Privacy Policy

Last updated 29 October 2026 (version 1.1)

A dream is about the most private thing you can record, and you record it half asleep. This policy explains, in plain words, what personal data Instadreams collects, why, who helps us process it, how long we keep it, and the rights you have over it.

It covers the Instadreams app for iPhone and Android and the website instadreams.com.

1. Who we are
2. What we collect
3. Sensitive things in dreams
4. How we use it, and why we may
5. How AI is used
6. Who we share it with
7. Transfers outside the UK
8. How long we keep it
9. How we protect it
10. Your rights
11. Cookies and tracking
12. Children
13. Changes to this policy
14. Contact and complaints

1. Who we are

Instadreams is run by Selfound Ltd, a company registered in England and Wales (company number 16450921), registered office Unit 82a James Carter Road, Mildenhall, Bury St. Edmunds, IP28 7DE, England. We are the controller of your personal data, and we are registered with the Information Commissioner's Office (ICO) under number ZC275470.

For anything about privacy, write to alex@instadreams.com. We have not appointed a Data Protection Officer; privacy questions go straight to the person who runs the service.

2. What we collect

What you give us

• Your dreams: the audio recording, the transcript, the cleaned-up text, the title, the tags, the cover image we make for it, any notes you add, the detected language, when you recorded it (with your time-zone offset), and whether the recording started from an alarm.
• Your account, if you make one: your email address and your password. We store only a one-way hash of the password, never the password itself. An account is optional: as a guest, your dreams are tied to a random token kept on your phone instead.
• If you sign in with Apple or Google: we receive your email address (with Apple, this may be a private relay address that forwards to you) and a stable account id that Apple or Google gives us for you. We keep them to recognise you when you sign in again. For Apple we also keep an encrypted token, used only to revoke the app's access on Apple's side when you delete your account. Signing in with Apple or Google sends them nothing about you or your dreams. To get that token, our server sends Apple the one-time sign-in code Apple gave the app, and when you delete your account it sends Apple the token so Apple can revoke it. We send Google nothing.
• The launch waitlist: if you join it on instadreams.com, your email address and when you joined.
• Messages you send us, for example a support email.

What the app records as it works

• A push token and your phone's platform (iOS or Android), so we can tell you when a dream is ready.
• A few yes/no facts per day: whether an alarm is set, whether you allowed notifications, and your phone's platform.
• Usage records tied to your account or guest token: how many dreams were processed, how many of your monthly free images you have used, and what processing cost us. They hold no dream content.
• Data exports you ask for, as an archive file.
• Technical data whenever the app or your browser talks to our servers: your IP address, the time and the request made. If something breaks, an error report (see Sentry in section 6).

What stays on your phone

• Your alarms and their settings.
• The live words you see while recording on iPhone come from Apple's speech recognition running on the phone itself. That preview is never saved or sent anywhere. (It is switched off on Android, where it could not be kept on the phone.) The recording itself is uploaded to us and stored, as described in section 5. On iPhones with iOS 26 or later, a separate transcript is made on the iPhone after you finish recording, where it can be. That transcript is saved and sent to us ahead of the recording, as section 5 describes.
• The app lock: Face ID, Touch ID and fingerprint checks are done by your phone. We never receive any biometric data.
• Share cards are saved to your photos only when you tap Save to Photos. The app never reads your photo library.

The app uses your microphone only while you are recording. We do not collect your location, your contacts, your photos or any advertising identifier.

3. Sensitive things in dreams

Dreams can reveal sensitive things about you, such as your health, your sex life or sexual orientation, your religious or political beliefs, or your ethnic origin. The law calls this "special category" data and protects it more strongly.

You choose what you record. We process what is in your dreams only with your explicit consent, which the app asks for before your first dream is processed. Processing your dreams is the service itself, so without that consent the app cannot write up or illustrate them. You can withdraw your consent at any time by deleting your dreams or your account; this does not affect processing that happened before.

