Is a Dream Journal Private?

A dream journal can end up holding things you would not tell most people. Whether anyone else can read it depends on where it is kept, who holds the keys and which companies get a copy. This guide compares five setups, explains how EU and UK law treats dream content, and ends with ten questions to put to any app.

---

The short answer

A dream journal is only as private as the place it lives. A paper notebook is private as long as nobody else can get to it. A cloud app that is not end-to-end encrypted can be read by the company that runs it (ICO), and an AI journal also sends your entries to an AI provider. Treat your journal as sensitive, and check any app against the ten questions below before you trust it with your dreams.

---

Why is a dream journal sensitive?

Because a run of dreams can say a lot about the person who had them. Researchers working from dream reports alone have shown how much, and research archives treat the reports with care:

• In a blind analysis of 192 dreams from one person, researchers drew conclusions about the dreamer's relationships and interests, and the dreamer confirmed almost all of them (Bulkeley & Domhoff, 2010).
• In another study, dreams found with just a few search keywords led to accurate inferences about religious beliefs (Domhoff & Schneider, 2008).
• The DreamBank research archive changes the names of all non-celebrity characters, and some place names and other details, before it makes dream reports public (DreamBank).

So a journal can show who matters to you, what you care about and what you believe. Religious beliefs, like health and sex life, are among the kinds of data that EU privacy law gives extra protection (GDPR, Art. 9(1)).

---

Are dreams health data under the GDPR?

No court or regulator has ruled on dream journals specifically. But entries that reveal (even indirectly) your mental health, beliefs or sex life can fall under the GDPR's rules for special category data, so treat a dream journal as sensitive data. Here is how the pieces fit together in the EU and the UK:

• Special categories. The GDPR gives extra protection to "special categories" of personal data, including data concerning health, religious or philosophical beliefs, and a person's sex life or sexual orientation (GDPR, Art. 9(1)).
• Mental health counts. "Data concerning health" covers physical or mental health information that reveals someone's health status, whether past, current or future (GDPR, Art. 4(15) and Recital 35).
• Indirect is enough. The EU's top court has ruled that data can fall into these categories even when it reveals them only indirectly, through deduction or by putting pieces of information together (Court of Justice, C-184/20; C-21/23).
• Inferring counts. The UK regulator, the ICO, says that if an organization sets out to infer someone's health, beliefs or sex life, or treats people differently on that basis, it is processing special category data, however confident it is in the inference (ICO).
• Your own notebook is exempt; the app company is not. The GDPR does not apply to a purely personal activity such as keeping your own notebook. It does apply to a company that provides the means for it, like a journal app (GDPR, Art. 2(2)(c) and Recital 18).

When a company keeps your journal, the GDPR gives you rights you can use (GDPR):

• Access: you can ask for a copy of your data (Art. 15).
• Erasure: you can ask for it to be deleted (Art. 17).
• Portability: where the processing rests on your consent or a contract, you can get your data in a structured, machine-readable format to take elsewhere (Art. 20).
• Consent: explicit consent is one of the conditions that let a company process special category data (Art. 9(2)(a)), and withdrawing consent must be as easy as giving it (Art. 7(3)).

Outside Europe, the rules differ. In the US, the Department of Health and Human Services sends health-app developers to an FTC tool that works out which federal laws might apply to an app, including the FTC Act, the FTC's Health Breach Notification Rule and HIPAA (HHS). Which of them, if any, covers a dream app depends on the app, so don't assume; read its privacy policy.

This section explains the rules in plain words; it is not legal advice.

---

Who can read your dream journal?

Anyone who can reach a readable copy, so the answer depends on the setup. MysticLab, which publishes this guide, makes a journal of the last kind in this table (a cloud app that sends entries to an AI), so each row sticks to what the cited documentation says.

