Privacy Policy

What we collect, who we share it with, and how long we keep it.

Youmeng ("we", "us", "our") is a private dream journal built and operated by an independent developer. Dreams are intimate, so we've designed this policy — and the app itself — around two principles: collect as little as possible, and be specific about what we do with what we collect.

This policy applies to the Youmeng mobile app (iOS, and later Android) and the youmeng.app website, including the waitlist signup form. By using Youmeng or signing up for the waitlist, you agree to this policy.

1. The short version

2. What we collect

Account data

Just your email address. We don't collect your name, phone number, date of birth, address, or any government identifiers.

Dream content

When you record a dream, we store: the free-text body, any voice recording you make, the symbols and mood you tagged, the timestamp, and a generated title. Voice recordings are stored as audio files. We treat dream content as sensitive personal information — see section 5 for how it's protected.

AI interpretation requests

When you tap "Read this dream", we send the relevant dream text to Anthropic (Claude API) so it can return a symbolic reading. If you use Voice Trace to record a dream aloud, the audio file is sent to OpenAI (Whisper API) to be transcribed into text. The reading and the transcription are then stored alongside the dream so you can revisit them.

The first time you sign in to Youmeng, the app shows an AI consent screen that names these providers, explains what is sent to each, and requires you to accept before any dream content can leave the app. If you decline, you are signed out and no dream content is ever sent. The screen is the contractual basis on which we share content under section 4.

Per Anthropic's Commercial Terms and OpenAI's API data-usage policy, content submitted via these APIs is not used to train their models and is retained only for the short period needed for operational and abuse-prevention purposes.

Diagnostic data (optional)

If you leave "Anonymous usage stats" enabled in Settings, we collect aggregate, non-identifying information about which screens are visited, crashes, and performance. This never includes dream content. In the EU and UK this setting is off by default.

Waitlist signups

If you submit your email on youmeng.app, we store: your email, the source page (landing), your browser's user agent, the approximate country your IP geolocates to (when available), and the timestamp.

What we don't collect

We don't collect contacts, photos, precise location, calendar, microphone audio outside of recording flows, biometric data, or your social graph.

3. How we use what we collect

• Provide the app's core functions (record, store, display your dreams)
• Generate AI symbolic readings when you request them
• Send sign-in links to your email
• Email you about important product changes or service issues (rarely)
• Fix bugs and improve the app (only with diagnostic data, if you've consented)
• Comply with legal obligations

We do not use your dreams or voice recordings for advertising, profiling, lookalike audiences, or training AI models for purposes other than reading your dream when you ask us to.

4. Who we share data with

We use a small number of carefully chosen third-party service providers ("processors"). They process data on our behalf, under contract, and only for the purposes listed.

We do not currently use any advertising networks, marketing analytics platforms, or customer support tools that would receive your dream content.

We may share data with law enforcement only when legally required (e.g., a valid subpoena). We have never received such a request as of the effective date above. We do not sell your data to anyone, for any purpose, ever.

5. How we protect it

• All traffic between your device and our servers is encrypted in transit (TLS 1.2 or higher)
• Dream content is encrypted at rest by Supabase (AES-256)
• Voice files are stored in a private storage bucket; only your authenticated session can read them
• Row-level security policies on the database mean even an SQL query on our end cannot return another user's dreams without explicitly identifying that user
• We don't keep production database backups on local laptops

No system is perfectly secure. If we ever suffer a breach affecting your data, we will notify you within 72 hours of confirming the incident, as required by GDPR.

6. AI interpretation — an important note

Symbolic readings generated by Youmeng are produced by a large language model. They are:

• Not a medical diagnosis. Youmeng is not a healthcare service.
• Not psychological or psychiatric advice. If anything in a reading distresses you, please talk to a qualified mental-health professional.
• Suggestive, not definitive. Treat readings as conversation prompts about your inner life — never as objective truth.
• Potentially inaccurate. AI models hallucinate. Cross-check anything that matters.

If you find yourself relying on dream readings to make significant life decisions, please pause and speak with someone you trust.

7. How long we keep it

• Account & dreams: for as long as your account exists. When you delete your account, we erase all personal data within 30 days, except where law requires longer retention (e.g., tax records, 7 years).
• Voice recordings: same as above. You can also delete individual recordings before deleting the account.
• Waitlist emails: until you ask us to remove you, or until we close the waitlist.
• Diagnostic data: at most 90 days.
• Server logs: at most 30 days.

8. Your rights

Depending on where you live, you have some or all of the following rights:

• Access — get a copy of your data (Settings → Data → Export my dreams)
• Correction — fix anything inaccurate
• Deletion — wipe your account and all associated data
• Portability — receive your data in JSON format
• Restriction & objection — limit how we process your data
• Withdraw consent — turn off optional features like diagnostics anytime
• Opt out of "sale" — already true: we don't sell data
• Lodge a complaint with your local data protection authority

For any of the above, just email hello@youmeng.app. We respond within 30 days, usually faster.

We don't use your data to make automated decisions that produce legal or similarly significant effects about you.

9. International transfers

Youmeng's servers (via Supabase) are located in the United States. If you're in the EU, UK, China, or elsewhere outside the US, your data will be transferred to and processed in the US. We rely on Standard Contractual Clauses (SCCs) where applicable for these transfers.

10. Children

Youmeng is not for children under 13. We do not knowingly collect data from anyone under 13. If you're between 13 and 16 and live in the EU or UK, please use Youmeng only with a parent or guardian's involvement, as GDPR requires. If you believe a child has provided us data, email hello@youmeng.app and we will delete it.

11. Changes to this policy

If we change this policy in a way that materially affects you, we'll notify you by email (or in-app banner) at least 14 days before the change takes effect. Smaller edits (typos, clarifications) we may make without notice, but we always update the "Last updated" date above.

12. Contact

Email: hello@youmeng.app

If we don't respond within 30 days, you may also contact your local data protection authority. EU residents: see the EDPB. UK residents: the ICO. California residents: the California Privacy Protection Agency.