Privacy Policy — Dream Keeper

Effective from 25 мая 2026. Contact: [email protected].

0. Who processes the data

The data controller is the author and owner of the Dream Keeper project — a private individual acting independently. Contact for any privacy questions and to exercise your rights: [email protected]. The service is experimental and intended for personal use.

1. What I collect

• The text of your dreams and transcripts of voice messages.
• Personal notes on your dreams.
• Analysis and summary results generated by AI.
• Metadata — date/time of sending, voice length, your Telegram user_id and username (if set).
• Payment history via Telegram Stars: transaction id, amount, what was purchased. Card/wallet details — NO (everything stays inside Telegram).

Voice files are not saved to disk — after transcription they are removed from the process's memory. Telegram, like any messenger, temporarily caches voice on its own servers — that is a platform standard and is beyond our control.

2. Where it's stored

An SQLite database on our own server at Hetzner (Germany, EU). Access to the server — owner only (SSH key, not a password). Backups — local snapshots in the same country.

3. The basis on which I process data

For users in the EU/EEA, the legal bases for processing (GDPR Art. 6) are:

• Performance of a contract (Art. 6(1)(b)) — to provide the service to you: accept a dream, analyse it, store your archive, run chat and patterns.
• Consent (Art. 6(1)(a) and Art. 9(2)(a) — see §4) — for processing the content of your dreams. You give it by accepting the terms on first launch; you may withdraw it at any time (see §7–8).
• Legitimate interest (Art. 6(1)(f)) — protection against abuse (anti-spam, anti-exploit) and keeping payment records.

4. Special categories of data (dreams)

The content of dreams and notes may indirectly reveal "special categories" of data under GDPR Art. 9 — for example, health, religious/philosophical beliefs, or details of your sex life. You share this voluntarily, and the processing is carried out solely on the basis of your explicit consent and exclusively to provide the service. This data is never shared with anyone beyond the recipients in §5 and is not used for advertising or profiling.

5. Who we share with

• Google Gemini API — for dream analysis, synthesis, chat, patterns and voice transcription. The text goes out in an API request, the response comes back. Per the Google API terms, paid-tier data is not used to train models. There is no programmatic opt-out parameter in the google-genai v1.51 SDK — protection is ensured by choosing a paid billing-account tier.
• Telegram — for the conversation itself, sending messages and accepting Stars payments. Telegram sees every message you send the bot (as it does with any other bot on Telegram).
• Cloudflare Tunnel — for HTTPS access to the Mini App. Cloudflare sees the fact of a request to our domain, but not its content (TLS end-to-end).

We do not pass data to any third parties, analytics providers, ad networks or data marketplaces.

International transfers. Google (Gemini API) and Cloudflare are companies with infrastructure outside the EEA, including in the USA. Data is transferred to them under their own data-processing agreements and the EU Standard Contractual Clauses (SCCs) those providers publish in their terms. The database and backups themselves are kept in the EU (Germany).

6. How long we keep data

The content of dreams, analyses, notes, patterns and chats is kept until you delete it yourself (see §7) or ask to have your account deleted. Payment records and referral entries are kept for as long as needed for accounting and protection against abuse, after which they are deleted or anonymised. The exact retention period may depend on applicable law.

7. Right to deletion

• /clear in the bot — deletes all your dreams, analyses, notes, patterns and chats in one click (with a button confirmation).
• /forget_me in the bot — the same, but requires typing the word «DELETE» as text + a notice to the owner. Use it if you want to be completely sure everything is wiped.
• Your account, payment history, subscription and referral credits are kept after /clear and /forget_me — they're needed for statistics and anti-abuse. To delete those too — write to [email protected].

8. Your rights

The service is intended for personal use. If you're in the EU/EEA — you have GDPR rights: access to your data, rectification, erasure, restriction of processing, portability, objection to processing and the right to withdraw consent at any time (withdrawal does not affect processing carried out before it). If you're in Russia — Federal Law 152-FZ "On Personal Data" applies (access, correction, blocking, deletion, withdrawal of consent).

To exercise your rights — use /clear or /forget_me, or write to [email protected]; I respond within a reasonable time. If you believe your rights have been violated, you may lodge a complaint with a supervisory authority: in the EU — your country's data protection authority; in Russia — Roskomnadzor.

9. Automated processing

Every dream is automatically checked by an AI classifier for markers of acute crisis — in order to soften the tone of the response and show helpline numbers. This is not a decision producing legal or similarly significant effects for you (GDPR Art. 22): the service does not block, score, or share results about anyone based on this check. Dream analyses are AI hypotheses, not diagnoses (see §13).

10. Age

The service is not intended for children. By using the bot, you confirm that you are at least 18 years old (or the age of majority in your country, but no less than 16 — the minimum age of digital consent under GDPR). We do not knowingly collect children's data; if such data has reached us by mistake — write to us and I will delete it.

11. Cookies and tracking

The Mini App works without cookies and without analytics (no Google Analytics, Yandex.Metrica, Facebook Pixel). Only the Telegram WebApp SDK from the bot's own domain.

12. Security

Mini App pages are protected by UUID4 tokens (unguessable links) and HMAC validation of the Telegram WebApp initData. POST operations (notes, chat, retry) additionally verify that the request came from the content's owner.

13. Disclaimer

Dream Keeper is an experimental AI tool, not a medical device and not a psychotherapy service. I can be wrong, give inaccurate interpretations, misclassify your experiences. If you're going through a hard time — reach out to a professional. See also the Terms of Use.

Policy last updated: 25 мая 2026. Any changes are published here; for material changes (new data recipients, a change to the training opt-out) — a separate notice in the bot.