Privacy Policy

1. Information We Collect

We collect information you provide directly to us, such as when you create an account, write dream entries, or interact with our AI analysis features. This includes:

• Account information from Google authentication (email, name, profile picture) or phone number for phone-based authentication
• Dream content (dream titles, dream descriptions, and dream journal entries)
• Voice recordings when using our voice-to-text feature (audio is transcribed and not permanently stored)
• AI-generated dream analysis and insights
• Conversation history with our AI therapist personas about your dreams
• Your selected AI therapist persona preferences
• Payment information (processed securely by Stripe - we do not store credit card details)
• Subscription status and billing history
• Usage analytics data to improve our Service
• Public sharing preferences (whether you choose to share dreams to the Explore page)
• Like interactions on shared dreams
• Content reports submitted on shared dreams

2. SMS Communications

If you opt in to SMS communications during phone-based sign-in, we may send you occasional text messages related to onboarding and product updates.

• Message frequency varies
• Message and data rates may apply
• Reply STOP to any message to opt out at any time
• Reply HELP for assistance
• Your phone number will not be shared with third parties for marketing purposes
• SMS consent is not required to use the Service

Your opt-in preference is stored in your account profile. Once you opt in, your consent is preserved unless you opt out by replying STOP.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our Service
• Perform aggregate, de-identified statistical and thematic analysis across all user-submitted dream content to understand common patterns, improve our AI systems, and inform new feature development
• Process and analyze your dream content using AI
• Authenticate your identity and manage your account
• Communicate with you about the Service
• Ensure the security and integrity of our platform
• Display anonymized dream snippets on the Explore page when you opt-in to sharing
• Process likes and deliver like notifications to dream owners
• Review reported content for community safety

4. Data Storage and Security

Your data is stored securely using industry-standard encryption and security measures. We use Supabase as our database provider, which implements robust security protocols including:

• End-to-end encryption for data transmission
• Secure data centers with physical security measures
• Regular security audits and monitoring
• Row-level security policies to protect user data

5. Third-Party Services

We use the following third-party services to provide our platform:

• Google Authentication: For secure user login and account management
• Phone Authentication: For secure login via SMS verification (powered by Supabase)
• Supabase: For secure database storage, authentication, and backend services
• OpenAI: For AI-powered dream analysis, insights, and voice transcription (Whisper API)
• Google (Gemini AI): For AI-powered dream visualization image generation
• Google Analytics: For anonymous usage analytics to improve our Service
• Microsoft Clarity: For understanding how visitors use our website (session replays, heatmaps, and interaction analytics)
• Meta and Google Ads: For measuring the effectiveness of our advertising
• Stripe: For secure payment processing and subscription management

When you use our AI analysis features, your dream descriptions are sent to OpenAI for processing. OpenAI processes this data according to their privacy policy and data processing terms. We do not store your data with OpenAI beyond the processing session. The generated analysis and conversation history are stored securely in our Supabase database for your continued access.

When you use our dream visualization feature, your dream content is sent to Google's Gemini AI for image generation. Gemini creates artistic visualizations based on your dream descriptions. This data is processed according to Google's privacy policy and is not permanently stored by Google or Oneira beyond the processing session. Only the resulting image URL is saved with your dream entry.

When you use our voice recording feature, your audio is sent to OpenAI's Whisper API for transcription. The audio data is processed in real-time and is not permanently stored by OpenAI or Oneira after transcription is complete. Only the resulting text transcription is saved as part of your dream entry.

Payment information is processed by Stripe and never stored on our servers. We only store subscription status and billing history necessary to provide you with our Service.

6. Data Sharing

We do not sell, trade, or otherwise transfer your personal information to third parties except:

• With your explicit consent
• To comply with legal obligations
• To protect our rights and the safety of our users
• With service providers who assist in operating our platform (under strict confidentiality agreements)

7. Social Features and Attribution

Oneira includes optional social features through the Explore page. Here is how your data is handled:

• Sharing to the Explore page is entirely opt-in
• Shared content shows either your preferred display name (default) or "Anonymous" if you choose. Email, phone, and profile picture are never displayed
• Like notifications show aggregate counts only (e.g., "2 people liked your dream") with no identifying information about who liked
• You can unshare a dream at any time; this removes it from the public feed and deletes associated likes and reports
• Streak leaderboard: if your active streak ranks in the top positions, your preferred display name and streak count may be visible to other authenticated users in the streak modal. No dream content is included in this surface. You can opt out at any time from the menu in the top-left of the streak modal. Email, phone, and profile picture are never displayed
• Notification read status is stored locally on your device (localStorage), not on our servers

8. Your Rights and Choices

You have the right to:

• Access, update, or delete your personal information
• Download a copy of your data
• Opt out of certain communications
• Delete your account and associated data
• Request clarification about our data practices
• Object to the processing of your personal data
• Request data portability where technically feasible

To exercise these rights, contact us through the support channels within the application or email ryan@oneira.dev.

How to delete your account and data

• Email ryan@oneira.dev from the address or phone number on your account and ask us to delete it. This permanently deletes your account, dreams, analyses, images and profile.
• Deletion is completed within 30 days. If you signed in with Google, you can also remove Oneira's access at any time at myaccount.google.com/permissions.

Google User Data

When you sign in with Google, Oneira accesses only your basic profile: your name, email address and profile picture. We do not access your Gmail, Drive, Calendar, contacts or any other Google data.

• How we use it: to create and sign you into your account, show your name in the app, and contact you about your account.
• How we store and protect it: it is stored in our encrypted, access-controlled database and sent only over HTTPS.
• Sharing: we never sell Google user data or use it for advertising. We do not share it with third parties except service providers that help us run Oneira, as required by law, or with your consent.
• AI: Google user data is not used to train or improve AI or machine learning models.
• Retention and deletion: we keep it while your account is active and delete it when you delete your account, as described above.

Oneira's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

9. Data Breach Notification

In the unlikely event of a data breach that may compromise your personal information, we will notify affected users within 72 hours of becoming aware of the breach. Notifications will include the nature of the breach, potential risks, and measures taken to address the incident.

10. Data Retention

We retain your information for as long as your account is active or as needed to provide you with our Service. You may delete your account at any time, which will result in the deletion of your personal data within 30 days.

Financial transaction records may be retained longer as required by law and for accounting purposes.

11. Cookies and Tracking

We use essential cookies to maintain your session and provide core functionality. We also use analytics and advertising measurement technologies, described below.

We use Google Analytics to collect anonymous usage data, including pages visited, session duration, and general interaction patterns. This data helps us understand how users interact with our Service and identify areas for improvement. Google Analytics may use cookies to track this information. You can opt out of Google Analytics by using browser extensions or settings that block analytics tracking.

We partner with Microsoft Clarity and Microsoft Advertising to capture how you use and interact with our website through behavioral metrics, heatmaps, and session replay to improve and market our products/services. Website usage data is captured using first and third-party cookies and other tracking technologies to determine the popularity of products/services and online activity. Additionally, we use this information for site optimization, fraud/security purposes, and advertising. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement.

We use the Meta Pixel and Google Ads conversion tracking to measure whether our ads lead to sign-ups. These tools may use cookies and share limited event data (such as a page visit or sign-up) with Meta and Google. You can manage ad preferences in your Meta and Google account settings or block these cookies in your browser.

12. Children's Privacy

Our Service is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13.

13. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place for such transfers.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

15. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at ryan@oneira.dev.