Privacy Policy

Account Information: When you create an account, we collect your name, email address, and password (stored as a secure hash).

Dream Journal Entries: Dream titles, descriptions, dates, mood ratings, and voice recordings you choose to submit.

Profile Information: Optional details you provide such as gender, date of birth, occupation, cultural background, spiritual beliefs, and personal dream context. This information is used solely to personalize Owlnyx's dream analysis.

Content you choose to process with AI: If you opt in and invoke an AI feature, Owlnyx may use your dream title and description, mood, selected profile or dream context, voice recording, AI chat messages and the dream context shown in that chat, comments submitted for safety review, text selected for translation, and image prompts or reference images you choose. This content comes from what you enter, record, or select in the app; it is not collected from your device's other files or conversations.

Location Data: Optional country and city information, either auto-detected by IP address or manually entered. Used for showing regional dream trends and, as part of an aggregated country breakdown, the reach of dreams you engage with (see below).

Usage Data: Google Analytics for Firebase collects feature usage, generic screen names, engagement times and an installation/browser identifier, plus the device and network information its SDK collects. We do not send dream text, recordings, search terms, email addresses or account IDs with these events. Advertising storage, advertising personalization and Google signals are disabled.

Website Traffic: On the website (not the mobile app), Cloudflare Web Analytics counts page views and measures page speed. It sets no cookies, does not identify you across sites, and receives page addresses without query strings, along with your browser, device type, referring site and country as Cloudflare derives it from the connection. Turning usage analytics off or Global Privacy Control keeps it from loading on later pages.

Activity Counts: While you are signed in and the app is open on screen, it tells our servers about once a minute that your account is active, with the platform (web, Android or iOS) and the country of the connection as Cloudflare reports it. This record never includes your IP address. We keep one record per account per day for 90 days and use it only for aggregated counts of active and online accounts. Turning usage analytics off or Global Privacy Control stops it. We also measure how long our servers take to respond, totalled per type of page without addresses or account details. When you open Owlnyx, the app reports once per browser tab or app launch which website sent you (only its name, such as google.com, never the page address), any campaign tag in the link (utm_source), and whether you use the web or mobile app; we keep only per-minute totals, without your IP address or account, for 14 days. Turning usage analytics off or Global Privacy Control stops it too.

Technical Failures: Firebase Crashlytics collects mobile crashes and technical errors, including startup/WebView load failures. Reports include technical stack traces, app/device/OS details and an installation identifier. Our custom error reports exclude journal content, credentials and private URLs. Browser errors use fixed technical categories in Analytics, not raw error messages.

AI features (opt-in): Account-wide AI processing is off until you allow it in the in-app prompt or Privacy settings. After you allow it, content is sent only when you use a feature that needs an AI provider. Turning account-wide consent off blocks future account-level AI requests; it does not retract data already sent, erase provider records, or delete results already saved in your journal.

Translation of shared dreams: Anyone who can read a dream you share can ask for an AI translation of the parts you share with them (text, analysis, or image captions). A translation request may send that shared text to OpenRouter when a translation needs to be generated; an existing cached translation can be served without another provider request. This works independently of your account-wide AI setting, because it only covers text you already chose to show that viewer. To stop it, narrow the dream's audience or stop sharing that part of the dream; this does not erase data already sent to the provider or cached translations already stored by Owlnyx.

Feature purposes and recipients: OpenRouter processes the text you submit for dream analysis, AI chat, translations, moderation, and image planning. Owlnyx currently uses Z.AI's GLM 5.3 Flash as its default text model; the selected model provider may vary. Voice transcription sends your recording to OpenRouter's transcription endpoint using OpenAI Whisper; this endpoint does not accept per-request ZDR routing, so it is available only while account-level ZDR is enabled for Owlnyx's API key. Image generation sends the generated prompt and any reference images you select to Runware. Runware ZDR has not been enabled for Owlnyx, so these requests use Runware's standard terms, not ZDR. Runware says it does not use API data to train or improve models. Owlnyx requests generated image data inline and stores it in your journal rather than using a Runware output URL. Runware's documentation says output URLs are available for seven days without ZDR, but does not specify standard retention for prompts or input images; we have not confirmed those periods. Read Runware's ZDR and retention documentation. If Runware cannot complete a request, the same prompt and reference images are sent to ImageRouter as a fallback, which forwards them to Runware or Replicate to generate the image. Owlnyx uses ImageRouter's ephemeral mode, so ImageRouter does not store the prompt or the generated image and deletes input images after processing; the provider it forwards to may retain them under its own terms. If ImageRouter cannot complete it either, they are sent directly to Replicate, which deletes API inputs and outputs after an hour by default; Owlnyx downloads the generated image right away and stores it in your journal. Read ImageRouter's privacy documentation.

Personalization: Profile details may help storyboard images keep the dreamer visually consistent. Dream analysis is based primarily on the dream text itself.

