Privacy Policy

Last updated: 23 October 2026

This policy explains what information Dreamsong collects, why, who helps process it and the choices you have. It has two parts, because they involve different information and different commitments:

Section 1 and Part C apply to both.

Contents

  1. Who operates Dreamsong
  2. Part A: Website and early access
  3. Part B: The Dreamsong app
  4. Part C: Transfers, rights and changes

1. Who operates Dreamsong

Dreamsong is operated by Donal O’Riordan, who is responsible for the information described in this policy.

For any privacy question or request, contact hello@dreamsong.app.

Part A

Website and early access

A1. The early-access list

Dreamsong previously offered an early-access list on this website, together with a free Dreamsong delivered by email. If you joined, the form recorded:

The form did not ask for your name, and it did not collect dream content, health information or app-usage information.

This information is used to:

Your information is not sold, and it is not used for advertising or profiling.

This update does not change what existing subscribers agreed to. Joining the early-access list does not create a Dreamsong app account, and early-access information continues to be used only for the purposes listed above and kept under the retention policy in section A4, or deleted with a linked app account as described in section B6.

A2. Legal basis for early-access emails

Consent is the legal basis for sending you Dreamsong early-access, launch and offer emails. You gave that consent when you joined the list.

You can withdraw your consent at any time by using the unsubscribe link in any Dreamsong email, or by contacting hello@dreamsong.app. Marketing messages stop promptly after a withdrawal is received. Withdrawing consent applies going forward and does not affect the lawfulness of processing that took place before you withdrew it.

A3. Your private listening link

The free Dreamsong email contains a private link to a listening page. When you open it, the page asks the Dreamsong server to check the link. If the link is valid, the server returns a temporary address for the audio file, which is kept in private Supabase storage. The link itself is a random, signed code and does not contain your email address.

A4. Retention of early-access information

Subscriber information is retained until consent is withdrawn or 12 months after Dreamsong’s public launch, whichever occurs first. Following an unsubscribe request, marketing communications will stop promptly and the subscriber information will be deleted within 30 days, except for a minimal suppression record retained where necessary to honour the opt-out. If you delete a Dreamsong app account, early-access records linked to that account’s verified email addresses are also deleted, as described in section B6.

In practice that means three states: active subscriber information, held while your consent stands; deleted subscriber records, removed within 30 days of an unsubscribe request; and a suppression record, the minimum needed to make sure a withdrawn address is not contacted again.

A5. Website hosting

As with any website, the hosting and delivery infrastructure processes limited technical information such as your IP address and browser request details in order to serve the pages and protect the service against abuse.

A6. Cookies, analytics and your choices

When you first visit, a small bar asks whether you allow analytics. The website behaves as follows:

You can change your analytics choice at any time using the Analytics choice button in the corner of the page, or here:

Part B

The Dreamsong app

This part applies when you create or use a Dreamsong app account. Dreamsong is preparing for public release, so this part describes the app as it works today and will be updated as it changes.

B1. Accounts and sign-in

Dreamsong accounts are managed through Supabase Authentication. You can sign in in three ways:

Linking sign-in methods. You can link more than one sign-in method to the same Dreamsong account, so that, for example, email and Google both open the same account. To do this, the account keeps a record of each linked sign-in method and its identifier. If you use Apple’s Hide My Email, the relay address will differ from the address you use elsewhere.

B2. What is stored with your account

To give you your own experience across sessions and devices, the following is stored in association with your account:

B3. AI-assisted features

Dreamsong uses AI to create personalised stories, narration and artwork, and to write reflections on dreams you record. To do this, the information needed for the request, such as your preferences, the details you give for a story or the text of a dream, is sent to AI service providers, which return the generated story, audio, image or reflection. The result is then stored with your account as described in B2.

Dreamsong uses OpenAI for AI-generated stories and artwork, and ElevenLabs for narration. OpenAI API data is not used for model training by default, but may be retained by OpenAI for abuse monitoring for up to 30 days. ElevenLabs may retain submitted text and generated audio under its own data retention policies. These retention periods are set by the providers and depend on their settings and legal requirements.

Reusable artwork. AI-generated illustrations may, after safety, privacy and quality review, become part of Dreamsong’s shared artwork library and be shown as temporary artwork for other Dreamsongs. Library images may remain after the account they were first created for is deleted. Your private story, narration, generation prompts and account associations are not shared or kept as library information, and any description stored with a library image describes only the image, without personal information.

If an image contains identifying or sensitive personal details, it is reviewed for privacy and dealt with appropriately, for example by editing it or removing it from the library. Treating artwork as a platform asset does not remove your privacy rights. If you have a concern about an image, contact hello@dreamsong.app.

Dreams can be personal. A dream journal entry may contain details about your health, relationships or beliefs if you choose to write them. Please share only what you are comfortable with. You decide what goes into the journal.

