Privacy policy

1. The essentials

Mergen is a dream journal and interpretation app operated by Serdar Coşkun (“we”, “us”). This policy covers the app and this website. You do not need an email account to use the app. We use a random device identifier to operate the interpretation service and credit balance.

We do not sell your personal information or use your dream content for advertising. The website itself sets no cookies and includes no analytics scripts, advertising trackers, or remotely loaded third-party fonts. Our delivery provider, Cloudflare, may process security and connection information as described below.

2. Data we process and why

• Your diary: dream titles, text, dates, moods, tags, saved interpretations, and the symbols and themes in your dream profile are stored in the app’s local database.
• Interpretation requests: when you request a reading, the app sends your dream, chosen lens, language, and relevant dream profile context to our backend. Follow-up requests also include your question and the relevant interpretation and conversation. We pass the content needed for the response to Anthropic’s Claude API. You can use the diary without requesting interpretations.
• Device and purchase records: our backend stores a random device identifier, credit balance, credit grants and spending, store transaction identifiers, and follow-up allowance counters. Purchase verification data is processed to validate purchases, prevent duplicate grants, and handle refunds. Apple or Google handles payment; we do not receive your card details.
• Operational data: requests involve an IP address and technical connection information. Our application logs contain request identifiers, routes, status codes, and timing information, not dream content. Infrastructure may process connection metadata for delivery and security.
• Support: if you contact us, we receive your email address and what you choose to send. Please do not include dream text or sensitive information unless necessary for your request.

We process information to provide requested services and purchases, protect the service against abuse, respond to support requests, and meet applicable legal obligations. Where consent is required, including for sensitive information, we rely on that consent. Where applicable, our other legal bases are performing our contract with you, legitimate interests in reliable and secure operation, and legal obligations.

3. Service providers

Anthropic: interpretations and follow-up answers are generated by a third-party AI service, the Claude API. Anthropic receives the content described above. Under its commercial API policy, inputs and outputs are not used to train models by default. Its standard API retention is up to 30 days, with exceptions including legal obligations and policy enforcement. Flagged content may be retained for up to two years and related safety classifications for up to seven years. Certain models require 30-day retention even for some customers with zero-retention arrangements. We do not promise zero retention by Anthropic. See its retention policy and model training policy.

Apple and Google: these companies process store purchases and, when enabled in your device settings, your personal device backups. See Apple’s privacy policy and Google’s privacy policy.

Hosting and communications: this website is hosted on DigitalOcean infrastructure in Frankfurt, Germany, and delivered through Cloudflare’s network. They process connection information, such as IP addresses and requested URLs, to deliver and protect the website. Cloudflare may use security cookies when protection features require them. Support email is handled through Google’s Gmail service. See DigitalOcean’s privacy policy and Cloudflare’s privacy policy. Other infrastructure supporting the interpretation service processes information needed to deliver that service. We require service providers processing data on our behalf to protect it under applicable contractual and legal safeguards. We may disclose information when legally required or necessary to protect rights and prevent abuse.

4. Storage and retention

Dream content on our backend: requests are processed in memory to generate a response. Dream text, interpretations, follow-up conversations, and dream profiles are not persisted in our backend database or application logs.

On your device: your diary remains until removed from the device. Deleting the app’s local data does not remove existing iCloud or Google device backups. Manage those copies through your device or cloud account settings. We cannot retrieve or remotely erase your local journal or personal backups.

Service records: device-linked balances and transaction records are retained to provide credits, validate purchases, prevent duplicate transactions, resolve disputes, and meet legal requirements. Operational records and support correspondence are kept for the purposes described above. There is currently no automatic expiry of credit-ledger records. You can request deletion; some records may need to be retained for legal obligations or unresolved transactions.

Third-party copies: Anthropic, Apple, and Google apply their own retention and deletion policies. Removing data from your device does not itself delete information already processed by those providers.

5. Your choices and rights

You can choose to record dreams without requesting interpretations. To stop future interpretation processing, stop requesting readings or follow-up answers. Where processing relies on consent, you may withdraw it; withdrawal does not undo processing that has already lawfully occurred.

You can remove the app and its local data using your device’s controls. On iOS, offloading an app keeps its documents and data; deleting the app is a different action. Check your personal backup settings separately. Removing the app may make device-linked credits inaccessible.

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of personal information; restrict or object to processing; withdraw consent; and complain to your local data protection authority. Contact us to exercise these rights. We may need limited information to verify and locate device-linked records. Do not send us your device authentication token. We cannot supply journal content that exists only on your device.

6. Security and international processing

Interpretation requests use HTTPS. Device authentication credentials are kept in platform secure storage. The journal uses your device’s local storage; we do not claim that the diary database is separately encrypted or end-to-end encrypted. Protect your device and your cloud account.

Our providers may process information outside your country, including in the United States. Where required, international transfers must rely on appropriate legal safeguards. No system is completely secure; avoid including information you do not want processed by an external interpretation service.

7. Children

Mergen is not directed to children under 13. Do not use the service if you are below the minimum age required to consent to data processing in your country, unless a parent or guardian can lawfully provide the required consent. If you believe a child has provided personal information to us, contact us so we can investigate and take appropriate action.

8. Changes to this policy

We will update this page and its effective date when our practices change. Where required, we will provide additional notice or request consent before applying a material change.

9. Contact and privacy requests

The publisher and person responsible for Mergen is Serdar Coşkun.

Support and privacy enquiries: coskun.serdar@gmail.com

For purchase support, include the store, approximate purchase date, and the problem you encountered. Please do not send payment card details, passwords, authentication tokens, or your private journal.