Privacy Policy

Who Is Responsible

MysticLab is published by Ender Yildirim e.U., Austria, which is the controller of your personal data under the GDPR.

• Privacy questions and requests: privacy@mysticlab.app
• Help with the app: support@mysticlab.app

Data We Collect

What you give the app, and what it needs to work:

• Account: Your email address and password, or your Sign in with Apple identity. Used to sign you in.
• Profile: The display name, birth date, gender, zodiac sign and dream-recall answers you choose to give during onboarding.
• Dreams and conversations: The dreams you write or dictate, your conversations with Luna, and the symbols, people, places and feelings drawn from them, including mood history, weekly insights and Deep Analysis results.
• Notes Luna keeps: Things about your waking life that Luna offered to remember and you chose to keep. You can delete each one.
• Technical data: What our servers see when they handle a request, such as IP address, device type and app version. The app contains no advertising, tracking or analytics SDKs.
• Your AI consent: Whether you agreed to AI processing, and when. This is stored on your phone.

Dreams can touch on health, relationships or beliefs. We process that content only to provide the journal and, with your explicit consent, Luna's replies.

Why We Use It, and on What Basis

We use your data only for these purposes:

• Running the app (contract): Keeping your account, journal, patterns and mood history, and showing them back to you.
• Luna's replies (your consent): Sending your dream and conversation to OpenAI to write Luna's interpretation, follow-up questions, weekly insight and Deep Analysis. This is based on your explicit consent, which you can withdraw at any time.
• Security (legitimate interest): Daily limits, abuse prevention and keeping the service running.
• Answering you (legitimate interest): Replying when you write to us.

We do not sell personal data, show ads, or build advertising profiles.

AI Processing With OpenAI

Your dreams are not used to train AI models

Luna's replies are written by a large language model from OpenAI (United States). Writes Luna's replies, dream titles and summaries, weekly insights and Deep Analysis. To do that, MysticLab sends OpenAI part of what you share:

• What is sent: the dream you wrote or spoke; your messages to Luna and her replies; the symbols, people, places and feelings found in your dreams; notes you asked Luna to keep; your display name, age, gender and zodiac sign, if you added them to your profile.
• What is never sent: your email address or your account ID.
• Your permission first: Only after you agree on the consent screen. You can withdraw in Settings › Privacy & AI; your dreams are still saved, Luna just stops replying.
• Training: OpenAI does not use data sent through its API to train its models unless a customer opts in. MysticLab has not opted in.
• How long OpenAI keeps it: OpenAI may keep API data for up to 30 days to detect abuse, unless the law requires it to keep it longer, and then deletes it.

Voice Input

Speech is turned into text by your phone's own speech recognition — on the device where it supports that, otherwise by Apple's (iPhone) or Google's (Android) speech service. MysticLab never receives or stores audio.

• Apple and Google: When recognition falls back to Apple's or Google's servers, their privacy policies apply to that audio. You can always type instead.

Who Else Processes Your Data

These providers process data on our behalf, only for the purpose listed:

• Hetzner Online GmbH — Helsinki, Finland (EU): Our database and servers (a self-hosted Supabase stack) run on a server we rent from Hetzner.
• OpenAI — United States: Luna's replies, as described above.
• Resend — United States: Sends account emails such as sign-up confirmation and password reset.
• Apple and Google: Sign in with Apple or with email and password. Speech recognition as described above.
• Migadu (Switzerland) and Google Gmail: Our support mailbox is hosted by Migadu and read in Gmail.
• No one else: No advertisers, data brokers or analytics companies receive your data.

OpenAI and Resend are in the United States. Those transfers rely on the safeguards in their data processing terms (the EU Standard Contractual Clauses or the EU–US Data Privacy Framework).

How Long We Keep It

We keep your data while your account exists, and no longer than needed:

• Your account: Until you delete it. Settings › Delete account removes your account and everything in it immediately and permanently.
• A single dream: Deleting a dream removes it from your journal; the stored copy is erased permanently when you delete your account.
• Emails to us: As long as needed to handle your request.
• Technical logs: Only as long as needed to run and secure the service.
• Old waitlist: Email addresses collected on our pre-launch waitlist are used only to tell those people the app is available, then deleted.

Security

How your dreams are protected, stated precisely:

• Encryption in transit: Everything between the app, our servers and our providers travels over HTTPS (TLS).
• EU servers: Your data is stored on our own server in Helsinki, Finland (EU).
• Access control: Database rules let each account read and change only its own data.
• What we do not offer: End-to-end encryption. Our servers have to read a dream to send it to Luna, so we don't claim that only you can read it.

This Website

mysticlab.app sets no cookies and shows no ads.

• Hosting (Vercel): Hosts mysticlab.app and keeps short-lived request logs (IP address, browser).
• Statistics: Umami (self-hosted on our Hetzner server in Finland). Counts page views and button clicks without cookies. It does not store IP addresses or build profiles.
• Free Dream Analyzer: Text you submit to the free web Dream Analyzer is sent to our server and to OpenAI to write one short reading. It is not linked to an account and not added to any dream journal. We don't store the text you submit. To enforce the one-reading-a-day limit we keep a technical record — a one-way code derived from your network address, and a counter — for up to 48 hours.

Your Rights

Under the GDPR you can:

• Access and portability: Get a copy of your data. There is no self-service export yet. Email us and we will send you a copy of your data.
• Correction: Fix your profile in the app, or ask us.
• Deletion: Delete your account in Settings, or ask us to do it.
• Withdraw consent: Stop AI processing in Settings › Privacy & AI at any time.
• Object or restrict: Ask us to stop or limit a use of your data based on legitimate interest.
• Complain: You can lodge a complaint with a data protection authority — in Austria, the Datenschutzbehörde (dsb.gv.at).

To exercise any of these rights, email privacy@mysticlab.app. We answer within one month.

Children and Changes

MysticLab is not meant for anyone under 13.

• Changes: When this policy changes we update the date at the top, and for significant changes we tell you in the app.