Privacy Policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Mert Tufangil
Tufangil IT Solutions
Email: datenschutz@dreamerscloud.de

A data protection officer is only mandatory above a certain company size or for certain types of processing (Art. 37 GDPR, §38 BDSG) — please check whether this applies to you.

Dreamerscloud is a digital dream journal that automatically analyses dream content (AI tags, emotions, categories) and — only with explicit consent — suggests semantically similar dreams from other users worldwide (“Dream Match”). Dream content can contain very personal information. We therefore process it according to the principle of data minimisation and with granular, separate consents (see section 5).

This website is hosted by Vercel Inc. (340 S Lemon Ave #4133, Walnut, CA 91789, USA). The application region configured for Dreamerscloud (Vercel Functions) is Frankfurt, Germany (eu-central-1, fra1) — that is where the application code that answers requests runs. Vercel itself is a globally distributed service with additional infrastructure and sub-processor locations (e.g. its edge network, logging/monitoring), so this does not mean processing occurs exclusively in Germany. Vercel automatically processes technical access data (server logs: IP address, timestamp, requested URL, browser/operating system) to provide and secure the service. The legal basis is our legitimate interest in a secure and functional operation of the website (Art. 6(1)(f) GDPR). As Vercel Inc. is a US company, data may be transferred to the USA (a third country); Vercel offers a Data Processing Addendum based on the EU Standard Contractual Clauses for this.

User accounts, dream content, and all product-related data are stored with Supabase Inc. The database region configured for Dreamerscloud is eu-central-1 (Frankfurt, Germany). As with any cloud provider, individual ancillary services (e.g. backups, Supabase's internal operations/support systems) may be located elsewhere — this does not affect the primary storage of database content. Sign-in (email/password) runs through Supabase Auth; passwords are stored exclusively in encrypted (hashed) form. The legal basis is the performance of the usage agreement with you (Art. 6(1)(b) GDPR).

At registration we collect your email address and password (encrypted).

When you record a dream, you decide its visibility yourself:

• Private — only you see the dream; it is never used for global matching, regardless of any other settings.
• Anonymous for Dream Matching — the dream is included in the worldwide similarity search, but is displayed without any user-identifying information (only country and approximate time, never exact location data or username).
• Public — the dream is readable by other users in the Explore section.

In addition, we ask for two separate, granular consents (revocable at any time under Account settings, Art. 7(3) GDPR):

• AI analysis of my dreams — allows automatic detection of themes, emotions, and summaries for your personal journal.
• Global Dream Matching — allows anonymous/ public dreams to be compared with other users worldwide.

The legal basis for both is your consent (Art. 6(1)(a) GDPR).

At registration you also confirm via checkbox that you are at least 16 years old (Art. 8 GDPR, the German default age of consent for information-society services). We deliberately do not collect a birthdate for this — a plain self-declaration is sufficient for this purpose and keeps with the principle of data minimization.

To automatically analyse your dreams (summary, emotions, themes, tags, optional translation, and the optional AI explanation of a found Dream Match) we use the API of Anthropic PBC (San Francisco, USA). To generate vector embeddings for the semantic similarity search/Dream Matching we use the API of OpenAI, L.L.C. (San Francisco, USA) — OpenAI only produces the mathematical vector representations used for similarity comparison, never a content-level or psychological interpretation of your dream; that interpretation is done solely by the Anthropic analysis above. Dream content is transmitted to and processed on the respective servers in the USA (third-country transfer).

Under both providers' current commercial API terms, content submitted via the API is not used to train their models by default (for Anthropic this applies to API/business use generally, independent of any opt-in/ opt-out setting; for OpenAI the same principle applies to API/business customers unless an explicit voluntary data-sharing program is enabled — Dreamerscloud does not enable any such voluntary sharing). Both providers offer a Data Processing Addendum (DPA) based on the EU Standard Contractual Clauses (Art. 46 GDPR) for the third-country transfer. Whether either provider additionally holds an EU-US Data Privacy Framework certification changes from time to time on the provider side and was not conclusively verified for this version — see the internal review note.

This processing only takes place if you have consented to AI analysis (see section 5); a dream marked Private is never passed to global Dream Matching, regardless of that consent.

We use exclusively technically necessary cookies to maintain your login session (set by Supabase Auth) as well as a cookie for your language preference (DE/EN). These are exempt from consent requirements under § 25(2) No. 2 TTDSG, as they are required to provide the service you explicitly requested. We currently do not use any tracking, marketing, or analytics cookies.

The fonts used (Space Grotesk, Inter) are embedded locally into the website at build time (via next/font) and served from our own server when the page is requested — no connection to Google's servers is made, and no data is transmitted to Google.

We store your data for as long as your account exists. After you delete your account, your profile, all dreams, analyses, embeddings, and matches are irrevocably deleted (no soft delete). Statutory retention obligations remain unaffected.

• Access to your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR) — can be triggered at any time under Account settings
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR) — available as a JSON export at any time under Account settings
• Objection to processing (Art. 21 GDPR)
• Withdrawal of given consent with effect for the future (Art. 7(3) GDPR)
• Lodging a complaint with a supervisory authority, e.g. the data protection authority responsible for you

We adapt this policy whenever our data processing or the legal situation changes. The version currently published on this page always applies.

For questions about the processing of your personal data, or to exercise your privacy rights, you can reach us at:
datenschutz@dreamerscloud.de