Privacy Policy
Last updated: 6 November 2026
This policy covers the Dreamance app and the Dreamance website.
Who we are
Dreamance is made by PB&T PTE. LTD. (UEN 202514892D), a company in Singapore. We decide how your data is used.
For anything about privacy, email support@dreamance.app.
The short version
- An AI writes each Scene of your Story. To do that, the name you play as and your replies are sent to the AI provider behind the Narrator you pick: OpenRouter (which passes it to the GLM-5.3 model made by Z.ai) for Reverie, the default Narrator, or Anthropic for Ember. Nocturne, which is for our admins only for now, uses NoKeep. Each provider has its own privacy policy, linked below.
- Your account and your Stories are kept on our server until you delete your account.
- We send usage events to PostHog so we can see how Stories are read. They never include anything you type. You can switch this off in Settings.
- On our website, with your consent where the law asks for it, we also record which buttons and links you click and a replay of your visit, with everything you type and the Story text hidden. This is only to improve the website. We don't sell your data, show ads, use advertising pixels, track your precise location or track you across other companies' sites or apps. Analytics records only your rough location: country and city.
What we collect, and why
You can start reading as a guest. A guest still has an account on our server, with a random id and no email. Everything below applies to guests too, except email and sign-in details.
| What | Why | Who else receives it |
|---|---|---|
| Your account id, whether you are a guest, and when you joined and last signed in | To run your account | Supabase, our host |
| Your email address and password, if you sign up or link an email. The password is stored scrambled (hashed), never as you typed it | To sign you in. Supabase sends the emails that confirm your address or let you sign in | Supabase |
| Your Google or Apple sign-in identity and email, if you sign in that way. Google may also send your name and profile picture | To sign you in | Supabase, from Google or Apple |
| Sign-in sessions: tokens that keep you signed in, and the network address and device or browser type for each session | To keep you signed in and spot misuse | Supabase |
| Your Story survey answer, if you give one: romance, BL or adventure, and when you answered. Until you have an account it stays on your device, then it is saved on your Player Profile | To decide which Stories to write | Supabase; PostHog, only if analytics is allowed (as the event survey_answered) |
| The name you play as in each Story | To write your Story | Supabase; the AI provider of the Narrator you use, in every Scene request |
| Your About you details in Settings: name, gender and Mature content setting. A Guest has them too | To fill in your name, to pick the version of a Story that matches your Mature content setting, and to set pronouns where a Story leaves them open | Supabase |
| Your Story progress: Scenes, the choices you pick, your Free Replies, Relationship Stats, Key Moments, Chapter Recaps and the ending you reach | To save your place and write the next Scene | Supabase; the AI provider of the Narrator you use receives your recent Scenes, recaps, Key Moments and your latest pick or Free Reply |
| A record of each Scene's cost: Story, Chapter, Scene, AI usage, Sparks and the AI model used | To price Scenes and watch our costs | Supabase |
| A turn lock and a count of turns per minute | To stop double turns and abuse | Supabase |
| Your Sparks: your free allowance, what you spend and what you buy, with a reference to each purchase | To run Sparks | Supabase |
| Story Ratings: whether you would recommend a Story you played (thumbs up or down) and whether you dismissed the question. Only signed-in accounts can rate. We show other Players how many ratings a Story has, never who gave them | To show which Stories Players recommend | Supabase; read by us |
| Scene reports: the Scene you report, the reason you write, and its status | To review reports and keep the app safe | Supabase; read by us |
| Blocked text: when our safety filter blocks a name you enter on Story Information or an AI-written Scene, we keep the full blocked text, what kind it was and why it was blocked | To review safety problems | Supabase; read by us |
| Flagged Free Replies: when a Free Reply matches our safety word list, we keep its text, the words that matched and the reason. The Free Reply is not blocked | To review safety problems | Supabase; read by us |
