Privacy policy

Who is responsible for your data

The Songe AI app and the songeai.com site are published by Manifesting Reality LLC, whose registered office is at 704 Wallace St, Suite 355, Clovis, NM 88101, États-Unis.

For any question about this page, or to exercise your rights, write to contact@songeai.com. You will receive a reply within one month.

The data Songe AI handles

Songe AI collects only what the app needs in order to work. Nothing is collected for advertising purposes.

• Your account: the first time you open the app, it creates your account on its own, with a technical address and a password drawn at random, kept in your phone's secure keychain. Nobody ever reads that address and no message is sent to it. If you then choose to save your journal, your email address and your password (stored in encrypted form, never in the clear) replace those technical credentials. Added to this is the first name you choose to display. Without an account, the app cannot carry your dreams from one device to another.
• Your dreams: the text of each dream, its date, how pleasant it was, how you felt on waking for dreams written while the app still asked, how clear the memory was, the indicators you tick, and any context note you write.
• Your dream profile, if you choose to fill it in: the people around you, the places you live, your animals, and elements of your life context. These fields are optional.
• Analysis results: the elements found in your dreams (emotions, people, places, objects, symbols, themes, needs) and the readings produced, together with the statistics and reports derived from them.
• Your voice recordings, for as long as it takes to transcribe them. Only the resulting text is kept.
• Your subscription, if you take one: the plan, its status (trial, active, ended) and its dates. We never see your bank details.
• Minimal technical data needed to run the service: a session identifier and server technical logs.
• Your waiting list sign-up, if you leave one on this site: your email address, the language of the site, the page you left it on, and the date and IP address of your sign-up. Those last two exist only to prove your consent, as the law requires. This sign-up is used for one thing, telling you when the app is out, and you can leave it at any time.

Why, and on what legal basis

Each processing operation serves a specific purpose and rests on a legal basis within the meaning of the GDPR.

• Providing the service — creating your account, saving and displaying your dreams, analyses, statistics. Legal basis: performance of the contract between us, namely the terms of use you accept when you create an account.
• Analysing a dream with AI — only when you ask, dream by dream. Legal basis: performance of the contract, since analysis is a feature of the service that you trigger yourself.
• Keeping the service secure — preventing unauthorised access and abuse. Legal basis: our legitimate interest in protecting the service and its users.
• Replying to your messages when you write to support. Legal basis: our legitimate interest in answering you.

What is passed to third parties

Your dreams are not sold, rented or transferred to anyone. The only third parties involved are those without which the service cannot run, and they act as processors on our instructions.

• OpenAI, to analyse a dream and to transcribe a voice recording. What is sent: the text of the dream, the details you filled in for it, your context note, and the parts of your profile you completed. What is not sent: your email address, your password and your account identifier. Under the terms that apply to OpenAI's API, content sent to it is not used to train their models; it may be kept temporarily for safety purposes before being deleted.
• Railway Corporation, which hosts the server and the database where your dreams are saved, in a data centre located in the Netherlands.
• Apple, if you take out a subscription through the App Store. Payment is handled by Apple; we receive neither your card number nor your bank details.
• RevenueCat, which manages subscriptions for us: it checks with Apple that a purchase is valid and tells us whether your subscription is active. What is sent: your account's technical identifier (a random code, not your email address), the purchase information Apple provides (plan, dates, price, store country) and technical information about the device (model, system version, language). Never sent: your dreams, their analyses, your profile.
• Public authorities, only on a valid legal request and within the limits of what the law requires.

What never leaves your phone

Some data stays on your device and is never sent to the server.

• The four digit lock code and the biometric unlock setting, held in the system's secure keychain. They are copied neither to iCloud nor to a backup restored onto another device.
• Your drafts, while a dream is still being written and has not been saved.
• Your favourited dreams, which are a local marking.
• The morning reminder setting, and the notification itself, scheduled by your phone.

What Songe AI does not do

This list matters as much as the previous one, and it can be checked: the app contains no analytics library at all.

• No advertising trackers and no analytics, neither in the app nor on this site. That is why you are shown no consent banner.
• No adverts inside the app, and no profiling for advertising purposes.
• No sale or transfer of your data.
• No automated decisions producing legal effects concerning you. A dream analysis is a suggested reading, with no consequence for your rights.
• No sharing of your dreams with other users: the app has no social features.

How long data is kept

• Your dreams and your account: for as long as your account exists. They are deleted when you delete your account.
• An inactive account: nothing is deleted automatically. A dream journal is built over years, and someone returning after a long absence must find their dreams intact. Only your own deletion request erases your account.
• Your session token: seven days, with no automatic extension through use.
• Your voice recordings: for as long as transcription takes. Only the text is kept afterwards.
• Server technical logs: twelve months at most.
• Your messages to support: three years from the last exchange.
• Your waiting list sign-up: until the app is released, then three years at most. If you unsubscribe, your address is kept on a suppression list, long enough to guarantee that we never write to you again.

Your rights

The European data protection regulation gives you rights over your data, which you can exercise at any time.

• Access and portability: in the app, Settings then My data. The export hands you a file containing your dreams, without having to ask anyone.
• Rectification: you can edit your dreams, your profile and your account details directly in the app.
• Erasure: in the app, Settings then Manage my account then Delete my account. Deletion is permanent and immediate.
• Objection and restriction: write to contact@songeai.com.
• Complaint: if a reply does not satisfy you, you can refer the matter to the data protection authority of your country of residence. In France that is the CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or a complaint online at cnil.fr.

Security

Traffic between the app and the server goes over an encrypted connection. Your password is stored in encrypted form and is never readable, by us included. Your session credentials are held in your phone's secure keychain and erased as soon as you sign out. Access to the app can be protected by a four digit code and by face recognition.

No system is infallible. In the event of a data breach likely to result in a high risk to your rights, you will be informed without undue delay, as the GDPR requires.

Minimum age

Songe AI is not intended for people under 15, and no account should be created below that age. If we learn that an account has been opened by someone younger, it is deleted.

Where your data is, and transfers outside the European Union

Better said plainly than left to be guessed: Manifesting Reality LLC is a company incorporated in the United States. Your dreams are stored in the European Union, in the Netherlands, on servers run by Railway Corporation, a company established in the United States. Analysis and transcription involve OpenAI, also established in the United States: the text sent for an analysis, or the recording sent for a transcription, is processed there. Subscription management involves RevenueCat, also established in the United States.

If you live in the European Union, this processing falls under the GDPR, which applies as soon as a service is offered to people located in the Union, whatever the company's own country. Transfers rely on the safeguards the regulation provides, in particular the European Commission's standard contractual clauses and, where applicable, providers' certification under the EU–US Data Privacy Framework.

Changes to this page

This policy may change along with the app. The date it was last updated appears at the foot of the page. If something significant changes, you will be told in the app before it takes effect.