Consumer Health Data Privacy Policy
The short version
- Dreams can reveal things about your health, and Dremr's readings are written from your dreams. In some states that makes them consumer health data.
- We use it only to run your journal: to store your dreams, write your readings, and show the 988 Lifeline when a dream mentions wanting to die or to hurt yourself.
- Only two service providers receive it, both working for us under contract: Google (hosting) and OpenAI (the AI that writes readings and turns speech into text). We never sell it and never use it for advertising.
- You can see it, get a copy, delete it, or withdraw your consent at any time. We answer within 45 days, and you can appeal.
1. Who this policy is for
This policy is published by Moonshine Labs LLC, a Florida limited liability company ("Moonshine Labs", "we", "us"), which makes the Dremr app. It covers "consumer health data" as defined by the Washington My Health My Data Act (RCW 19.373), Nevada's consumer health data law (Senate Bill 370, NRS 603A.400 to 603A.550) and Connecticut's Data Privacy Act. We apply it to everyone who uses Dremr, wherever they live.
It sits alongside our Privacy Policy, which covers all the personal data Dremr handles. Where this policy is more specific about health data, this policy applies.
2. What we collect
Dremr does not connect to Apple Health and does not ask you about your health. But a dream journal can still reveal health information, so we treat the following as consumer health data:
| Category | What it is |
|---|---|
| Your dream entries | The dreams you write or dictate, with their dates, titles, tags and notes. A dream may mention your physical or mental health, your feelings, your sleep, your body, medicines, illness, pregnancy or sexuality, or what you are going through. We do not know in advance which entries do, so we treat all of them as health data. |
| Voice recordings | When you dictate a dream, the audio is sent to be turned into text. We do not keep the recording, and the app deletes it from your phone once it has been transcribed. Only the text is saved. |
| The care note | A yes-or-no note, stored with a dream, that records whether the dream seems to mention you wanting to die or to hurt yourself. It is written by our AI provider's reading of the dream, not by a person. When it is set, the app shows the 988 Suicide & Crisis Lifeline beside that dream. |
| Readings | What the app writes from your dreams: emotions, themes, symbols, patterns over time, the situations that keep coming back and how you respond to them, your Insights page, and any feedback or corrections you give on them. Some of these describe how you feel or what you may be going through. |
| People and places you name | The people and places in your dreams and the labels you give them, which can include health details (for example, a doctor or a hospital). |
We do not collect precise location, biometric data, or data from health devices or Apple Health. Your age in years at sign-up, which we keep to show you are 18 or older, is not health data and is covered by the Privacy Policy.
3. Where it comes from
- You. Everything you write, dictate, label or correct in the app.
- Our AI provider, working for us. The care note and the readings are produced from your entries by OpenAI's models, on our instructions.
We do not buy health data, and we do not get it from data brokers, other apps, advertisers or anyone else.
4. Why we collect it and how we use it
We collect and use consumer health data only to provide the journal you asked for:
- To keep your journal. Storing your dreams, showing them back to you on your devices, and keeping a copy on your phone so the app opens quickly.
- To write your readings. Sending a dream's text to our AI provider when you finish telling it (before you save it), again after you save it, and when your Insights page is written, and storing what comes back.
- To show the 988 Lifeline. Setting the care note and showing the Lifeline beside a dream that seems to mention wanting to die or to hurt yourself. No one is alerted, and no one at Moonshine Labs watches for it.
- To turn your voice into text when you dictate a dream.
- To keep the service working and secure. Backups, fixing problems, and enforcing the daily limit on saved dreams.
- To answer you and follow the law. Handling requests you send us, and responding to valid legal process.
Your data is processed automatically by software. We do not read your entries except when you ask us to help with a problem, or when the law requires it. We do not sell consumer health data, use it for advertising, use it to train AI models, use it to make decisions about you that have legal or similar effects, or set up any geofence around places where people get health care.
