Privacy & Security

How MysticLab Handles Your Dreams

What leaves your phone, who receives it, and how to take it back — in plain words. The Privacy Policy is the legal version; the sections further down link to the matching part of it.

Last updated: 29 September 2026

At a glance

Stored in the EU
Your journal lives on our server in Helsinki, Finland (EU).
OpenAI only with your yes
Luna's replies come from OpenAI (United States), and only after you agree. It never gets your email address or your account ID.
No audio reaches us
Speech becomes text on your phone, or through Apple or Google. We only ever receive the text.
Encrypted in transit
Everything travels over HTTPS (TLS). Our server can read your dreams, because it has to pass them to Luna.
No ads, no data sales
We do not sell personal data, show ads, or build advertising profiles.
Delete it all at once
Settings › Delete account removes your account and everything in it immediately and permanently.

Where your dreams go

Three stops, and what may cross each arrow.

1. iPhone or Android

Your phone

You type a dream or say it. Speech becomes text on the phone itself, or — where the phone can't do that — through Apple's (iPhone) or Google's (Android) speech service. Your AI-consent choice, and any “no” you gave when Luna offered to remember something, stay here.

Over HTTPS (TLS)

Sent

your dreams, as text
your messages to Luna
your profile answers
your sign-in details

Never sent

audio recordings
your AI-consent choice

2. Helsinki, Finland (EU)

MysticLab server

Our database and servers (a self-hosted Supabase stack) run on a server we rent from Hetzner. Your journal is stored here.

Over HTTPS (TLS), only after you agree

Sent

the dream you wrote or spoke
your messages to Luna and her replies
the symbols, people, places and feelings found in your dreams
notes you asked Luna to keep
your display name, age, gender and zodiac sign, if you added them to your profile

Never sent

your email address
your account ID

3. United States

OpenAI

Writes Luna's replies, dream titles and summaries, weekly insights and Deep Analysis. OpenAI does not use data sent through its API to train its models unless a customer opts in. MysticLab has not opted in.

What MysticLab stores

On our server in Helsinki, Finland (EU), tied to your account:

Account: your email address and password, or your Sign in with Apple identity.
Profile: your display name and a username, plus what you chose to add: birth date (with the age and zodiac sign worked out from it), gender, how often you remember dreams and why you use MysticLab.
Dreams: the text of each dream, its title and the night it happened. A spoken dream is stored as text, never as audio.
Conversations: your messages to Luna and her replies.
Patterns: the symbols, people, places and emotions found in each dream, and the mood that follows from them.
Insights: your weekly insights and Deep Analysis results.
Notes Luna keeps: things about your waking life that Luna offered to remember and you said yes to.
A daily counter: how many replies Luna has given you today, for the 100-a-day limit.
Technical data: what our servers see when they handle a request, such as IP address, device type and app version.

Legal detail: Privacy Policy › Data We Collect

What stays on your phone

Kept only on your phone, in the app's own storage:

Your AI consent: whether you agreed to let us send your dreams to OpenAI, and when. Because the choice lives on the phone, you are asked again on a new phone and after you sign out.
The offers you declined: when Luna offers to remember something and you say no, only your phone keeps that answer. We keep no record of what you turned down.
Your settings: such as the app language. Requests to Luna say which language to answer in, but we do not store your settings.

Also kept on your phone, next to our copy on the server:

Your sign-in session, so you stay signed in.
A copy of your profile answers.

Signing out or deleting your account clears all of this from the phone except your settings.

Legal detail: Privacy Policy › Data We Collect

What is sent to OpenAI, and why

An AI model from OpenAI (United States) writes Luna's replies, dream titles and summaries, weekly insights and Deep Analysis. To do that, it receives:

the dream you wrote or spoke
your messages to Luna and her replies
the symbols, people, places and feelings found in your dreams
notes you asked Luna to keep
your display name, age, gender and zodiac sign, if you added them to your profile

Never sent: your email address or your account ID.
When: Only after you agree on the consent screen. You can withdraw in Settings › Privacy & AI; your dreams are still saved, Luna just stops replying.
Training: OpenAI does not use data sent through its API to train its models unless a customer opts in. MysticLab has not opted in.
How long OpenAI keeps it: OpenAI may keep API data for up to 30 days to detect abuse, unless the law requires it to keep it longer, and then deletes it.