| Unusable replies: when the Narrator returns a reply we can't use, we keep a short excerpt of the AI's reply, what went wrong and what the call cost. It holds no Player text | To fix problems and watch our costs | Supabase; read by us |
| Your Analytics setting (on or off) | So the app and our server respect your choice | Supabase |
| Usage events, the device details that come with them, the local time of day on your device, and your rough location: country and city (see Analytics) | To see how Stories are read and where Players stop | PostHog |
| On the website only: the buttons and links you click, when you leave a page, and a replay of your visit with all typed text and Story text hidden (see Analytics) | To see where visitors get stuck and improve the website | PostHog |
Tracking Link click counts: when someone opens one of our short links (dreamance.app/lt and a number), we add one to that link's total for the day. Only the link number and the day are kept: no IP address, cookie, browser details or account id (see Analytics) | To see which links bring readers | Supabase; read by us |
| Purchase details (see Purchases) | To take payment and add your Sparks | Apple, Google, RevenueCat or Stripe |
| Backups: a daily copy of our database, which includes everything above that we keep on Supabase | To restore your data if something goes wrong | Supabase |
| Your choice on the consent bar, if you see one (kept in your browser) | To remember your answer | Nobody else |
| Emails you send us | To answer you | Cloudflare, which forwards them, and our mailbox |
Please don't type sensitive details
What you type as your name and in Free Replies is stored and sent to an AI provider to write your Story. Please don't type sensitive personal details there, such as health information, your sexuality, other people's real names, or contact details like phone numbers and addresses. Use made-up details for your character if you prefer.
What we don't collect
We don't collect your precise location (only your country and city, worked out from your network address for analytics), contacts, photos, camera, microphone or advertising id. We don't collect native crash reports. We do send error reports for JavaScript errors, as described under Analytics. We don't send push notifications. Nothing is shared for advertising, and nothing goes to data brokers.
If the app asks you to rate it, the rating dialog belongs to Apple or Google. We don't see what you do in it.
On your device
The app keeps your sign-in session on your phone or in your browser so you stay signed in, and a note that it has already asked you for a rating. This stays on your device until you sign out or uninstall the app.
How the AI writes your Story
Each Scene and Chapter Recap is written by an AI model. You pick a Narrator, and each Narrator runs on a different provider:
- Reverie, the default Narrator, runs on the GLM-5.3 model made by Z.ai. We reach it through OpenRouter, which receives your request and passes it on to a company that runs the model.
- Ember runs on Anthropic's Claude Haiku model. Anthropic receives the request directly.
- Nocturne runs on NoKeep. For now it is available only to our admins, so no Player's text goes to NoKeep. If we open Nocturne to Players, it will send them the same things as the others.
For the Narrator you use, our server sends its provider the Story's text and instructions, the name you play as, your recent Scenes, Chapter Recaps, Key Moments and your latest pick or Free Reply. We don't send your email, payment details or account id, and the provider sees our server's network address, not yours. Remember that the name you play as may be your real name.
Anthropic doesn't train its models on this data. It deletes it within 30 days. If its safety systems flag something, Anthropic may keep the flagged requests and replies for up to 2 years. For OpenRouter, Z.ai and NoKeep, how long they keep your text and whether they use it to train models is set by their own policies, which we don't control. Read them if that matters to you. OpenRouter and the companies behind these models may process data outside your country.
Our safety filter checks the names you enter on Story Information and each Scene before it reaches you. Blocked text is kept, as the table above says. Free Replies are no longer blocked. A Free Reply that matches our safety word list still goes to the Narrator, and we keep its text, the matched words and the reason in a private table for safety review. It is deleted with your account.
Analytics, and how to switch it off
Unless you switch it off, the app and our server send PostHog short events about how the app is used. They are linked to your account id, so a guest's reading joins up with later purchases and other devices.
