Privacy Policy
This policy explains how personal data is processed when you use the DreamBuddy mobile app (called Rüyam in Turkish) and the website https://ruyamapp.web.app. By using the app you acknowledge the processing described here.
1. Who we are
DreamBuddy is provided by an independent developer publishing on Google Play as B&T APPS. B&T APPS is the data controller under the Turkish Personal Data Protection Law No. 6698 (KVKK) and, where applicable, the EU General Data Protection Regulation (GDPR). For anything privacy-related, contact us at inforuyam@gmail.com.
2. Data we process
| Data | Details |
|---|---|
| Account | Your email address. If you sign in with Google or Apple, the name and email those services share with us. Your password is stored by Firebase Authentication in hashed form; we never see it. |
| Profile (optional) | Your name, gender, date of birth and language. These fields are optional. |
| Dreams and interpretations | The dream texts you write and the feeling you optionally pick, the interpretations your readers create for you, the questions you ask your readers and their answers, favorite and read status, and timestamps. |
| Stardust and purchases | Your stardust balance, stardust history (earned, spent, refunded) and subscription status. Your payment card details stay with Google Play or the App Store and never reach us. |
| Device and technical data | Notification token, device platform, app version; integrity signals confirming the app is genuine (Firebase App Check with Google Play Integrity / Apple App Attest); IP address and technical logs kept on our providers' servers. |
| Device digest | A one-way digest (SHA-256) derived from your device identifier, used only to stop the welcome stardust from being claimed repeatedly on the same device. The identifier cannot be recovered from it and it is stored without a link to your account. |
| Advertising and usage data | If you allow it, your advertising ID (Android advertising ID / iOS IDFA) and ad interactions (Google AdMob); app usage statistics (Google Analytics for Firebase). |
| Support messages | Whatever you share when you email us. |
We do not intend to collect special categories of data (health, beliefs, biometrics, etc.). Please don't include sensitive details such as ID numbers, home addresses or health information in your dream texts.
3. Why we process it
- To create your account, sign you in and provide the service,
- To have your dream read by the readers you choose, store the interpretations and your questions, and notify you when an interpretation is ready,
- To manage your stardust, purchases and subscription, and verify rewarded ads,
- To prevent abuse, fraud and security threats,
- To show ads (Premium members see no ads),
- To improve the service with aggregate statistics and fix bugs,
- To answer support requests and meet legal obligations.
4. Who we share it with
We do not sell your personal data. It is shared only as needed with these providers, who work on our behalf:
| Provider | Purpose |
|---|---|
| Google Firebase (Google LLC): Authentication, Cloud Firestore, Cloud Functions, Cloud Messaging, App Check, Analytics | Accounts, storage, server processing, notifications, security, statistics · policy |
| Google AdMob and User Messaging Platform | Ads and ad consent · policy |
| Anthropic, PBC | Interpreting dream texts (Claude) · policy |
| RevenueCat, Inc. | Verifying purchases and subscriptions (account ID and purchase records) · policy |
| Google Play / Apple App Store | Payments and subscriptions (subject to their own policies) |
| Sign in with Google / Apple | Authentication, if you choose these options |
We may also disclose data in response to lawful requests from authorities and where needed to protect rights and safety.
5. International transfers
Our servers and the providers above are mainly located in the United States (Firebase us-central1 region). Your data is transferred there to provide the service, in line with Article 9 of KVKK, the GDPR and the safeguards offered by the providers (such as standard contractual clauses).
6. Legal bases
- Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)): accounts, interpretations, stardust and subscriptions.
- Legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)): security and abuse prevention (device digest, App Check) and aggregate statistics to improve the service.
- Consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)): personalized ads, notifications and optional profile details. You can withdraw consent at any time.
- Legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)): retention and reporting duties required by law.
7. Retention
Your data is kept while your account exists. You can delete individual dreams and edit your profile at any time.
When you delete your account, your user record, all dreams and interpretations, device records, stardust history and sign-in account are deleted from our servers immediately. For details, and what to do if you can't access the app, see Account & data deletion.
After deletion, only the following may remain:
- The device digest, not linked to your account (to prevent welcome-stardust abuse),
- Transaction IDs that stop purchases and ad rewards from being processed twice,
- Records our providers keep under their own retention periods (e.g. purchase records at Google Play/App Store, Google Analytics statistics for up to 14 months, technical logs). Your customer record at RevenueCat is deleted together with your account,
- Information we are legally required to keep.
8. Ads and your choices
- Users in the European Economic Area, the UK and Switzerland are shown Google's consent form for personalized ads. You can change your choice in the app under Profile > Ad privacy options.
- On iPhone, we ask for permission to access the advertising ID (App Tracking Transparency). If you decline, non-personalized ads are shown.
- On Android, you can reset or delete your advertising ID under Settings > Google > Ads.
- When you watch a rewarded ad, Google passes your account ID and the reward type to our server so the reward reaches the right account.
- Premium members see no ads.
Notifications are sent only if you allow them. Turn them off under Profile > Notifications or in your phone settings. You can also turn off the morning reminder on its own under Profile > Morning reminder.
9. Your rights
Under KVKK Article 11 and, where applicable, the GDPR, you have the right to access your data, learn how and why it is processed and who receives it, have it corrected or deleted, restrict or object to processing, receive it in a portable format, withdraw consent, object to decisions made solely by automated means, and seek compensation for damages.
Send requests from your registered email address to inforuyam@gmail.com. We answer free of charge within 30 days. You may also lodge a complaint with the Turkish Personal Data Protection Authority or your local supervisory authority.
10. Children
DreamBuddy is not directed to children under 13, and we do not knowingly collect personal data from them. If you believe this has happened, contact us and we will delete the data.
11. Security
All connections are encrypted (TLS). Server-side rules restrict access to your data to your own account, and stardust and reward operations run only on our servers. No system is perfectly secure, so please use a strong, unique password.
12. Changes
We may update this policy from time to time. The current version is always on this page, and we announce significant changes in the app.
13. Contact
B&T APPS · inforuyam@gmail.com
14. AI interpretations
Dream interpretations are generated with the help of AI. To do this, your dream text is sent from our servers to Anthropic (Anthropic, PBC, USA) via its API, and the interpretation is written by its Claude model. Each request contains only what that task needs: for a reading, your dream text, how the dream felt if you chose it, and your language; when you ask your reader a question, also that dream's reading, your earlier questions and answers on it, and your new question; for your sky personality, your dream symbols, the element balance computed from them, and, if you entered a birth date, the sun sign computed from it (not the birth date itself). Your name, email address or account ID are not sent. Before you send your first dream, we ask for your explicit permission in the app; if you decline, your dream is not sent.
Under Anthropic's commercial API terms, content sent through the API is not used for model training without permission and is deleted within 30 days; content flagged for a usage policy violation may be kept longer (up to 2 years). See the Anthropic Privacy Policy.
Interpretations are for entertainment and self-reflection; they may be inaccurate and are not professional advice. You can report any interpretation you find inappropriate with the in-app "Report interpretation" option.