Dreams often mention other people. We use those mentions only to run the app for you, and we remove the names we detect before anything is sent to make your image.

4. How we use it, and why we may

The law requires a reason, called a legal basis, for each use of personal data. Here is ours for each one.

Where we rely on legitimate interests, you can object, as described in section 10.

We do not send marketing emails, we do not show ads, and we do not build profiles of you. AI writes text and pictures for you, but no automated decision is made about you that has a legal or similarly significant effect.

5. How AI is used

• OpenAI: on iPhones with iOS 26 or later, your recording is transcribed on the iPhone where it can be, and that text is sent to us ahead of the recording. Otherwise, and whenever the recording reaches us first, OpenAI receives the audio to turn it into text. The recording itself is always uploaded and stored on our servers. OpenAI then receives the transcript to tidy it up, give it a title and tags, and write a short English description of the scene for the image.
• Google Gemini (paid tier) draws your cover image. It receives only that short English scene description, never your audio or your transcript. We tell the model not to include people's names, and we remove the names we detect before sending.

Under their terms for business customers, neither provider uses the data we send to train its models. Each may keep it for a limited time to detect abuse, under its own policy.

AI can get things wrong: a word misheard, a detail invented, an image that misses. Your original recording is kept, so you can always listen to what you actually said.

6. Who we share it with

We use these companies to run Instadreams. They process your data only on our instructions, under contracts that require them to protect it.

• Hetzner Online GmbH, Finland: our servers and database. Privacy policy
• Cloudflare, Inc.: stores your audio, images and export archives, and our encrypted nightly database backups (Cloudflare R2). It also answers the internet's lookups for instadreams.com. Privacy policy
• OpenAI: transcription and write-up, as described in section 5. Privacy policy
• Google (Gemini API): the cover image, as described in section 5. Privacy policy
• Mailgun (Sinch), EU region: sends the welcome email, and the launch email to the waitlist. It receives your email address and the message. Privacy policy
• Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging, on Android): deliver push notifications. They get your push token and the notification text. While the app lock is off, that text includes your dream's title (for example: Your dream has a name). With the lock on, it says only that your dream is ready.
• Apple and Google, if you choose to sign in with them: they tell us your email address and account id, as described in section 2. Signing in sends them nothing about you or your dreams. Our server sends Apple only the one-time sign-in code, and, when you delete your account, the token it asks Apple to revoke. What we send Google for your dreams and for push notifications is described above.
  
  When you choose Continue with Google, Google's sign-in software inside the app may itself collect data, under Google's privacy policy. According to its iOS privacy manifest (GoogleSignIn-iOS 9.2.0), that can include name, email, phone, coarse location, user ID, device ID, other data and other usage data, linked to you and not used for tracking. We don't receive any of that beyond your email address and a stable account id. Apple's sign-in is part of iOS and is covered by Apple's privacy policy.
• Sentry (Functional Software, Inc.): crash and error reports, only when error reporting is enabled. Reports hold technical details such as the error and internal ids, and never dream content, request bodies, email addresses, IP addresses or tokens. Privacy policy

Apple's App Store and Google Play distribute the app, and will handle payment for any paid feature we offer in future, under their own privacy policies. We never see your card details.

We do not sell your personal data, and we do not share it for advertising. We disclose it to anyone else only if the law requires it, to protect people's safety or our legal rights, or as part of a sale or merger of our business, in which case the new owner must keep to this policy and we will tell you first.

7. Transfers outside the UK

We are based in the UK, and our servers are in the EU. Some of the companies above are in the United States. When your data goes to a country without UK adequacy regulations, we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or on the UK Extension to the EU-US Data Privacy Framework where the company is certified. For users in the EEA, we rely on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. Write to us for a copy of the relevant safeguards.

