Privacy Policy
Noctly is made by David Martos, an independent developer ("I", "me"). Your dreams are deeply personal, and this page explains plainly what happens to them.
This policy covers the Noctly website at noctly.co. The Noctly iOS app works differently — it keeps your journal in your own iCloud account and is covered separately. On the web, your dreams are stored on servers I operate and are sent to the third parties named below in order to be interpreted. If that is not what you want, the iOS app is the private option.
1. What the website stores
Your account. Your email address, and a password if you created one. If you sign in with Google, I receive your email address and basic profile information from Google; I never see your Google password.
Your dreams. The text you write is stored in a database I operate, linked to your account. Alongside it I store what the interpretation produces: a title, the reading itself, the symbol and emotion tags, and the line printed on your card.
Your cards. The artwork generated for each dream, and its number in your deck.
Subscription state. Whether you are on the free or paid plan, when the period ends, and the identifiers my payment processor uses to recognise you. I never see or store your card number.
Usage and technical data. Which pages you open and which actions you take, your approximate location derived from your IP address, and standard server logs.
2. Who else processes your data
I am one person; the site runs on other people's infrastructure. These companies process data on my behalf:
- Supabase — hosts the database holding your account, your dreams and your readings, and handles sign-in.
- Vercel — hosts and serves the website, and keeps standard request logs.
- Anthropic — receives the text of a dream in order to interpret it, and returns the reading. This is the one step where your dream text leaves my systems.
- fal.ai — receives a short visual description derived from your dream, not the dream itself, and generates the card artwork. The artwork is served from their network.
- Stripe — handles payment. Card details go to Stripe directly and never reach me.
- Amplitude — product analytics: which steps you reach, on which device. It does not receive your dream text or your readings.
- Microsoft Clarity — records how pages are used, so I can see where the site is confusing. Text you type into the dream box is masked.
- Google — measures whether an advertisement led to a subscription. It receives that a purchase happened and its value, not what you dreamt.
Some of these operate outside the European Economic Area, so your data may be transferred and processed there under the safeguards those providers publish.
3. What is never sent anywhere
Your dream text is sent to Anthropic to be interpreted, and to nowhere else. It is not sent to advertisers, not used to target advertising, and not sold or shared for anyone else's marketing. It is not used to train anybody's models by me.
4. Cookies and tracking
If you visit from the European Economic Area, the United Kingdom or Switzerland, advertising and analytics are switched off until you accept them. Reject, and the advertising tag stays disabled and no session recording or product analytics run. Outside those regions they are enabled by default, and you can clear them at any time by clearing this site's data in your browser.
Sign-in itself needs a cookie to keep you logged in. That one is essential and is not optional.
5. How long it is kept
Your dreams and readings are kept until you delete them or ask me to delete your account. Payment records are retained as long as tax and accounting rules require. Analytics data follows each provider's own retention period.
6. Your rights
You can ask me for a copy of your data, ask me to correct it, or ask me to delete your account and everything in it. Write to the address below and I will act on it — for deletion, within 30 days. You can also complain to your national data protection authority; in Spain that is the AEPD.
You can cancel your subscription at any time from Settings, which takes you to Stripe's billing portal. Cancelling stops the renewal and leaves your journal intact.
7. Children
Noctly is not directed at children under 13, and I do not knowingly collect their data. If you believe a child has an account, contact me and I will remove it.
8. Changes
If this policy changes materially, I will update this page and the date above.
Write to doingtheindie@gmail.com. I'm a one-person team and I read every email.