Daydream Privacy Policy

Information We Collect

• Account information. You sign in with "Continue with Google" (Android and iOS) or "Continue with Apple" (iOS only). Sign-in is handled by WorkOS, and Daydream receives your name, email address, WorkOS user ID and, if your account has one, a link to your profile picture.
• Journal entries. The text of the entries you type or dictate, and the moods and tags that Daydream's AI detects in them.
• AI outputs. Summaries, weekly reflections and highlights, daily prompts, a personal profile and advice that Daydream generates from your entries.
• Your consent. Daydream asks for your consent before it collects entries, and records which version you accepted and when.
• Usage and crash data. App usage events (Firebase Analytics) and crash reports (Firebase Crashlytics), described under "Service Providers" below.
• Error reports. When something fails, the app sends a redacted error report to the Daydream server with the error type, a redacted message and stack trace, the screen or API request that failed, your user ID, the app version and your phone's operating system.
• AI content reports. If you use the Report control on AI text, Daydream receives the reported AI text, the reason you pick and your optional note.
• Support email. If you email hello@ppv.digital, we receive your email address and your message.

Daydream has no location permission and does not collect your precise location, contacts or voice recordings. Firebase Analytics derives an approximate location, such as your city or country, from your IP address.

Voice Entries Stay on Your Phone

When you record a voice entry, Daydream transcribes it on your phone with a speech model that the app downloads once from GitHub (over Wi-Fi by default). Voice transcription is in English.

The audio never leaves your phone. Only the text you save is sent to Daydream.

When you use Photo, the photo of your page is sent to Daydream's own server and read by Daydream's own AI. The photo is deleted after the read, and at most 2 days later if a read fails. Only the text you save is kept.

How We Use Your Information

• To store, sync and show your journal on your phone
• To create summaries, moods, tags, weekly reflections, daily prompts, your profile and advice from your entries
• To sign you in and keep your account secure
• To find and fix crashes and errors
• To review AI content reports and answer support email

Reminders are local notifications scheduled on your phone.

We do not use your entries for advertising, and your entries are not used to train AI models.

AI Processing

Daydream's AI features run only on AI servers operated by PPV Enterprises LLC (PPV). To create summaries, moods, tags, reflections, prompts, your profile and advice, the Daydream server sends the relevant entry text or profile to those PPV servers over HTTPS through Cloudflare.

No third-party AI company receives your diary text, and there is no fallback to an outside AI provider. If the PPV AI servers are unavailable, the AI feature is delayed or shows that it failed so you can retry.

AI output can be wrong. It is for personal reflection and is not medical advice.

Service Providers

These service providers process data for us to run Daydream:

• Amazon Web Services (AWS) hosts the Daydream API, database (DynamoDB), task queue and logs in the us-east-1 (N. Virginia) region in the United States, and stores your account, entries, AI outputs, AI content reports and error reports.
• Cloudflare carries the HTTPS network traffic between the app and the Daydream API, and between the Daydream server and the PPV AI servers; it processes the IP address of your device to deliver that traffic, and your requests, including entry text, pass through its network.
• WorkOS runs sign-in for Continue with Google and Continue with Apple and gives Daydream your name, email address, user ID and profile picture link.
• Google Firebase Analytics receives app usage events (for example, that an entry was created or Insights was opened), an app-instance identifier and basic device information; it never receives your entry text, moods, tags or AI output.
• Google Firebase Crashlytics receives crash reports with your device model, operating system and app version; crash messages are redacted to remove entry text before they are sent.
• GitHub serves the one-time speech model download and receives no entry text or audio.
• Google AdMob shows banner ads in the app. It receives a device identifier (on Android, the advertising ID), your IP address and basic device and app information, for advertising, measurement and fraud prevention. Daydream requests non-personalized ads only and never sends AdMob your entries, moods, tags or AI output.

Ads and No Sale

Daydream shows small banner ads served by Google AdMob. Daydream requests non-personalized ads only and does not ask to track you across other companies' apps or websites. We do not sell your personal data.

Security

Data travels between the app and our servers over HTTPS (TLS). On our servers it is stored in Amazon DynamoDB, which AWS encrypts at rest.

Daydream also encrypts these fields with AES-256-GCM before storing them: entry content, summaries, advice, profile text, weekly reflection narratives, daily prompts, and the notes and AI-text snapshots in AI content reports.

Moods, tags, timestamps and weekly highlights are not field-encrypted; they are protected by AWS encryption at rest only.

On your phone, Daydream keeps your journal in an encrypted database (SQLCipher), and sign-in tokens are kept in the phone's secure storage.

No system is perfectly secure, and we cannot guarantee against every loss or breach.

Reporting AI Content

Summaries, advice, weekly reflections, daily prompts and your profile each have a Report control. A report sends us the reported AI text, the reason you pick and your optional note, and we keep it for 180 days or until you delete your account.

Data Retention

• Your account, entries and AI outputs are kept while your account exists.
• AI content reports are kept for 180 days or until you delete your account.
• Error reports sent to the Daydream server are deleted automatically after 30 days.
• Server logs are kept for 30 days.
• Database backups (point-in-time recovery) hold a rolling 35 days of history, so deleted data leaves the backups within 35 days.
• Background tasks that fail are held in a failed-task queue for up to 14 days and then discarded.
• Firebase Analytics and Crashlytics data is kept under the retention settings of our Firebase project.

Deleting Your Account

You can delete single entries in the app at any time. To delete your account, open Daydream and go to Settings > Delete Account.

This deletes your Daydream account record and the Daydream data stored with it on our servers: entries, summaries, moods, tags, weekly reflections, daily prompts, your profile, advice and AI content reports. It also signs you out and clears the journal stored on your phone.

Deletion runs in the background and normally finishes within minutes. Copies can remain in database backups for up to 35 days and in server logs for up to 30 days, and then expire. Error reports the app sent before the deletion include your user ID and are deleted automatically 30 days after they were sent. We keep a record that the deletion was requested and completed (your user ID, the time and its status).

Your shared PPV sign-in is kept, because the same sign-in works for other PPV apps. To delete that shared sign-in too, email hello@ppv.digital from the address you sign in with.

If you cannot open the app, see how to delete your Daydream account by email.

Your Choices

• Turn off "Share usage analytics and crash reports" in Settings > Data & Privacy to stop Firebase Analytics and Crashlytics collection.
• Export a copy of your journal with Settings > Export Data.
• Turn off reminders in your phone's notification settings.
• Delete entries at any time, or your account with Settings > Delete Account.
• Email hello@ppv.digital to ask for access to, correction of or deletion of your data.

Consumer Health Data (Washington and Other States)

Your entries can include information about your mental or physical health. Washington's My Health My Data Act and similar state laws treat this as consumer health data.

Our Consumer Health Data Privacy Policy lists the health data we collect, why, where it comes from, who receives it, and how to access or delete it, withdraw consent or appeal a decision.

Eligibility: Adults in the United States

Daydream is for adults 18 or older and is offered only in the United States. It is not directed to children, and we do not knowingly collect data from anyone under 18. If you believe a child has an account, email hello@ppv.digital and we will delete it.

Not Medical Advice

Daydream is a journal. It is not a medical device and does not provide medical advice, diagnosis or treatment. If you are in crisis or thinking about suicide, call or text 988 (Suicide & Crisis Lifeline, United States).

Changes to This Policy

When we change this policy, we update the "Last updated" date at the top of this page.

Contact

PPV Enterprises LLC. Email hello@ppv.digital with any privacy question or request.