Privacy Policy

DreamTrak, meaning the mobile app, the website at mydreamtrak.com and the emails and notifications that come with them, is operated by Soul Science LLC.

We are the controller of the personal data described here. Put simply, we decide how and why your data is used, and we answer for it under the laws that apply to us and to you. Those include, where they reach you, the EU and UK General Data Protection Regulation (GDPR) and US state privacy laws such as California’s, as well as the Nigeria Data Protection Act 2023.

This policy doesn’t cover the app stores, sign-in services or payment companies you might use alongside DreamTrak. They have their own privacy policies, and we name them below wherever they come into the picture.

If anything here is unclear, you can write to our privacy team.

What you give us

Your account

Your email address, display name, profile photo and password. Passwords are stored only as a one-way hash, never in readable form.

Your preferences

Language, timezone, sleep direction, notification settings and the narrator voices you choose.

Your diary

The entries you write or record: text, voice notes, titles, tags, mood, sleep quality, and how clear or vivid a dream felt.

Your intentions

The personal intentions you set for a Trak, and your answers to check-ins.

Conversations with Teema

What you say to Teema, DreamTrak’s companion, by text or voice, and its replies. Voice check-ins are kept as a transcript, with the reply and a simple reading of mood and energy.

Community posts

Posts, comments, reactions and images you share in the community, and your community profile.

Support requests

What you write to our support team, and anything you add to a request.

Purchases and gifts

What you bought and when. If you gift a Trak, the recipient’s name and email address and any message you include.

Referrals and payouts

Your referral code and the sign-ups and purchases credited to it. When you ask to be paid, the details you enter: bank name, account number and account holder name, or a PayPal email address.

Your consent choices

What you agreed to (terms, privacy, marketing, analytics, AI features), when, which version, and the IP address and device details at that moment, so your choices can be shown to be genuine.

What the app and website record as you use them

Practice and progress

Which Traks and techniques you open, the nights you complete and your streaks.

Usage analytics

Only if you opt in: events such as screens viewed and features used. These are deleted automatically after 90 days.

Device details

Device model, operating system, app version and language, and a push notification token if you allow notifications.

Crash reports

What went wrong, the state of the app at the time and a coarse account identifier, so we can fix it.

Voice and AI usage

When a voice session started and ended, how long it ran and which features were used, so we can keep the service running within fair limits.

Referral links

When someone opens a referral link: hashed, non-reversible versions of their IP address, browser and device signals, used to credit the right person and stop fraud. They expire and are cleared automatically.

Website visits

Standard request information such as IP address and browser type, and the cookies described in our Cookie Policy.

Advertising identifiers

In the free app, the ad network may read your device’s advertising identifier where your settings allow. See section 6.

What we receive from other companies

• Sign in with Apple or Google. Your name and email address, as you authorise during sign-in. Apple lets you hide your real email address if you prefer.
• The app stores and RevenueCat. Confirmation of purchases, renewals and refunds, linked to an anonymous purchase identifier.
• Flutterwave and Paystack. For web purchases, whether a payment went through, with a transaction reference, amount and currency. Your card number and security code stay with them.

What stays on your phone

• Compass readings used to guide your sleep direction.
• Photos that a practice asks you to keep on your device, such as the photo intention in Trak 13. These are never uploaded.
• Face ID, Touch ID or fingerprint checks that lock your diary. Your phone handles them; we never receive biometric data.

Privacy law asks us to name a lawful basis for each thing we do with personal data. Here they are side by side.

We don’t make decisions about you that have legal or similarly significant effects based solely on automated processing. Where automated tools flag something, such as a possibly fraudulent payout or a harmful post, a person reviews it and you can ask us to look again.

Some of what you keep in DreamTrak may say something about your health, your emotions, or your religious or philosophical beliefs. Laws such as the GDPR treat that kind of information as sensitive. So do we.

