Privacy Policy

1. Controller

Ethyria Dream Analysis

Oliver Stolz

Freistädter Straße 65

4040 Linz, Austria

Email: support@ethyria.at

2. What data we collect and why

2.1 Email address (registration and contact)

When you register via the sign-up form, join the Early Access program or contact us by email, we collect your email address. The legal basis is your explicit consent (Art. 6(1)(a) GDPR). We use it exclusively for the agreed purpose. For Early Access, registration and email delivery use the service providers described in section 2.7. We do not use your address for external advertising. No newsletter without renewed consent.

2.2 Consent management

Before the privacy settings are shown, a consent dialogue appears. Your consent is stored with a unique identifier (UUID), timestamp, version and language in your browser storage and in our Cloudflare KV store (retention period: 3 years). You can withdraw your consent at any time via the link in the footer. Legal basis: Art. 6(1)(a) GDPR in conjunction with Art. 7 GDPR.

2.3 App data (Android)

Your dream entries and analyses in the Ethyria app are automatically synced with our cloud database (Supabase) so you can access your dream journal across devices. On-device they are additionally held in an encrypted database. They are linked via a random device ID; an optional recovery email is used solely for account recovery. Deleting an entry removes it from the device and the server. For Ethyria-KI-powered analysis, the dream text is transmitted to our AI provider and is not permanently stored there. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

2.4 In-app purchases (Google Play & Stripe)

Purchases within the Android app (single analysis, monthly or annual subscription) are processed exclusively via Google Play. We do not receive payment data. Google LLC processes this data in accordance with the Google Privacy Policy. Website payments are processed via Stripe Inc. We do not receive credit card data. More information: stripe.com/privacy.

2.5 Analytics (Google Analytics 4)

This website uses Google Analytics 4 (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). The Google Analytics script is requested only after you explicitly allow analytics in the Cookie Consent popup. No analytics events are sent to Google before that. If you withdraw consent, this site deletes its Google Analytics cookies and blocks future analytics events. The consent-status update may be sent to Google. With active consent we collect: anonymised IP address (truncated last octets), browser and operating system version, referrer, visited pages, dwell time and approximate region (country). Cookie retention: up to 13 months. Legal basis: consent under Art. 6(1)(a) GDPR in conjunction with § 25 TTDSG.

You can withdraw or update your consent at any time via the "Cookie settings" link in the footer. Google also offers a browser add-on to disable Google Analytics: tools.google.com/dlpage/gaoptout.

2.6 Server logs and CDN

When you visit this website, technical access data (IP address, browser, timestamp) is recorded in server logs by GitHub Pages and Cloudflare. This data is deleted after 7 days at the latest. Cloudflare acts as CDN and security layer in front of the web server. Legal basis: legitimate interest according to Art. 6 (1) (f) GDPR.

2.7 Early Access program (email membership)

When you sign up for the Ethyria Early Access program, we collect your email address, language and the page from which you signed up. The data is stored in our database (Supabase Postgres, EU-region). Your sign-up becomes active immediately and your status is set to confirmed right away, no additional confirmation email is needed. Your consent is documented by the checkbox in the sign-up form. You can unsubscribe at any time via the Unsubscribe link in every email.

Retention period: until revocation, maximum 7 years. Legal basis: Art. 6 (1) (a) GDPR (consent). We send only program-related emails (welcome, program updates, occasional dream reflections). We never share your email with external advertising networks.

Sending is performed via Resend Inc. (USA). Resend is certified under the EU-US Data Privacy Framework (DPF). You can find the certification list at dataprivacyframework.gov.

2.8 Chat assistant (discontinued)

The chat assistant was discontinued on 26 September 2026. It is no longer available, and no chat messages are transmitted to our servers or to third parties. Messages processed up to that date are still stored only with a pseudonymous session ID on our database server (Supabase, EU region) and are automatically deleted, as before, no later than 30 days after they were created. The chat histories and session IDs previously stored in your browser (ethyria_chat_history, ethyria_chat_session) are no longer written and are deleted automatically on the next page load. After the 30-day period no chat data remains. The legal basis for the remaining deletion is the consent you gave to use the assistant (Art. 6 (1) (a) GDPR); it ends with the discontinuation of the service.

2.9 Health data (Health Connect, optional)

The app's optional bio-synchronous analysis reads (only after your explicit grant in Health Connect) sleep data for the 24 hours before your dream. The app requests no write permissions. Heart rate and heart rate variability are not requested; the app reads sleep data only. On your device it computes the following values: the last REM phase and the duration of the REM, deep and light sleep phases. These values are transmitted to our API together with your dream text, because the AI analysis needs them. Your health data therefore leaves your device. It is passed to the AI model provided by Google Gemini; no other third party receives it. Health data is not stored and not logged. You can revoke the grant at any time in Health Connect or in the system settings; after that no health data is transmitted. Legal basis: explicit consent (Art. 9(2)(a) GDPR).