The events cover: opening the app (and whether from the icon or a link), starting as a guest, linking an account, viewing Explore, opening a Story, starting a Story, a name being refused (the reason, never the text), the first Scene, each Scene played (whether it was a pick or a Free Reply, the Chapter, the Scene number and the Sparks spent), finishing a Chapter, the ending reached, restarting a Story, a Scene or name being blocked, or a Free Reply being flagged (the reason only), running out of Sparks, opening the Sparks Store and from where, tapping and buying a pack (the pack, price, currency and store) rating a Story (the Story and thumbs up or down) or dismissing the question, and reporting a Scene. On the website there is also a page view for each screen you see (Explore, My Stories, Story, Play, Store, Settings, Sign in), described below.
Each event also carries the app version, your platform, and the device details PostHog adds: operating system and version, device type, screen size and the PostHog library version.
Events about the Story survey say only that it was shown, which choice you picked, or that you skipped it. Events never include the name you play as, your About you details, Free Replies, email, report text, blocked or flagged text or Scene text. The phone apps use no click capture or session replay, and send no screen tracking. PostHog's automatic app events, such as app opened or backgrounded, are switched off. Each event also carries the local hour, the day of the week and the time zone from your device's clock, so we can see when people read.
PostHog sees your network address when the app or website connects. It uses it to work out your rough location, which is your country and city, then discards the address without storing it. We don't keep anything more precise than the city. Events sent from our server don't include your network address or a location.
Click capture and session replay (website only). On the website, once Analytics is allowed (after Accept for visitors the consent bar asks, and only while the Analytics switch is on), PostHog records which buttons and links you click and when you leave a page, and a replay of your visit so we can see where visitors get confused. In the replay, everything you type is hidden, and so are the text on the Play screen, your Free Replies and the Story text. Network requests and other sites embedded in the page are not recorded. Switching Analytics off, or withdrawing consent, stops both. The phone apps don't use them. This analytics is only for improving the website. We don't use it for advertising and the website has no advertising pixels.
When the app hits a JavaScript error, PostHog also receives an error report: the type of error, its message, its stack trace and the name of the screen you were on. Error reports are sent only while Analytics is on (and, for the visitors the consent bar asks, only after Accept), and are linked to your account id like other events. We don't add your name, replies or Scene text to them.
On the website, PostHog stores a random id in your browser so it can count visits. Each page view records the screen you are on (and the Story, on Story and Play screens), the page address with everything removed except campaign tags (the utm_ tags in a link we shared), the website that sent you here (its name only, never the page or search), and those campaign tags. Your first referring website and campaign tags are also saved once on your PostHog profile, to see which links bring readers. Page views follow the same Analytics switch and consent bar as other events, and never include anything you type or your payment details.
The website also uses Cloudflare Web Analytics to count visits and pages in aggregate. It sets no cookies and keeps no id in your browser, and it is not tied to your account. It runs without asking first, so the consent bar and the Analytics switch do not control it. The phone apps do not load it.
Tracking Links. We share short links such as dreamance.app/lt1 in posts and bios, to learn which ones bring readers. When one is opened, we add one to that link's click count for the day, whether or not you allowed analytics. That count is cookieless: we store only the link number and the date, never your IP address, a cookie, your browser details or anything about you, and link previews and bots are not counted. If you allowed analytics, the link's labels (the platform, page, placement, campaign and content style we gave it) are also added to your visit and saved on your PostHog profile (your first link once, and your latest link each time), so we can see which links lead to readers and purchases. This follows the same consent bar and Analytics switch as other analytics.
Consent bar. If Cloudflare shows your country as one in the EU, the EEA or the United Kingdom, or can't tell, the website asks before sending any analytics or error reports. Nothing is sent until you choose Accept. Reject keeps them off. Your choice sets the same Analytics switch as in Settings, and you can change it there. Elsewhere, and in the phone apps, there is no bar and Analytics is on until you switch it off.
To switch it off: open Settings and turn off Analytics. The setting is saved on your account, so both the app and our server stop sending your events, on every device you use. On the website, switching it off also stops PostHog using its id in your browser.
