Privacy Policy
How DREAM CODE handles your dreams and your account
Last updated: 15 October 2026
- Who we are
- In short
- What we collect
- How we use it
- AI
- Service providers
- How long we keep it
- Your choices
- Contact
Who we are
DREAM CODE is a dream journal and dream analysis app, the companion to the book The Dream Code: Understanding Your Mind Through the Science of Dreams by Randolph R Beverly Jr. It is made by Empyrean Scientifica, a trade name of Beverly Index LLC, United States ("we", "us"). This policy covers the DREAM CODE app for Android, the DREAM CODE web console at beverly-index.com/dreamcode and the DREAM CODE server they use.
Questions or requests about your information: rrbjr@remielengine.ai.
In short
- Your journal is yours. You can export it at any time, for free, and delete it at any time.
- The private parts of your dreams are encrypted before they are stored on our server.
- To write an analysis or a chat reply, the text needed for it is sent to our AI provider for that request only.
- Paid plans are bought only in the Android app, through Google Play. We never receive your card or other payment details.
- There are no ads in DREAM CODE. We do not sell your information, and we do not share it for advertising.
- The app and the web console contain no third-party analytics or tracking tools.
- DREAM CODE is for adults (18 or older) and is a wellness tool, not a medical service.
What we collect
Your account
When you create an account: your email address, your password (stored only as a salted scrypt hash, never in readable form), the display name you choose, your language, your confirmation that you are 18 or older, the time you accepted the Terms and this policy, and the date the account was created. We also keep your plan, how many analyses and chat messages you have used in the current week or month (to apply your plan's allowance) and, if you use a tester code, which code and when.
Your journal
If you are signed in, each dream you save is kept on our server so it is safe if you lose or change your phone: its title, text, the date you dreamt it, the dream types you choose, the recording details you fill in (such as sleep quality, emotional tone, people, the dominant emotion, how it ended, sensations and intensity), your reflections, its analysis and your chat with Dream AI. These fields are encrypted together with AES-256-GCM before they are stored. So that an overwrite from another device can be undone, earlier versions of the title, text and reflection are kept, encrypted, up to the last 20 versions of each dream.
Kept in readable form beside them: the dream's id, dates and times, a change number used for syncing, the main dream type of its analysis, the id of a community post you shared from it, and a keyed fingerprint (HMAC) of the analysed text, which only tells the server whether the text changed since it was analysed.
Without an account, your dreams stay on your device only and nothing about them reaches our server.
Dream Community (only if you use it)
Your community name (handle), the posts, comments and chat room messages you publish, your likes, the people you block, and the reports you file (the reason and an optional note). When you share a dream, you choose which parts go into the post (title, text, types, symbols); your analysis and reflections are never shared. Community posts, comments and room messages are visible to anyone who opens Dream Community, including people who are not signed in, with your handle and its initials. Your email and display name are never shown. Trends and the symbol map are worked out from visible posts and show no personal information.
Reports about AI content
If you report an analysis or a Dream AI reply, we keep an encrypted copy of the reported AI text (never your dream itself or anything else from your journal), the reason, your optional note, the time and the status of the report.
Moderation and safety
Community suspensions (their end date and reason) and a log of moderation decisions (which moderator took which action on which item, when, and an optional moderator note; the log does not hold the item's text).
Sign-in and technical information
- A record for each signed-in session (an id and its time), so that you can stay signed in for up to 60 days and sign out. The sign-in tokens themselves stay on your device.
- If you ask to reset your password: a hashed one-time token that works for one hour. The reset link is sent to your email address.
- To protect accounts from guessing and abuse, the server limits repeated requests by network address or account. These counts are held in memory for a short time; where one is kept in the database, the network address is replaced by a keyed hash.
- Our hosting provider tells the server which country a request comes from. It is used, without being stored, to decide whether new accounts can be opened there and to show the right crisis support lines.
- Our hosting providers may keep short-lived technical logs (such as network address, time and the page or address requested) under their own policies. Our own server logs never contain dream text, reflections, chat messages, replies, passwords, tokens or email addresses.
On your device
The app keeps a copy of your journal and of changes waiting to sync in the device's browser storage (IndexedDB), together with your sign-in tokens, your settings and the last known account and plan details. The web console also keeps its own files in a cache so it can open offline. Voice input, if you use it, turns speech into text with your device's or browser's speech recognition service (for example Google's); DREAM CODE receives only the text you keep. Morning reminders in the Android app are scheduled on the device and send nothing to us.
Subscriptions and payments
The paid plans (Dreamer and Dream Code Plus) can be bought only in the DREAM CODE Android app, through Google Play Billing; they cannot be bought on the web console. You pay Google under Google Play's terms, and Google handles the payment as an independent party under its own privacy policy. We never receive your card or other payment details, and we do not keep your billing address or your Google account details.
When you buy, the app tells Google Play which DREAM CODE account the purchase is for, using an identifier of that account (a random code, not your email, your name or any other personal detail). The app then hands the purchase token that Google issues to our server. The server asks Google about the purchase, checks that it was made for your account, confirms (acknowledges) it to Google and opens your plan. Google can also notify our server when a subscription renews, changes, is cancelled or ends; the server then reads the subscription from Google again.