2.10 App analytics and stability

The app collects usage and stability data: Sentry (EU ingest endpoint) for anonymous crash reports, and Firebase Analytics (Google) for usage statistics. This collection is switched off by default and is only enabled once you have expressly consented to usage statistics; you can revoke it at any time under Profile → Privacy. Legal basis: consent (Art. 6(1)(a) GDPR) and legitimate interest in stable operation (Art. 6(1)(f) GDPR).

2.11 Voice input (dictation, optional)

You can dictate your dream in the app instead of typing. The app needs microphone permission for this; it is requested the first time you use the microphone, and the purpose is explained beforehand. Your recording is transmitted to Google's speech service to be transcribed. We do not store the recording: only the recognised text is kept, and it is stored in your dream journal. Nothing is transmitted while you have not granted microphone permission. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by revoking microphone permission in the system settings; dictation is then no longer possible.

2.12 Voice output (dream reader, optional)

The app can read your analysis aloud. By default this happens entirely on your device, so no data leaves it. Only if you enable the cloud voice in the settings, hold a premium subscription and are online, is the text of your interpretation transmitted to our API and from there to Google in order to generate the audio. The app stores the generated audio files on your device in a cache of up to 50 MB; older files are evicted first. The cache is deleted when you uninstall the app. Legal basis: your consent (Art. 6(1)(a) GDPR).

2.13 Feedback survey (optional)

When your trial period ends, we invite you to a short survey. What is transmitted: device model, Android version, app language, the number of your stored dreams and analyses, trial days used, and your answers to the individual questions. Free text, dream content and health data are not part of the survey. The sole recipient is our own server. Participation is voluntary; there is no disadvantage if you do not take part. Legal basis: your consent (Art. 6(1)(a) GDPR).

3. Cookies and local storage

This website uses only technically necessary storage (localStorage, sessionStorage) to manage analysis credits, consents, session cache, cookie settings and Early Access modal gates (suppression after dismiss).The former chat keys (ethyria_chat_history, ethyria_chat_session) have not been written since 26 September 2026 and are removed from local storage automatically when the page loads. No tracking or marketing cookies are used unless you explicitly opt in to analytics through the Cookie Consent popup. A cookie consent under § 25 TTDSG is required for non-essential cookies and is collected via the Cookie Consent popup.

The service worker enables offline use through local caching of website resources.

4. Ethyria-KI processing and EU AI Act

Dream interpretation is performed by an Ethyria-KI model connected via our Cloudflare Workers API. The following transparency obligations apply:

• The Ethyria-KI nature of all analyses is always clearly communicated to users.
• Ethyria analyses do not replace professional psychological or therapeutic advice.
• Input texts are used solely to generate the analysis and are not used to train Ethyria-KI models.
• The Ethyria app is classified as a general-purpose AI application at the lowest risk level under the EU AI Act (Regulation (EU) 2024/1689).

5. Data transfers to third countries

The following services transfer data to countries outside the EEA:

• Cloudflare (USA): Certified under EU-US Data Privacy Framework (DPF). Processing for our API and CDN.
• Stripe (USA): Certified under EU-US DPF. Payment processing on the website.
• Google Play (USA): Payment processing for app purchases. Standard Contractual Clauses (SCC) per Art. 46 GDPR.
• Google Analytics (USA): Google Ireland Ltd. is certified under the EU-US Data Privacy Framework. Transmission only after your explicit consent (see section 2.5).
• Google API (USA): The chat assistant on this website has been discontinued (see section 2.8); messages from website visitors are no longer transmitted to Google. Google LLC is certified under the EU-US Data Privacy Framework.
• Google AI (USA): Dream analysis (Gemini) and image generation in the app. Google LLC is certified under the EU-US Data Privacy Framework.
• Supabase (USA, EU region): Storage of Early Access memberships in the EU region. Data center and storage in the EU, GDPR-compliant. Standard Contractual Clauses and DPF certification at the parent company.
• Resend (USA): Sending of Early Access emails. Resend Inc. is certified under the EU-US DPF (see section 2.7).

An adequate level of data protection is ensured through DPF certification, standard contractual clauses or technical measures.

6. Your rights

Under the GDPR you have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to object (Art. 21 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to withdraw consent (Art. 7(3) GDPR)

Please direct requests to: support@ethyria.at

You also have the right to lodge a complaint with the Austrian Data Protection Authority: www.dsb.gv.at

7. Changes to this policy

We reserve the right to update this Privacy Policy as necessary. The current version is always available on this page. In the event of significant changes, registered users will be notified by email.