Purchases
In the app: Apple or Google take your payment. We never see your card. RevenueCat manages purchases for us and receives your account id (never a guest's), what you bought and when, the store receipt, your store's country and currency, and your device type and operating system.
On the website: Stripe runs the payment page. Stripe collects your card or other payment details, email, billing details and device, browser and network address for fraud checks. We send Stripe your account id, the pack and the price, and we get back a reference to the payment. We never see your card. Stripe Tax is switched on, so Stripe also uses your billing address or the location of your network address to work out sales tax. If you ask for a refund or open a dispute, Stripe tells us and we take back the Sparks from that purchase.
Network address
Every service your phone or browser connects to sees your network address (IP address), including Supabase, PostHog, RevenueCat, Stripe, Cloudflare and Expo. Supabase keeps it in its server logs, with your account id, for up to 28 days, and with each sign-in session as described above. Apart from PostHog working out your country and city as described under Analytics, we don't use your network address to work out where you are.
App updates and the website
Expo delivers app updates. When the app checks for an update it sends Expo your platform, app version details, update channel and a random update token, and Expo sees your network address and operating system. Cloudflare hosts the website and its domain name, forwards our support email, and runs Turnstile, a check that stops bots creating guest accounts. When you visit the website, Cloudflare sees your network address, browser and region, and tells our site your country so it knows whether to show the consent bar. Turnstile runs in your browser when a guest account is created and sends Cloudflare signals about your browser to decide if you are a person. A backup copy of the website on Expo sees the same. None of this is linked to your account.
Who receives data
These companies process data for us, on our instructions, to provide their service to us.
| Company | What it does | Where |
|---|---|---|
| Supabase | Hosts your account, Stories, Sparks, reports, daily backups and server logs, and sends sign-in emails | Singapore |
| OpenRouter | Receives requests for the Reverie Narrator and passes them to the company that runs the model (GLM-5.3, made by Z.ai) | May process data outside your country |
| Anthropic | Writes Scenes and Chapter Recaps for the Ember Narrator | United States |
| NoKeep | Writes Scenes and Chapter Recaps for the Nocturne Narrator, currently for admins only | May process data outside your country |
| PostHog | Usage events | United States |
| RevenueCat | Manages in-app purchases | United States |
| Stripe | Takes website payments | United States and other countries |
| Apple and Google | Sign-in, in-app payments and app delivery | Under their own privacy policies |
| Cloudflare | Website hosting, domain name, support email forwarding, the country lookup for the consent bar and the Turnstile bot check | United States and other countries |
| Expo | App updates and a backup copy of the website | United States |
Stripe, Apple and Google also use payment data for their own fraud checks and legal duties, under their own privacy policies.
We may also share data if the law requires it, or to protect Players or the service. If the company or the app is sold, data would pass to the new owner under this policy.
Moving data between countries
We're in Singapore, and our main database is in Singapore. Anthropic, PostHog, RevenueCat, Stripe, Cloudflare and Expo are mostly in the United States, so some of your data is processed outside your country. OpenRouter, the company that runs Reverie's model, and NoKeep may also process data outside your country. Where the law requires, we use safeguards such as standard contractual clauses.