5. Who receives it
We do not sell or share consumer health data with third parties for their own use. We disclose it only to the service providers (in legal terms, "processors") that run Dremr for us, each under a contract that limits them to processing it on our instructions:
| Who | Category | What they receive, and why |
|---|---|---|
| Google LLC (Firebase Authentication, Cloud Firestore, Cloud Functions, managed backups) | Cloud hosting provider | All the categories in section 2, to store your journal, run our servers, and keep encrypted backups. |
| OpenAI, L.L.C. (language model and speech-to-text APIs) | AI service provider | Dream text, the labels on your dreams and the names you give people and places, to write the readings and the care note; and dictated audio, to turn it into text. OpenAI may not use this data to train its models. Under its published API data policy it keeps what it receives and returns in abuse-monitoring logs for up to 30 days, longer only where the law requires, and then deletes it. |
Affiliates. Moonshine Labs has no affiliates, so no affiliate receives your data.
Other disclosures. We may disclose consumer health data where the law requires it, for example to comply with a valid court order or subpoena. If Moonshine Labs is ever merged or sold, your data may move with the business, and we will tell you before it becomes subject to a different policy. If we add a new kind of recipient, we will update this policy and ask for your consent first.
6. Your consent
When you create an account, we ask for your consent to collect and use consumer health data as this policy describes. That consent is a separate tick, apart from accepting the Terms of Service and the Privacy Policy, and we record when you gave it and which version of this policy you saw. We use your data only for the purposes in section 4; for anything else we would ask you first.
You can withdraw your consent at any time by deleting your account in the app (Profile → Delete Account) or by emailing us (section 8). Because Dremr cannot work without processing your entries, withdrawing consent means closing your account.
7. How long we keep it
- We keep your entries, care notes and readings while your account exists.
- When you delete a dream, it is removed at once, with its readings and its care note.
- When you delete your account, everything is removed from our live database at once, and the copies on your phone are removed when the app signs you out.
- Google keeps encrypted backups of our database for recovery after a failure: a daily backup that expires after at most 90 days, and a rolling 7-day record. Deleted data leaves the backups as they expire, within 90 days.
- OpenAI deletes what it received within 30 days, as described in section 5.
8. Your rights and how to use them
You have the right to:
- Know and access. Ask whether we collect, share or sell your consumer health data, get a copy of it, and get a list of every third party and affiliate it has been shared with or sold to, with a way to contact them. (We have never sold it, and the only recipients are those in section 5.)
- Delete. Ask us to delete your consumer health data. You can also do this yourself, a dream at a time or your whole account, in the app. When we delete it, we also tell our service providers to delete it.
- Withdraw consent. Take back your consent to our collecting and using it, as section 6 explains.
- Correct. Ask us to correct data that is wrong. You can edit or delete any dream in the app, and correct many readings directly.
How to ask. Email support@moonshinelabs.app from the email address on your Dremr account, and say what you would like. We check a request by confirming it came from that address, and we may ask you to confirm from it again before deleting anything. Someone you authorize can ask for you, with your written permission.
When we answer. We will answer within 45 days of receiving your request. If we need more time, we may extend that once by another 45 days where reasonably necessary, and if we do, we will tell you why within the first 45 days. Requests are free.
9. Appeals
If we turn down your request, in whole or in part, you can appeal. Reply to our decision, or email support@moonshinelabs.app with the subject line "Appeal", within a reasonable time after you receive it. We will answer your appeal in writing within 45 days, explaining what we did and why.
If we deny your appeal, you can complain to your state's attorney general:
- Washington: atg.wa.gov
- Nevada: ag.nv.gov
- Connecticut: portal.ct.gov/ag
10. No tracking across websites
Dremr and our website have no advertising, analytics or tracking tools. No third party collects consumer health data about you over time or across other websites or apps through Dremr.
11. Changes to this policy
If we change this policy, we will update the date at the top of this page and keep the earlier version online. If the change is material, for example a new category of data, a new recipient or a new purpose, we will tell you in the app before it takes effect and ask for your consent again.
12. Contact us
Questions or requests about your consumer health data:
support@moonshinelabs.app
Moonshine Labs LLC, Florida, United States