Dream Trends: If you opt in, anonymized and aggregated dream data may be used to show community-level trends (e.g., common themes in your country). Individual dreams are never identifiable.

Engagement visibility: When you like or open another member's dream while signed in, its author can see your name, profile and when you did it. When you save a dream, the author sees only when it was saved, never who saved it. Authors also see the countries of the people who liked, saved or viewed their dream as an aggregated breakdown in which countries with fewer than 3 people are grouped together.

Service Improvement: Aggregated usage analytics help us improve features and fix bugs.

Your data is stored in SurrealDB, a self-hosted database on our secure servers. Data is encrypted in transit with TLS. Provider-managed storage encryption may apply depending on the storage service used.

Voice recordings are stored in S3-compatible object storage and are only accessible by you.

Passwords are never stored in plain text — they are hashed using industry-standard algorithms.

We use the following third-party services:

• SurrealDB — Database software and infrastructure
• OpenRouter — Routes text features to selected model providers; Owlnyx's current default is Z.AI's GLM 5.3 Flash. Voice transcription sends the recording to OpenRouter's transcription endpoint using OpenAI Whisper. The transcription endpoint does not accept per-request ZDR routing settings, so it is available only while account-level ZDR is enabled for Owlnyx's API key. Content is still sent to and processed by external providers.
• Runware — The primary image-generation provider. Image requests send the generated prompt and any selected reference images to Runware; Owlnyx requests generated results as image data rather than temporary provider URLs, then stores them in Owlnyx-managed object storage. Runware ZDR has not been enabled for Owlnyx, so these requests use Runware's standard terms, not ZDR. Runware says it does not use API data to train or improve models. Its documentation says output URLs are available for seven days without ZDR, but does not specify standard retention for prompts or input images; we have not confirmed those periods. See Runware's ZDR documentation.
• ImageRouter — The fallback image-generation provider, used only when Runware cannot complete a request. It receives the same prompt and selected reference images and forwards them to Runware or Replicate. Owlnyx uses its ephemeral mode, so ImageRouter does not store the prompt or the generated image and deletes input images after processing; the provider it forwards to may retain them under its own terms, which are not ZDR. See ImageRouter's privacy documentation.
• Replicate — The second fallback image-generation provider, used only when Runware and ImageRouter cannot complete a request. It receives the same prompt and selected reference images and runs the same FLUX.2 [klein] model. Replicate says inputs, outputs, and logs of API requests are deleted after an hour by default; Owlnyx downloads the generated image right away and stores it in Owlnyx-managed object storage. This processing is not ZDR. See Replicate's data retention documentation.
• S3-compatible object storage and CDN providers — Voice recording, generated image, and media storage/delivery
• Payment gateways, merchant-of-record providers, subscription platforms, and app stores — Payment, subscription, receipts, refunds, and app-store billing where applicable
• Email providers — Account email, verification, support, and service notifications
• IP Geolocation APIs — Optional location detection
• Google Analytics for Firebase and Firebase Crashlytics — Usage measurement and mobile reliability. See Firebase privacy information.
• Cloudflare Web Analytics — Cookieless website traffic and page-speed measurement. See Cloudflare Web Analytics.

We do not sell your personal data. Each provider receives only the content needed for the AI feature you request and processes it under its applicable terms; provider retention, security, and data-use controls differ. OpenRouter text requests require ZDR-compatible model endpoints and deny provider data collection. Voice transcription is available only while account-level ZDR is enabled for Owlnyx's OpenRouter API key. Runware image generation is not covered by ZDR while its organization-level option is disabled; its published documentation states that it does not use API data to train or improve models, but we have not confirmed standard retention for prompts or input images. The ImageRouter fallback is not covered by ZDR either: ImageRouter does not store prompts or results in the mode Owlnyx uses, but Runware or Replicate may retain them under their terms. The Replicate fallback is not ZDR; Replicate says it deletes API request data after an hour by default. You can decline or revoke AI-processing consent; declining prevents the requested content from being sent. Do not submit content unless you are comfortable with the listed recipients and practices.

You have the right to:

• Access your data — all your dreams and profile information are visible in the app
• Edit or delete any dream entry or profile information at any time
• Delete your account — in Settings → Account, or by email; your data is permanently deleted 30 days after the request, except records we must keep. See how account deletion works
• Opt out of anonymous statistics sharing via Privacy settings
• Turn off usage analytics in Settings → Privacy. Collection is automatic by default; the preference applies immediately to this device/browser and also stops its server-side usage events. Global Privacy Control disables browser usage collection; Do Not Track is not used, because it has no agreed meaning. Mobile Crashlytics reporting is separate and remains enabled for technical failures.
• Export your dream data (available to premium subscribers)

Analytics uses cookies and local storage for its browser identifier and your choice. Turning collection off does not delete reports already received by Google. Our operational and security logs are separate from usage analytics.