email address. OpenAI's API terms and Data Processing Addendum apply; under them this content is not used to train its models. Transfers to the US rely on the EU-US Data Privacy Framework and Standard Contractual Clauses.
• Replicate (United States): generates dream images from a short scene description derived from your reading, and stands in for OpenAI if it is unavailable, in which case it receives the same dream content. Replicate acts as our processor under its privacy policy.
• Anthropic (United States): an alternative reading provider we can switch to; when in use it receives the same content as OpenAI, under Anthropic's Commercial Terms and Data Processing Addendum, which exclude training on customer content.
• Hetzner (Finland, EU): hosts our servers and database. Your data is stored in the EU.
• Resend (EU region): delivers verification and password-reset emails to your address, and the dream reminder email if you asked for it.
• Dodo Payments (United States): payment processing and invoicing for paid plans; receives your email and name when you start a checkout.
• Google (Google Sign-In; Google Analytics only with your consent): sign-in verification, and usage statistics if you accept analytics cookies.
• Telegram: delivers operational alerts to the operator. Alerts contain internal ids only; email addresses are masked and dream content is removed before sending.

Error monitoring runs on our own server (self-hosted GlitchTip) and does not receive request contents such as passwords or dream text.

5. How long we keep it

• Account and journal: for as long as your account exists.
• After you delete your account: the account is deactivated at once and invisible to anyone. For 30 days you can sign in again to undo the deletion. After 30 days everything is erased: account, dreams, readings, images, insights and analytics events. We keep an anonymous record of the deletion (former account id, dates, plan, payment reference and the policy version you accepted) that identifies no one, to meet billing obligations and to prove erasure took place.
• Guest readings: 30 days unless claimed by an account.
• Sign-ups never verified: 7 days.
• Product analytics events: 12 months.
• Web server logs: 120 days.
• Backups: nightly copies kept for 14 days on our EU server, after which deleted data disappears from backups too.
• Billing records: held by Dodo Payments for the period tax law requires.

6. Cookies and local storage

Strictly necessary: a cookie remembering your language, and browser storage for your sign-in token, your guest reading token and your cookie choice. These need no consent. Optional: Google Analytics cookies, set only after you click Accept in the banner. Declining, or changing your mind later through "Cookie settings" in the footer or in Settings, stops analytics and removes its cookies.

7. Your rights

You have the right to:

• Access your data. Your journal is visible in the app; on request we provide a complete copy of everything we hold.
• Rectify it: name, language and personal context in Settings; anything else on request.
• Erase it: delete individual dreams in the journal, or your whole account in Settings (section 5).
• Port it: on request we send your journal and account data in a machine-readable format (JSON).
• Restrict or object to processing based on legitimate interest.
• Withdraw consent at any time, without affecting processing before withdrawal.
• Complain to a supervisory authority, in particular in the EU country where you live or work. A list is at edpb.europa.eu.

Send requests to support@somniscient.com. We answer within one month, and may ask you to confirm the request from the email address on your account.

8. Children

Somniscient is not for children under 16 and we do not knowingly hold their data. If you believe someone under 16 has an account, tell us at support@somniscient.com and we will erase it.

9. Security

All traffic is encrypted (HTTPS). Passwords are stored as bcrypt hashes. Data is hosted in the EU with access limited to the operator. Deleting an account requires re-entering your password or re-confirming with Google. No system is perfectly secure; if you find a vulnerability, please report it to support@somniscient.com.

10. Changes

We will update this policy as the service changes and update the date at the top. For material changes we will notify you in the app or by email before they take effect.

11. Contact

Questions about this policy: support@somniscient.com.