• We process it only with your explicit consent. You give that consent when you create entries, and separately for each AI feature that reads them.
• Diary text is encrypted inside the app before it’s saved. This isn’t end-to-end encryption, since our systems need to restore your entries when you sign in on a new phone, but it means entries aren’t stored as readable text.
• Inside DreamTrak, access to personal data is limited by role to the few people who need it to keep the service running, and that access is logged.
• Your entries are never used to train AI models, ours or anyone else’s. The AI providers we work with may process them only to answer the request you made.
• Switching off an AI feature stops it reading your diary. It doesn’t delete your entries; you can do that yourself, one at a time or all together by deleting your account.

Withdrawing consent doesn’t make earlier processing unlawful, but it stops anything further from that point on.

Teema, the companion

Teema answers questions about your practice using the content of your Traks. If you allow it, Teema can also draw on your progress and, with a separate permission, your diary. Conversations are saved so you can pick up where you left off, and you can delete them at any time.

Teema doesn’t give medical, psychological or therapeutic advice, can’t see your payment details or support requests, and never shares what you say with other members.

Speaking with Teema

When you talk to Teema by voice, your audio travels live to ElevenLabs, which understands what you say and answers in a spoken voice, over a real-time connection provided by LiveKit. We keep the details of each session, such as when it started and how long it lasted.

Voice check-ins and voice notes

Voice check-ins are turned into text. We save that transcript together with Teema’s reply and a light reading of your mood and energy, so the app can reflect your progress back to you. Voice notes you add to a diary entry are saved as audio with that entry.

Narration and transcription

Guided narration is produced by ElevenLabs from our own scripts, so it needs no personal data. When you dictate an entry, the audio is sent to ElevenLabs, or to OpenAI as a backup, to be transcribed. Some quick voice commands use the speech recognition built into your phone, which Apple or Google provide under their own terms.

The providers behind these features

Anthropic is our main language model provider, with OpenAI as a fallback. ElevenLabs provides voices and transcription, and LiveKit carries live audio. The AI providers among them process your data only on our instructions and aren’t permitted to use it to train their models.

Support and community safety

Our support assistant sees account and technical details, such as your plan, purchases, device and recent errors. It never sees your diary, moods or reflections. Community posts are checked by automated classifiers, and sometimes by a person, for abuse, spam and harmful content.

More on how we build and limit these features is on our AI Safety page.

We ask AdMob for non-personalised ads only, so ads aren’t chosen from your behaviour across other apps and websites. AdMob may still use limited information to show an ad, cap how often you see it, measure ads in aggregate and prevent fraud: your device type, an approximate location derived from your IP address and, where your settings allow, your device’s advertising identifier. Google describes how it handles that information in its own privacy policy.

On iPhone we ask before any tracking identifier is available, and you can change your answer in your phone’s settings at any time. On Android you can reset or delete your advertising ID in your device settings.

Nothing from your diary, moods, conversations or practice is shared with advertisers.

In the app

Purchases in the app go through the Apple App Store or Google Play and are reconciled through RevenueCat. We learn what you bought and whether a subscription is active. We never see your card.

On the website

Web purchases are processed by Flutterwave or Paystack. They collect your payment details directly. We receive the result, a transaction reference, the amount, the currency and the email address used for the purchase.

Gifts

When you gift a Trak, we use the recipient’s name, email address and your message to deliver the gift, and for nothing else.

Referral payouts

When you request a payout, we record the amount and the method you choose. For a bank transfer we collect your bank name, account number and account holder name; for PayPal, your PayPal email address. We share these with Paystack, Flutterwave or PayPal to send the money. Payout requests are checked for fraud and reviewed before they’re paid, and we keep payout records as long as tax and anti-fraud rules require.

The QR code for your referral link is generated by QR Server (goQR.me), which receives only the link itself.

The companies that help us run DreamTrak

These providers handle personal data on our behalf, only to provide their service to us and under contracts that require them to protect it.

The list is kept current on our Subprocessors page. Apple and Google also receive data when you use their app stores or sign-in, as independent companies under their own privacy policies.

Other members

Your community posts, display name and community photo are visible to members of the groups you post in. Your diary is never shown to other members. We don’t reveal the identity of people you refer.

