Privacy Policy

Last updated: July 15, 2026

The short version

Dreams are personal, so we’ll be direct: we collect only what the service needs to work, we use your dreams for exactly one thing — making your readings, paintings, and weekly reflections — and we don’t sell data, run ads, use tracking analytics, or train models on what you write. You can delete everything yourself, at any time, with one button.

What we collect

• Account: your email address and a hashed form of your password (we can’t see the password itself).
• Your journal: the dreams you write, and the readings, paintings, and weekly reflections generated from them.
• Billing: your subscription status from Lemon Squeezy, our payment provider. Card details go directly to them; we never see or store them.
• Technical: IP addresses in ordinary server logs and in a short-lived rate limiter, and a single session cookie that keeps you signed in. That’s the only cookie we set. No analytics, no trackers, no ad pixels.

How your dreams are used

When you save a dream, its text is sent to our own model servers to generate the reading and the painting, and once a week your recent dreams are read together to write your Sunday reflection. That processing happens on infrastructure we run — your dreams are not sent to third-party AI services. Your dreams are never used to train models, never shared, and never read by a human except if you ask us to look at your account to fix a problem.

The try-it box on the landing page

Dreams typed into the landing-page demo are processed to produce that one reading and painting and are not saved to any journal. The demo painting is automatically deleted from our server within an hour.

Third parties

• Lemon Squeezy handles checkout, billing, and taxes as merchant of record. When you subscribe, your email and payment details are processed under their privacy policy.
• Our hosting provider stores the server and its disk, like any website.

That’s the whole list. There is no one else.

Retention and deletion

Your journal is kept for as long as you have an account, whether or not your membership is active. Deleting your account — the link is at the bottom of your journal — immediately and permanently removes your dreams, readings, paintings, weekly reflections, and account record, and cancels your subscription. Copies in our backups are purged within 30 days. Server logs rotate on a similar schedule.

Security

Passwords are stored using a modern one-way hash (scrypt), traffic is encrypted with HTTPS, and your journal is only readable from your signed-in session. No system is perfectly secure, but we keep the attack surface deliberately small.

Your rights

You can read everything you’ve stored on Nightstand by signing in — it’s all in your journal. You can delete everything yourself. If you’d like a copy of your data in a portable format, or have any other request about your information (including rights under GDPR or similar laws), email us at [contact email] and we’ll take care of it.

Children

Nightstand is not directed at children and requires you to be 18 or older to create an account. If you believe a child has created an account, contact us and we’ll delete it.

Changes

If this policy changes in a way that matters, we’ll update the date above and, for significant changes, tell you by email or in the app.

Contact

Privacy questions: [contact email].