Last updated: 27 October 2026
This policy explains what DreamDump™ collects, where it goes, how long we keep it and what you can do about it. DreamDump is run by Magnolia Labs Limited, a company in Hong Kong ("we", "us"). We decide how your information is used, so we are its controller under data protection law. Contact: magnolia.labs.ai@gmail.com.
The short version
When you sign in with Apple or Google, we receive your name and email address (with Apple you can hide your email). We also keep your app language, time zone, reminder settings, the device token we need to send you notifications, and whether you have Premium.
What you write or record: the dream text, title, date, emotions, tags and dream type, any drawing, and the readings, symbols and themes DreamDump produces from it. If you use voice entry, the recording is sent to be turned into text (section 3); we do not keep the recording.
Your messages and Drift's replies. To let Drift pick up where you left off, we also keep a short summary of each recent conversation.
To make readings and chats personal, the app keeps a small profile on your phone, built from your dreams and chats: your dream archetype from the quiz, interests, recurring symbols, and broad themes such as "student", "in a relationship" or "family tension". People who appear in your dreams are referred to by their role (for example "mother" or "ex"), not by name. This profile is sent with your requests to Google Gemini (section 3).
We do not infer, store or send guesses about your mental health, such as traumas, anxieties or diagnoses.
Apple processes payments; we never see your card details. RevenueCat tells us what you bought and whether your subscription is active (section 5).
If our automated checks find wording that suggests you may be in danger, the app shows crisis resources. We record that this happened: the time, the risk level and the type of signal (for example "self-harm"), with your account ID. We do not record the words you wrote.
If you take the quiz on dreamdump.app and ask for your reading by email, we keep your email address, your quiz result and the reading, and the link you came from. We send you that reading and up to four follow-up emails over the next week. Each email has an Unsubscribe link, or you can write to us.
Dreams can reveal things about your health, sex life, beliefs or relationships, which some laws treat as sensitive or "special category" information. We use it only to run DreamDump for you, as described here, and only with your consent (section 4).
Your dreams, readings, chats, profile and settings are stored on your phone. Dream text, readings and Drift conversations are encrypted with a key kept in your phone's secure storage. Other parts, such as titles, symbols and themes, are not encrypted by the app; they are protected by your phone's own encryption and passcode. You can add Face ID or a passcode to the app in Me → Privacy & Security.
When you're signed in, your dreams (including readings and drawings), Drift chats, chat summaries, dream patterns and intentions are copied to our database at Supabase, so you can restore them on a new phone. The database is protected by access controls and stored encrypted on disk by Supabase, but the copy is not end-to-end encrypted, so it can technically be read by people with access to our systems. Only the people who run DreamDump have that access, and we look at your content only if you ask us to (for example for support), to investigate abuse or security problems, or if the law requires it.
If you don't sign in, your dreams stay on your phone. You can still journal; AI readings and Drift need an account. You can also save a backup file yourself (Me → Privacy & Security → Back up my journal) and keep it wherever you choose.
Readings, Drift chats, weekly summaries, dream cards and symbol and theme readings are written by Google's Gemini AI.
Before a reading, your text is checked for wording that suggests you may be in danger, first on your phone and then on our server, so crisis resources can be shown. These checks are automated; no person reads your text, and they can miss things. DreamDump is not a crisis service.
We do not use your information for advertising, we do not sell or rent it, and we do not share it for cross-context behavioural advertising. AI readings are for reflection only; we make no decisions about you that have legal or similarly significant effects.
These companies process information for us. Each receives only what it needs for its job.
| Service | What it does | What it receives |
|---|---|---|
| Supabase | Account and database | Your account and, if you're signed in, your synced dreams, chats and summaries (section 2.2) |
| Vercel | Our AI server (United States) | Each AI request in transit (section 3) |
| Google (Gemini API) | AI readings, chats and voice-to-text | What is listed in section 3 |
| Apple | Sign in, payments, notifications | Sign-in details; purchases; notification text and your device token |
| Google (Sign-In) | Sign in | Sign-in details |
| RevenueCat | Subscriptions and purchases | Your account ID (not your name or email), purchase receipts and subscription status |
| Sentry | Error reports | What is listed in section 1.6 |
| PostHog | Usage statistics, only if you switch them on | A random ID or your account ID, and which features you use |
| Resend | Quiz emails | Your email address and the email's content |
| Datamuse | Word associations for dream symbols | Single symbol words such as "ocean", with no personal or account information |
We may also disclose information if the law requires it, to protect someone's safety, or as part of a sale or merger of our business (in which case this policy continues to apply).
| Information | Kept |
|---|---|
| Account, synced dreams, chats, patterns, intentions | Until you delete them or your account |
| Drift conversation summaries | 90 days, then deleted automatically |
| Usage counts and safety events | Until you delete your account |
| Quiz email sign-ups | Until you unsubscribe or ask us to delete them |
| Record that an account was deleted (a one-way hash of the account ID and how many items were removed, no content) | 90 days |
| Error reports (Sentry) | Deleted on Sentry's schedule, at most 90 days |
| Data held by Google, Apple and other services | Under their own terms |
Go to Me → Privacy & Security → Delete all my data. This permanently deletes your account and, on our servers: your dreams, chats, summaries, patterns, intentions, usage counts and safety events; quiz emails sent to your account's address; and your customer record at RevenueCat. If you turned on usage statistics, we ask PostHog to delete your data. Everything on the phone is erased too. Deleting cannot be undone; save a backup file first if you want to keep your journal.
Deleting the app does not delete your account. Deleting your account does not cancel an Apple subscription; cancel it in your App Store settings. Apple keeps its own purchase records.
You can also email us to delete your data or to remove a quiz email address.
Wherever you live, you can ask us to:
Email magnolia.labs.ai@gmail.com. We may need to confirm it's you. We reply within one month, or sooner where your local law requires. Using your rights is free, and we will not treat you differently for using them. If you're not happy with our answer, you can complain to your data protection regulator.
We are in Hong Kong. Our database (Supabase) and our AI server (Vercel) are in the United States, and Google, Supabase and the other services in section 5 may process information in other countries. Where the law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses (and the UK addendum) in our agreements with these services.
We use encrypted connections, access controls on our database, encryption of dream content on your phone, and the protections described above. No system is completely secure. If a data breach affects you, we will tell you and the regulators as the law requires.
DreamDump is for people aged 18 and over. We do not knowingly collect information from anyone younger. If you believe someone under 18 is using DreamDump, email us and we will delete their account and data.
If we change this policy in a way that affects how your information is used, we will tell you in the app and ask you to agree before the change applies to you. The date at the top shows the latest version.
Magnolia Labs Limited, Hong Kong · magnolia.labs.ai@gmail.com