For each subscription we keep: the purchase token, the account it belongs to, the product and plan, the billing period (monthly or yearly), the subscription's state as Google reports it, when the current paid period ends, whether it renews automatically, whether it is a test purchase, which purchase replaced it after a change of plan, and when we last checked it. On your account we keep the plan, that it comes from Google Play, and when it ends. We use these records only to open and keep your plan, to stop a purchase from being used by another account, and to refuse purchases that Google does not confirm.
These records are kept while your account exists and are deleted with it. A Google Play subscription that still renews must be cancelled in Google Play before the account can be deleted, because deleting the account cannot stop Google from charging you; the app tells you so if you try. Google keeps its own records of your purchases under its own policies.
How we use your information
- To keep your journal, sync it between your devices, and let you export, import, restore and delete it.
- To write dream analyses and Dream AI chat replies when you ask for them.
- To check community content before it is published, to handle reports, to block, and to moderate.
- To apply your plan's allowance and tell you when it renews.
- To confirm Google Play purchases with Google, and to open and keep your paid plan.
- To keep accounts secure: sign-in, sessions, password reset and limits on repeated requests.
- To show crisis support lines when something you write suggests you may be in danger.
- To answer your messages to support.
We do not use your journal for advertising, we do not sell or rent your information, we do not share it with data brokers or advertisers, and we do not send marketing emails. The only email DREAM CODE sends is the password reset link you ask for.
Artificial intelligence
Dream analyses and Dream AI chat replies are written by an AI model, currently Claude by Anthropic, from what you write. They are reflections for your wellbeing, not medical, psychological or other professional advice, and not a diagnosis. They may be wrong. You can report any analysis or reply from inside the app.
For an analysis we send the dream's text, title, date, the types you chose and your recording details, together with a short list of symbols that recur in your recent analysed dreams. For a chat reply we send the dream's text, title and date, a summary of its analysis, the recent turns of the conversation and your message. Your reflections are not sent. Before something is published in the community, its text is also checked by the AI provider. Each request carries only what it needs.
Anthropic states that, by default, it does not use inputs or outputs of its commercial API to train its models, and that it deletes them within 30 days, except where longer retention applies under its usage policies or the law.
Service providers
We use these companies to run DREAM CODE. They process information on our behalf, only to provide their service to us:
- Vercel: runs the DREAM CODE server.
- Turso: hosts the database where your account and encrypted journal are stored.
- Anthropic: the AI that writes analyses and chat replies and helps check community content.
- GitHub Pages: serves the web console and these pages.
- Resend: sends password reset emails, when password reset by email is turned on.
- Google: distributes the Android app through Google Play and handles the purchase and payment of paid plans through Google Play Billing, as an independent party under Google's own terms and privacy policy. Our server uses Google's Play Developer API to confirm purchases and read their state.
These providers may process information in the United States and in other countries where they operate. We may also disclose information when the law requires it, or to protect the safety of a person when we believe in good faith that this is necessary. If Beverly Index LLC is ever part of a merger or sale, your information would move only under the protections of this policy, and we would tell you first.
Security
Information travels over encrypted connections (HTTPS). The private fields of your dreams, their earlier versions and copies of reported AI text are encrypted with AES-256-GCM before they reach the database. Passwords are stored only as scrypt hashes. The encryption is not end to end: the server holds the key, because it must read a dream to send it for analysis, and because a lost phone should never cost you your journal. No method of storage or transmission is perfectly secure, but we work to protect your information.
How long we keep it
- Your journal: while your account exists. A dream you delete stays in Recently deleted for 30 days, where you can restore it; after that its text, analysis, chat and earlier versions are erased and only its id and deletion date remain, so other devices know not to bring it back. Those remain until you delete your account.
- Sessions: up to 60 days, or until you sign out. Usage counts and password reset records: until you delete your account.
- Subscription records: while your account exists; they are deleted with it.
- Community content: until you delete it or your account. A post or comment you delete is hidden from everyone at once; its text stays in our database until your account is deleted, so reports about it can still be reviewed.
- Reports about AI content: until a moderator resolves them and then 90 days, or until you delete your account, whichever comes first.
- Moderation log: kept to keep the community safe, also after an account is deleted. It holds no item text.
- After you delete your account: we keep only a minimal record that the account existed (its internal id, the dates it was created and deleted, its language and the time the Terms were accepted), with no email, name, handle, password or content, so that no old sign-in can work again.
- Backups: our database provider may keep backups for a limited time, so deleted information may remain in a backup until it expires.
Your choices and rights
- See and take your data: export your whole journal at any time, free, as JSON (which can be imported again) or plain text, from Profile or the Dream Journal.
- Correct it: edit your dreams, your display name and your language at any time.
- Delete it: delete single dreams, community posts and comments, or your whole account in Profile, Delete account. See how account deletion works, including how to ask for deletion by email without the app.
- Community: report or block anyone, and leave the community at any time.
Depending on where you live, you may have further rights, such as to ask what information we hold about you, to receive a copy, to have it corrected or erased, to object to or restrict some uses, or to complain to your data protection authority (in Italy, the Garante per la protezione dei dati personali). Write to rrbjr@remielengine.ai from the email address of your account; we will reply within one month.
Adults only
DREAM CODE is only for people aged 18 or older, and you must confirm your age to create an account. We do not knowingly collect information from anyone under 18. If you believe a minor has an account, contact us and we will delete it.
Changes to this policy
If we change this policy, we will publish the new version here with a new date. If a change is significant, we will tell you in the app before it takes effect.
Contact
Empyrean Scientifica, a trade name of Beverly Index LLC, United States.
Email: rrbjr@remielengine.ai