Legal detail: Privacy Policy › AI Processing With OpenAI

How voice becomes text

Speech is turned into text by your phone's own speech recognition — on the device where it supports that, otherwise by Apple's (iPhone) or Google's (Android) speech service. MysticLab never receives or stores audio.

The app asks for on-device recognition whenever the phone supports it. When Apple's or Google's servers do the work instead, their privacy policies apply to that audio. You can always type instead.

Legal detail: Privacy Policy › Voice Input

Encryption and security

In transit: everything between the app, our server and our providers travels over HTTPS (TLS).
Access rules: database rules let each account read and change only its own data.
Sign-in: Sign in with Apple or with email and password.
What we do not claim: our server has to read a dream to pass it to Luna, so we do not claim that only you can read your dreams.

Legal detail: Privacy Policy › Security

Who else handles your data

Each provider does one job for us:

Hetzner Online GmbH (Helsinki, Finland (EU)): Our database and servers (a self-hosted Supabase stack) run on a server we rent from Hetzner.
OpenAI (United States): Luna's replies, as described above.
Resend (United States): Sends account emails such as sign-up confirmation and password reset.
Apple and Google: Sign in with Apple, and speech recognition when your phone cannot do it on the device.
Migadu (Switzerland) and Google Gmail: Our support mailbox is hosted by Migadu and read in Gmail.
No one else: no advertisers, data brokers or analytics companies receive your data.

Transfers to the United States rely on the safeguards described in the Privacy Policy.

Legal detail: Privacy Policy › Who Else Processes Your Data

How long it is kept

Your journal: for as long as your account exists.
A single dream: deleting a dream removes it from your journal; the stored copy is erased permanently when you delete your account.
A note Luna kept: deleting it erases it permanently, straight away.
At OpenAI: OpenAI may keep API data for up to 30 days to detect abuse, unless the law requires it to keep it longer, and then deletes it.
Emails to us: as long as needed to handle your request.
Technical logs: only as long as needed to run and secure the service.

Legal detail: Privacy Policy › How Long We Keep It

Export and deletion

Delete your account: Settings › Delete account removes your account and everything in it immediately and permanently. It cannot be undone.
Or ask us: email privacy@mysticlab.app and we will delete it for you.
Get a copy: There is no self-service export yet. Email us and we will send you a copy of your data: privacy@mysticlab.app.
Correct it: fix your profile in the app, or ask us.

Legal detail: Privacy Policy › Your Rights

This website

Cookies and ads: mysticlab.app sets no cookies and shows no ads.
Hosting (Vercel): Hosts mysticlab.app and keeps short-lived request logs (IP address, browser).
Statistics: Umami (self-hosted on our Hetzner server in Finland). Counts page views and button clicks without cookies. It does not store IP addresses or build profiles.
Free Dream Analyzer: Text you submit to the free web Dream Analyzer is sent to our server and to OpenAI to write one short reading. It is not linked to an account and not added to any dream journal. We don't store the text you submit. To enforce the one-reading-a-day limit we keep a technical record — a one-way code derived from your network address, and a counter — for up to 48 hours.

Legal detail: Privacy Policy › This Website

Store privacy labels

Apple and Google each show a short privacy summary on the store listing, in their own format: “App Privacy” on the App Store and “Data safety” on Google Play. See them on MysticLab on the App Store and MysticLab on Google Play.

Those summaries are short by design. Our Privacy Policy is the full statement.

Weighing up dream apps in general? Our guides on whether a dream journal is private and whether AI stores your dreams include checklists you can use on any app, this one included.

Privacy contact

Responsible for your data: Ender Yildirim e.U., Austria.
Questions and requests: privacy@mysticlab.app. We answer within one month.
Complaints: you can complain to a data protection authority; in Austria, the Datenschutzbehörde (dsb.gv.at).

Legal detail: Privacy Policy › Who Is Responsible

Questions about your data?

Write to us and a person will answer.

privacy@mysticlab.app

Download on theApp Store Get it onGoogle Play