When the law requires it

We disclose personal data to courts, regulators or law enforcement only when the law requires it, or when we believe in good faith that it’s needed to protect someone from serious harm. We review every request before responding. Our Law Enforcement page explains how.

If DreamTrak changes hands

If our company is involved in a merger, acquisition or sale of assets, personal data may transfer as part of that. We’ll tell you before your data becomes subject to a different privacy policy.

What we don’t do

We don’t sell personal data, and we don’t share it for cross-context behavioural advertising, as those terms are defined under California law.

Our main database is hosted in the United States. Depending on the feature, data may also be processed in the European Union, in the countries where our payment providers operate, or on worldwide delivery networks. Wherever it goes, this policy goes with it.

For transfers out of the EU and the UK, we rely on adequacy decisions where they exist, and on the European Commission’s Standard Contractual Clauses and the UK Addendum to them. Other transfers use the safeguards the law that governs them permits. You can ask us for details of the safeguards that apply to you.

When you delete your account, we delete or anonymise your personal data within 30 days, except records the law requires us to keep. Deleted data can remain in encrypted backups for a short time until those backups are overwritten.

• Encryption in transit (TLS 1.2 or later) and at rest.
• Diary text encrypted inside the app before it’s saved.
• Database rules that let each account reach only its own data.
• Optional two-step verification, with recovery codes.
• Staff access limited by role, and logged.
• Card details that never touch our servers.
• Regular reviews of our security and the providers we rely on.

No method of storing or sending data over the internet is completely secure, and we can’t promise absolute security. If a breach puts your personal data at risk, we’ll notify the relevant regulators within the time the law sets, which is 72 hours under the GDPR and many similar laws, and we’ll tell you directly where the breach is likely to put your rights at high risk.

Do it yourself in the app

• Settings → Privacy to manage AI permissions, analytics and marketing, and to download a copy of your data.
• Settings → Delete Account to close your account and erase your personal data.
• Your phone’s settings to turn off notifications or change ad tracking permissions.

Rights everyone has with us

Wherever you live, you can ask to access the personal data we hold about you, correct it, delete it, receive a portable copy, and withdraw any consent you’ve given.

In the EU, the EEA and the UK

You can also ask us to restrict how we use your data, object to processing based on our legitimate interests or for direct marketing, and not be subject to decisions based solely on automated processing. You have the right to complain to your local data protection authority, which in the UK is the Information Commissioner’s Office.

In California and other US states

You have the right to know what personal information we collect, use and disclose, and to delete and correct it. We don’t sell or share personal information, and we use sensitive personal information only to provide the service you asked for. We won’t treat you differently for exercising any of these rights. You may use an authorised agent. If your state gives you a right to appeal a decision we make about your request, you can do that by replying to our response.

Everywhere else

If you live in another country with its own privacy law, you have the rights that law gives you, and we honour them the same way.

How to ask

For anything you can’t do in the app, contact our privacy team, ideally from the email address linked to your account. We may need to confirm it’s really you. We reply within 30 days, or sooner where your law requires, and it’s free. If we can’t do what you ask, we’ll explain why, and you can ask us to reconsider or take it to your data protection authority.

We don’t knowingly collect personal data from anyone under 16, and signing up requires confirming you’re 16 or older. If you believe a child has created an account, please let our privacy team know and we’ll delete the account and its data.

The cookies and browser storage our website uses, what each one does and how to control them are set out in our Cookie Policy.

We update this policy as DreamTrak and the law change. The date at the top of the page shows when the current version took effect. When a change is significant, we’ll tell you in the app or by notification before it applies.

If a change means we want to use your data in a new way that needs your consent, we’ll ask for it rather than assume it.

Company

Soul Science LLC, operator of DreamTrak

Registered address

No. 11 Dideolu Court, Ogba, Lagos State, Nigeria

Privacy questions

Contact our privacy team

In the app

Support → Contact Us

Regulators

The data protection authority where you live