8. How long we keep it

• Dreams: until you delete them. When you delete a dream, its content is removed from our servers at once and its audio and image within a few minutes, and an empty marker stays so your other devices learn it is gone.
• Your account: until you delete it. Then we delete your dreams, audio, images, export archives and email address at once. What remains is anonymised usage and event counts, which no longer point to you and are kept indefinitely. See how to delete your account, with or without the app.
• Guest data: until you delete it with Settings, Delete everything, or until 24 months pass without the app reaching our servers; then we delete it, leaving only anonymised counts as for an account. Uninstalling the app does not delete the copies on our servers, and afterwards we can no longer tell they are yours, so use Delete everything first if you want them gone sooner.
• Export archives: until you delete your account.
• The encrypted Apple token: if you signed in with Apple, we delete it from your account when you delete the account, and keep a copy only in a queued revocation job until Apple confirms the revoke. The job record is cleared within a week of that. If Apple cannot be reached we keep trying for about a week, and then clear the record within another week, so at most about two weeks after you delete your account.
• Backups: encrypted nightly copies of our database are kept for 14 days and then deleted. A deleted dream or account can remain in a backup until it expires. We restore a backup only to recover from a disaster.
• The waitlist: deleted once the launch email has gone out.
• Messages to us: up to two years after our last exchange.
• Server logs: no more than 30 days.
• Error reports: no more than 90 days.
• Purchase records, once paid features exist: as long as tax law requires, currently six years in the UK.

9. How we protect it

• Everything between the app, the website and our servers travels encrypted (HTTPS).
• Recordings, images, exports and backups are kept in private, encrypted storage.
• Passwords are stored only as bcrypt hashes.
• Access to the systems is limited to what is needed to run and fix the service.
• You can lock your archive in the app with Face ID, Touch ID or your fingerprint.

No system is perfectly secure. If a breach puts your data at risk, we will tell the ICO and you as the law requires.

10. Your rights

If you are in the UK or the EEA

• Access and portability: export everything from the app, or ask us for a copy.
• Correction: edit your notes in the app, or ask us to fix anything else.
• Erasure: delete a dream or your whole account in the app, or ask us (how to delete your account).
• Restriction and objection: ask us to pause or stop a use of your data, including any we base on legitimate interests.
• Withdrawing consent: at any time, as easily as you gave it, without affecting what happened before.
• Complaint: to the ICO or, in the EEA, your local data protection authority (see section 14).

If you are in the United States

Depending on your state, including California, you may have the right to know what personal information we hold about you, to have it deleted or corrected, and to limit the use of sensitive personal information. We use sensitive personal information only to provide the service, and we do not sell or share personal information for cross-context behavioural advertising. We will not treat you differently for using these rights.

How to use them

Most rights work directly in the app. For anything else, write to alex@instadreams.com. It is free, and we answer within one month (45 days for US state law requests), extended only where the law allows and we tell you why. We may need to confirm it is really you, for example by asking you to write from your account's email address.

11. Cookies and tracking

The website sets one strictly necessary cookie, _instadreams_backend_key, which protects the waitlist form against forged submissions. It does not track you and disappears when you close your browser. We use no analytics, advertising or tracking cookies, so there is nothing to consent to.

The app has no cookies, no advertising identifier and no third-party analytics. On Android, Google's Firebase Cloud Messaging creates an installation id on your phone to deliver notifications.

12. Children

Instadreams is not meant for anyone under 16, and we do not knowingly collect personal data from them. If you believe a child under 16 has given us personal data, write to us and we will delete it.

13. Changes to this policy

When we change this policy we update this page and its date. If a change matters to how your data is used, we tell you in the app or by email before it takes effect.

14. Contact and complaints

Selfound Ltd, Unit 82a James Carter Road, Mildenhall, Bury St. Edmunds, IP28 7DE, England
alex@instadreams.com

If you are unhappy with how we handle your data, please tell us first; we would like the chance to fix it. You also have the right to complain to the Information Commissioner's Office at ico.org.uk (0303 123 1113), or, in the EEA, to your local data protection authority, listed at edpb.europa.eu.