Setup	Who can read it	What to check
Paper notebook	Anyone who can pick it up	Where you keep it
App that keeps entries on your phone, with no account	You, and anyone who can unlock your phone	Cloud backups of the phone
Cloud notes, such as Notes on iPhone	Depends on the encryption	Who holds the keys
Cloud journal app	The company, unless entries are end-to-end encrypted	What "encrypted" means there
AI-processed journal	The company, plus the AI provider it sends text to	The provider's retention and training rules

What the documentation says about each:

• Paper has no server, backup or provider behind it, so physical security is the whole story.
• "On-device" doesn't guarantee an entry never leaves the phone, because a phone backup can take a copy. Under Apple's standard protection, the keys to iCloud Backup are kept in Apple's data centers, so Apple can decrypt it on your behalf; with Advanced Data Protection turned on, the backup is end-to-end encrypted (Apple). Android backups are uploaded to Google, and some of the data is end-to-end encrypted with your screen lock PIN, pattern or password (Google).
• Cloud notes vary by app. In iCloud, Notes uses keys Apple holds unless you turn on Advanced Data Protection, while data from Apple's Journal app is end-to-end encrypted by default (Apple).
• A cloud journal app depends on what its encryption covers, which the next section explains.
• An AI-processed journal adds the AI provider's own rules on how long it keeps text and whether it trains on it. Does AI store my dreams? covers that layer in detail.

---

What does "encrypted" actually protect?

It depends on the kind, and only one kind stops the company itself from reading your entries:

• In transit (for example, HTTPS) protects entries on their way to the server. Without further encryption, such as encrypted storage, they are stored on the receiving system in the same plain form they were sent in (ICO).
• On the server means stored data is encrypted, but whoever holds the keys can decrypt it. Apple's standard protection for Notes, for example, is encryption "in transit & on server" with Apple holding the keys (Apple).
• End-to-end means the data can be decrypted only on your own trusted devices, so no one else can read it, not even the company that stores it (Apple).

So "encrypted" on its own does not mean only you can read your journal. Ask which of the three an app means.

---

Which questions should you ask a dream journal app?

Ask these ten, and look for the answers in writing. Most are in the app's privacy policy; the rest are on its security page, in its settings or on its store listing.

• 1. Where is it stored? Only on your device, or on a company's servers, and in which country? Look in: the privacy policy, where it covers storage and transfers.
• 2. Who can read it? Only your own devices (end-to-end), or the company too? Look in: the security page.
• 3. What does "encrypted" mean here? In transit, on the server or end-to-end (see above)?
• 4. Does any text go to an AI provider? Which one, and only after you agree? Look in: the list of processors, sometimes called subprocessors.
• 5. Is it used to train AI? The app's own models, or the provider's? Look in: the policy's AI or training section.
• 6. Is it sold, licensed or shared, even "anonymized"? Look in: the section on sharing or sale.
• 7. What identifiers travel with it? Your email, an account ID, profile details? Look in: the policy's section on processors or AI.
• 8. Can you export it, and in what format? Where processing rests on your consent or a contract, the GDPR lets you ask for a machine-readable copy (Art. 20).
• 9. Can you delete one entry, and everything? Both app stores require apps that let you create an account to let you delete it from inside the app (Apple; Google Play), and Google tells developers to ask their service providers to delete the data too (Google Play). Ask whether deletion reaches backups and providers.
• 10. Do the store labels match the policy? Apple's privacy labels and Google Play's Data safety section are both filled in by the developer (Apple; Google Play). On Google Play, data passed to a service provider that processes it on the developer's behalf doesn't have to be listed as "shared" (Google Play). So "no data shared" does not tell you whether an AI provider sees your entries.

Bonus: if other people use your phone, check whether the app has its own lock or PIN.

---

How does MysticLab answer these questions?