How long we keep it
| Data | How long |
|---|---|
| Account, sign-in details, Sparks, Scene cost records, Analytics setting | Until you delete your account |
| The name you play as in each Story, and Story progress | Until you restart that Story or delete your account |
| Your Story survey answer | Until you delete your account (on your device, until you clear it or uninstall) |
| About you details (name, gender, Mature content setting). Dreamance no longer asks for a birthday; one given before 6 November 2026 may still be stored, is never used or shown, and is deleted with your account | Until you delete your account |
| Sign-in sessions | Until the session ends or you delete your account |
| Story Ratings | Until you delete your account |
| Scene reports, blocked text, flagged Free Replies and unusable-reply excerpts | Kept for safety review until you delete your account |
| Server logs on Supabase | Up to 28 days |
| Daily database backups on Supabase | About 7 days. Deleted data leaves the backups when they age out |
| What Anthropic receives | Deleted within 30 days, or up to 2 years if its safety systems flag it |
| What OpenRouter, Z.ai and NoKeep receive | Under their own policies. They are not deleted when you delete your account |
| Usage events in PostHog | Until they reach the retention period we set in PostHog. They are not deleted when you delete your account |
| Purchase records at RevenueCat, Stripe, Apple and Google | Under their own policies, including tax and accounting law. They are not deleted when you delete your account |
| Update and website requests at Cloudflare and Expo | As long as they reasonably need them |
| Emails | As long as needed to help you and keep records |
Deleting your account
You can delete your account in the app (Settings, then Delete account), on the website (sign in, then Settings), or by emailing us. Guests can only delete in the app. See Delete your account.
Deleting is immediate. It removes your account, sign-in details, your About you details, your Story survey answer, the name you play as, Stories and progress, Sparks, Scene cost records, Scene reports, blocked text, flagged Free Replies, unusable-reply excerpts and your Analytics setting from our server. Unspent Sparks are lost.
These stay after deletion, held by other companies under their own policies:
- RevenueCat keeps your account id and in-app purchase history.
- Stripe keeps website payment records, including your account id on the payment.
- Apple and Google keep their purchase records.
- PostHog keeps usage events under your old account id until they reach their retention period.
- Anthropic keeps recent requests for up to 30 days, or up to 2 years if flagged.
- OpenRouter, Z.ai and NoKeep keep what they received under their own policies.
- Supabase server logs stay until they age out, within 28 days.
- Supabase backups still hold your data until they age out, about 7 days. If we restore a backup, we delete your account again.
Your choices and rights
Wherever you live, you can ask us for a copy of your data, ask us to correct it, or ask us to delete it. You can withdraw consent at any time. You can:
- switch off Analytics in Settings
- restart a Story to clear its name and progress
- delete your account
To ask for anything else, email us. Withdrawing consent doesn't undo what was done before, and some features may stop working. We answer within 30 days and may ask you to confirm the account is yours.
Children
Dreamance is for people aged 13 and over. If you are under the age where your country lets you agree to online services yourself, you need a parent or guardian's permission. We don't knowingly collect data from children under 13. If you think a child under 13 is using the app, email us and we will delete the account.
How we keep it safe
Data travels encrypted. Each account can reach only its own data. Reports, blocked text, flagged Free Replies and unusable-reply excerpts can only be read by us. No service is perfectly secure. If there is a breach, we will tell you and the regulators where the law requires.
Singapore
We handle personal data under the Personal Data Protection Act 2012. You can ask for access to your data, ask us to correct it, and withdraw consent. If you aren't happy with our answer, you can complain to the Personal Data Protection Commission.
California
We don't sell personal information, and we don't share it for cross-context behavioural advertising. The categories we collect are the ones in this policy: identifiers, commercial information (purchases), internet activity (app usage) and content you write.
California residents can ask to know, correct or delete their personal information. We won't treat you differently for asking. Someone you authorise can ask for you. Email support@dreamance.app.
The EEA and the UK
We use your data on these legal bases:
- Contract: to run your account, write your Stories, and run Sparks and purchases.
- Legitimate interests: to improve the app through usage events, to stop abuse, and to review reports and blocked text. You can object at any time, and the Analytics switch stops usage events.
- Legal duty: for records the law requires.
You can ask for access, correction, deletion, restriction or a copy to take elsewhere, and you can object to processing. You can complain to your local data protection authority.
Changes
If we change this policy, we will post the new version here and change the date at the top. If a change matters, we will tell you in the app first.
Contact
PB&T PTE. LTD.
UEN 202514892D
Singapore
support@dreamance.app