Privacy Policy

Dreamtime (“we”, “us”, “our”) is committed to protecting the privacy of you and your family. This policy explains what personal data we collect, how we use it, and your rights under UK GDPR.

If you have any questions, contact us at privacy@trydreamtime.com.

1. Who we are

Dreamtime is an AI-powered bedtime story service. We are the data controller for all personal data collected through our app and website.

2. What data we collect

Account data

• Email address and password (hashed) used to create your account
• Household name and timezone
• Subscription and billing status (payment details are held by our payment processor, not us)

Children's data

• First name and date of birth for each child you add
• Story theme and value preferences you select for each child

We do not collect any data directly from children. All children's data is provided by the parent or guardian managing the account. We treat children's data with heightened care and do not use it for any purpose other than generating personalised stories.

Usage data

• Stories generated and read (to power streaks and progress tracking)
• App interactions (to improve the service)
• Device type and OS version (for technical support)

Where you came from

• When you sign up through our website, or install our Android app from one of our Google Play links, we store the campaign parameters in the link you arrived by (utm_source, utm_medium, utm_campaign, utm_content), the time you landed, and any ad click id the link carried (such as Meta's fbclid or Google's gclid), so we can tell which of our campaigns bring people in. For an app install, the app reads these parameters from Google Play the first time you open it and sends them to us only when you create your account; an install that did not come through one of our links stores nothing. Section 8 explains how the Meta click id is used.

3. How we use your data

• Story generation: a child's age and your chosen theme and value preferences are sent to our AI provider (Anthropic) and used to generate a personalised story. A child's first name is also sent, but only as an instruction for the model to avoid it: the name is never used to generate or personalise the story and never appears in the finished story. Anthropic is contractually prohibited from using this data to train its models, and deletes it within 30 days, apart from limited cases where it must retain content for safety or legal reasons.
• Illustration generation: illustration prompts (which contain no personal data) are sent to our image generation provider (Fal AI).
• Audio narration: story text is sent to our text-to-speech provider (Inworld AI) to generate audio. No personal data is included in these requests.
• Account management: to provide, maintain, and improve the service.
• Communication: to send service-related emails (e.g. password resets). We will only send marketing emails if you have opted in.
• Billing: subscription management via our payment processor.
• Advertising measurement: if you arrived from one of our Meta ads and then tap a download or sign-up button, sign up, or subscribe on our website, we tell Meta about it from our servers so we can see which ads work. Section 8 explains exactly what we send and how to object. There are no advertising cookies or pixels on our website. The Dreamtime iOS and Android apps do not share any data with Meta or any other advertising partner.

4. Legal basis for processing

• Contract: processing necessary to provide the service you have subscribed to.
• Legitimate interests: improving our service, fraud prevention, security, and measuring how our advertising performs (see section 8). You can object to any of these.
• Consent: for marketing emails, which we send only if you opt in.
• Legal obligation: where we are required to retain data by law.

5. Data sharing

We do not sell your personal data. We share data only with the third-party service providers needed to operate Dreamtime:

• Supabase: database and file storage (EU region)
• Anthropic: AI story generation
• Fal AI: illustration generation
• Inworld AI: audio narration
• Stripe: payment processing on our website
• RevenueCat: subscription management for in-app purchases on iOS and Android
• Resend: sending transactional emails
• Expo: delivering push notifications, via Apple and Google's push services
• Better Stack: crash and error reporting, and service monitoring
• Plausible: website and app analytics, self-hosted by us, cookieless, and collects no personal data
• Meta Platforms: advertising measurement for download and sign-up button taps, sign-ups and subscriptions made on our website, only for people who arrived from one of our Meta ads (see section 8)

Our other providers are bound by data processing agreements and are prohibited from using your data for their own purposes. Meta acts as an independent controller for the advertising measurement data we send it; we send it only from our own servers, only about tapping a download or sign-up button, signing up or subscribing on our website, only for people who arrived from one of our Meta ads, and never for anyone who has objected. The Dreamtime iOS and Android apps do not share data with Meta or any other advertising partner, and we do not share data with any other advertising network.

6. Data retention

• Account and household data is retained for as long as your account is active.
• Generated stories and audio are retained indefinitely so your library remains accessible.
• After account deletion, all personal data is removed within 30 days, except where retention is required by law (e.g. billing records for 7 years).

7. Your rights

Under UK GDPR you have the right to:

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct inaccurate data.
• Erasure: request deletion of your data (“right to be forgotten”).
• Restriction: ask us to limit how we process your data.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interests.

To exercise any of these rights, email privacy@trydreamtime.com. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

8. Cookies and advertising measurement

There are no advertising cookies, pixels or tracking scripts on our website, so there is no cookie banner. Our website analytics (Plausible) are cookieless and collect no personal data.

The Dreamtime iOS and Android apps do not share any data with Meta or any other advertising partner. They contain no advertising or tracking SDK, and subscriptions bought in the apps are never reported to Meta.

On our website we measure whether our Meta ads lead to people downloading the app, signing up and subscribing. When you arrive from one of our Meta ads, the link you clicked carries a Meta click id, which we keep with your account when you sign up. If you arrived from one of our Meta ads and then tap a download button (App Store or Google Play) or a sign-up button, sign up, or subscribe on our website, our servers send Meta:

• the type of event (a button tap, a sign-up or a subscription) and, for subscriptions, the subscription's list price and currency;
• with sign-ups and subscriptions, your email address, hashed (SHA-256) so Meta can match it to an account it already knows but cannot read it;
• the Meta click id;
• with button taps and sign-ups only, technical data: your IP address, your browser's user agent and the address of the page;
• with button taps only, which button you tapped (for example the one at the top of the page or the one in the footer).

So a button tap sends the event type, click id, IP address, user agent, page address and which button was tapped, and never your email address; a sign-up sends the event type, hashed email, click id, IP address, user agent and page address; a subscription sends the event type, the subscription's list price and currency, hashed email and click id. That is all we send, only for those three events (tapping a download or sign-up button, signing up and subscribing on our website), and only for people who arrived from one of our Meta ads. If you visit, tap a button or sign up without coming from one of our Meta ads, nothing is sent. We do this under our legitimate interests in knowing which of our ads work, so we spend less on ads that do not. Nothing is sent from your browser to Meta: when you tap a button, your browser tells our own server, and our server tells Meta. Nothing is stored on your device to do this. Meta acts as an independent controller for this data.

You can object at any time: email privacy@trydreamtime.com and we will record your objection and stop sending your data to Meta. If you declined advertising cookies on our website before, and you sign up through our website in the same browser, we exclude you automatically; otherwise email privacy@trydreamtime.com. Button taps are not linked to an account, so we cannot find them afterwards; a browser that declined advertising cookies before never reports them, and neither does a visit that did not come from one of our Meta ads.

9. Security

We use industry-standard security measures including encryption in transit (TLS) and at rest, access controls, and regular security reviews. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security but will notify you promptly in the event of a data breach.

10. Changes to this policy

We may update this policy from time to time. We will notify you of material changes by email or in-app notification. Continued use of Dreamtime after changes take effect constitutes acceptance of the revised policy.

Questions? Email us at privacy@trydreamtime.com.