MysticLab's journal app is the fifth setup above: a cloud journal whose AI replies come from OpenAI. Our short answers, with the full detail on the privacy and security page:

• Storage and reading (1–3): your journal is on our server in Helsinki, Finland (EU). It is encrypted in transit, not end-to-end, so our server can read your dreams; it has to, to pass them to Luna, the app's AI character. Spoken dreams reach us only as text: your phone, or Apple's or Google's speech service when the phone can't, does the transcribing.
• AI and training (4–5): OpenAI (USA) writes Luna's replies, only after you agree on a consent screen. OpenAI doesn't train on API data unless a customer opts in, and we haven't. If you withdraw consent in Settings, Luna stops reading new dreams.
• Sharing and identifiers (6–7): we don't sell personal data or show ads. Your email address and account ID are never sent to OpenAI; your display name, age, gender and zodiac sign are, if you added them to your profile.
• Export and deletion (8–9): there is no self-service export yet; email us for a copy. Deleting your account in the app erases it and everything in it immediately. A single dream you delete leaves your journal, and its stored copy is erased when you delete your account. OpenAI may keep API data for up to 30 days to detect abuse, unless the law requires longer.

If you would rather not keep a journal at all, a one-off reading in the web analyzer isn't linked to an account or added to any journal.

---

Frequently Asked Questions

Is a paper dream journal more private than an app?

Usually, yes. A notebook has no server, backup or AI provider behind it, so the main risk is someone picking it up. An app can come close if it is end-to-end encrypted, or keeps entries only on your phone and you check what your backups include. How to keep a dream journal covers choosing between the two for the habit itself.

Can a dream journal app read my entries?

If it stores them on its servers without end-to-end encryption, it technically can. Encryption in transit only protects entries on the way; without further encryption they are stored in readable form on the receiving system. End-to-end encryption means your data can be decrypted only on your own trusted devices, so check which kind the app's security page describes.

Are dreams health data under the GDPR?

Not automatically: no court or regulator has ruled on dream journals specifically. But entries that reveal (even indirectly) your mental health, beliefs or sex life can count as special category data under the GDPR, so treat a dream journal as sensitive data.

Does "no data shared" on Google Play mean nobody else sees my dreams?

No. The Data safety section is filled in by the developer, and data sent to a service provider that processes it on the developer's behalf doesn't have to be listed as shared. An AI provider can be such a service provider, so check the privacy policy's list of processors.

How do I delete my dream journal from an app?

Look in the app's settings: apps on the App Store and Google Play that let you create an account must let you delete it from inside the app. Check whether deleting a single entry erases it straight away and whether deletion reaches the app's providers; under the GDPR, you can also ask the company to erase your data.

In the MysticLab app, AI-assisted dream interpretation comes in one voice that draws on psychology and symbolism and asks you a follow-up question.

---

References

Web pages were checked on 29 September 2026. Policies change, so check the current version before relying on one.

• Bulkeley, K., & Domhoff, G. W. (2010). Detecting meaning in dream reports: An extension of a word search approach. Dreaming, 20(2), 77–95.
• Domhoff, G. W., & Schneider, A. (2008). Studying dream content using the archive and search engine on DreamBank.net. Consciousness and Cognition, 17(4), 1238–1247.
• Schneider, A., & Domhoff, G. W. The DreamBank. University of California, Santa Cruz.
• Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 2(2)(c), 4(15), 7(3), 9(1), 9(2)(a), 15, 17 and 20; Recitals 18 and 35. Official Journal of the European Union, L 119, 4 May 2016.
• Court of Justice of the European Union (Grand Chamber). Judgment of 1 August 2022, OT v Vyriausioji tarnybinės etikos komisija, C-184/20, EU:C:2022:601.
• Court of Justice of the European Union (Grand Chamber). Judgment of 4 October 2024, Lindenapotheke, C-21/23.
• Information Commissioner's Office (UK). What is special category data? Updated 9 April 2024.
• Information Commissioner's Office (UK). Encryption and data transfer.
• U.S. Department of Health and Human Services, Office for Civil Rights. Resources for Mobile Health Apps Developers. Content last reviewed 22 April 2026.
• Apple Support. iCloud data security overview. Published 5 January 2026.
• Google. Back up or restore data on your Android device. Android Help.
• Apple Developer. App Privacy Details on the App Store.
• Google Play Help. Understand app privacy & security practices with Google Play's Data safety section.
• Apple Developer. App Review Guidelines, guideline 5.1.1(v).
• Google Play Console Help. Understanding Google Play's app account deletion requirements.