B4. Microphone and dream transcription

Microphone use is optional. If you choose to record a dream aloud, the app asks for microphone permission through your device’s settings. The microphone is used only while you are recording. The recording is processed to produce a written transcription of your dream, which you can then keep in your journal. The audio is discarded once the transcription has been made. You can type your dreams instead, and you can withdraw microphone permission at any time in your device settings.

B5. Service providers

Dreamsong relies on a small number of providers:

Dreamsong does not sell your information.

B6. Keeping and deleting app data

Active accounts. Account information and saved content, including stories, dream journal entries, Dream Oracle reflections, preferences, narrator and Spirit Guide choices and listening progress, are kept while your account exists, until you delete them or your account.

Deleting content. You can delete individual stories and dream journal entries in the app. Existing recovery copies are handled under the backup and deletion-record policies below.

Deleting your account. To delete your account, write to hello@dreamsong.app from an email address linked to your account.

Once a verified deletion request is accepted, access to your private account data is restricted and no new account activity is allowed while a secure background cleanup completes. The cleanup removes your linked sign-in identities, private stories and narration, dream journal and Dream Oracle entries, preferences, saved routines and listening progress. Deletion can take some time, particularly if revoking access with a sign-in provider, or another service, is temporarily unavailable. You will receive confirmation when deletion is complete.

Backups and recovery archives. Dreamsong keeps two kinds of recovery copy. Scheduled database backups are made through Supabase and follow their separately configured retention period. Independent encrypted archives of the database and private file storage follow a 30-day retention policy, measured from creation. Before an archive is removed, a newer recoverable copy is verified. If verification fails, the older archive may be retained temporarily under a documented recovery exception, which is resolved as soon as a replacement is verified. Retained archives and any exceptions are reviewed monthly; the monthly review does not extend the normal 30-day retention period. Access to recovery copies is restricted, and they are kept only so the service can be restored, not for normal app use. Deleting your account does not rewrite existing backups or archives, so information they already contain may remain until those copies expire and are removed. The deletion-record safeguards below apply for as long as any relevant copy remains restorable.

Deletion records. To prevent a deleted account from being restored into active use, Dreamsong keeps a minimal, protected deletion record (the account identifier and the times the request was made and completed) for as long as a relevant backup or archive could still be restored. Before restored systems reopen, they are reconciled against these records. If it cannot be confirmed that every deletion has been applied, restored access stays closed.

Shared library artwork. Illustrations accepted into the shared artwork library are kept as described in section B3 and are not removed when an account is deleted.

Logs. Supabase keeps authentication logs, such as sign-in events, for the standard retention period of Dreamsong’s Supabase plan.

Voice recordings. Recordings are used only to create a transcription, and the audio is then discarded. The transcription is kept with your journal like any other entry.

AI providers. OpenAI and ElevenLabs may keep data for their own periods, as described in B3.

Legal obligations. Where Dreamsong holds transaction, subscription or financial records, they may be kept for six years where required by Irish tax law. Limited information may also be retained where necessary to comply with legal obligations, resolve disputes or protect legal rights. Personal dream content is not retained for these purposes unless legally required.

The early-access list is separate: its retention is described in section A4 and does not apply to app accounts. Deleting an app account also deletes early-access records linked to the account’s verified email addresses. Dreamsong cannot reliably identify subscriptions made with unrelated email addresses, so contact hello@dreamsong.app if you want those removed. Unsubscribing from the list, using the unsubscribe link or by email as described in section A2, does not delete an app account.

B7. Age

Dreamsong is intended for people aged 16 and over, as set out in the Terms of Service.

Part C

Transfers, rights and changes

C1. Where information is processed

Early-access signup records are stored and primarily processed in the eu-west-1 (West EU, Ireland) region of Supabase.

Supabase, Resend, Netlify, the sign-in and AI providers, or their subprocessors may process some information outside Ireland or the European Economic Area in the course of providing their services. Resend’s primary processing operations take place in the United States, and its data-processing terms provide international-transfer safeguards, including the applicable EU Standard Contractual Clauses.

C2. Your rights

Depending on your circumstances, you may have the right to:

These rights do not apply without exception in every situation. Where a request cannot be met in full, you will be told why.

Send any request to hello@dreamsong.app. Enough information may be needed to confirm that the request comes from the person the information belongs to; usually a message from the address on the account or list is sufficient. Excessive identity documentation will not be requested.

C3. Complaints

If you are unhappy with how your information has been handled, you can raise a concern at hello@dreamsong.app, and you may also lodge a complaint with the Irish Data Protection Commission at www.dataprotection.ie.

C4. Changes to this policy

This policy may be updated as Dreamsong’s services or data practices change. The revised date always appears at the top of the page, and material changes will be communicated where appropriate, for example by email to the early-access list or in the app.

Continuing to visit this page is not treated as agreement to a material change.

See also the Terms of Service.