Your Dream Data and Privacy

Your dream journal is one of the most intimate datasets you'll ever create. We treat it that way.

What we store

• Your account profile — name, email, country, timezone, language, avatar.
• Your Trak progress — which Traks you're on, which nights you've completed, and your check-in answers.
• Your journal entries — dream descriptions, reflections, voice notes, and any tags you add.
• Optional aggregated insights — patterns we surface back to you ("you've written in your journal 12 times this month"). Computed from your own data only.
• Payment metadata — the gateway (Flutterwave or Paystack), transaction ID, amount, and currency. We never store your card number or CVV. Those live with the gateway.

What we don't store

• Your password (we store a one-way hash that even our engineers cannot reverse).
• Your card details (PAN / CVV).
• Microphone audio when you aren't actively recording. The voice companion listens only inside an active session.
• Location beyond the country on your profile.

Who can see your journal

• You. Always.
• No one else by default. Not the DreamTrak team, not other users, not advertisers. Journal entries are private unless you explicitly mark them as shareable.
• Support, only with your consent. If you open a support ticket about a journal feature, you can grant temporary read access in the ticket. Access auto-expires after 7 days.

How it's protected

1. 1In transit — every request between your device and our servers is TLS 1.3 encrypted.
2. 2At rest — journal content is encrypted in our database. The encryption keys are managed by our hosting provider's HSM service, not stored in our application code.
3. 3Account access — passwords are hashed with bcrypt, and 2FA is available in Settings → Security.
4. 4Backups — daily encrypted backups, retained 30 days, then permanently destroyed.

Exporting your data

You can download everything we have about you, anytime:

1. 1Open My Account → Settings → Export My Data.
2. 2Pick a format (JSON for completeness, CSV for spreadsheets, Markdown for human reading).
3. 3We email you a secure download link within 24 hours, usually within minutes.

Deleting your account

1. 1Open My Account → Settings → Delete Account.
2. 2Confirm with your password.
3. 3Your data is soft-deleted immediately (you can recover it within 14 days by signing in again).
4. 4After 14 days, permanent destruction — entries, journal, profile, and all backups containing your data are wiped within the next backup cycle (max 30 days).

Your rights, wherever you live

• GDPR (EU/EEA) — full data subject rights including access, rectification, erasure, restriction, portability, and objection. Contact privacy to exercise any of them.
• CCPA (California) — right to know, delete, and opt-out of sale. We don't sell data, so opt-out is implicit, but you can request a written confirmation.
• Everywhere else — if your country has its own data protection law, we honor requests under it the same way.