Privacy Policy

1. Controller

2. What data we collect and why

2.1 Email address (registration and contact)

When you register via the sign-up form, join the Early Access program or contact us by email, we collect your email address. The legal basis is your explicit consent (Art. 6(1)(a) GDPR). We use it exclusively for the agreed purpose. No sharing with third parties. No newsletter without renewed consent.

2.2 Live dream analysis (website)

Dream texts entered on the website are transmitted to our API (Cloudflare Workers) for Ethyria-KI processing. The texts are not stored permanently and are not linked to any individual. The analysis limit is managed via local browser storage (localStorage). Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

2.3 Consent management

Before using the live dream analysis, a consent dialogue appears. Your consent is stored with a unique identifier (UUID), timestamp, version and language in your browser storage and in our Cloudflare KV store (retention period: 3 years). You can withdraw your consent at any time via the link in the footer. Legal basis: Art. 6(1)(a) GDPR in conjunction with Art. 7 GDPR.

2.4 App data (Android)

Your dream entries and analyses in the Ethyria app are automatically synced with our cloud database (Supabase) so you can access your dream journal across devices. For Ethyria-KI-powered analysis, the dream text is transmitted to our AI provider and is not permanently stored there. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

2.5 In-app purchases (Google Play & Stripe)

Purchases within the Android app (single analysis, monthly or annual subscription) are processed exclusively via Google Play. We do not receive payment data. Google LLC processes this data in accordance with the Google Privacy Policy. Website payments are processed via Stripe Inc. We do not receive credit card data. More information: stripe.com/privacy.

2.6 Analytics (Google Analytics 4)

This website uses Google Analytics 4 (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics is loaded only after your explicit consent via the Cookie Consent popup (Consent Mode v2 with analytics_storage = denied by default). Without your consent, no analytics cookies are set and no personal data is transmitted to Google. With active consent we collect: anonymised IP address (truncated last octets), browser and operating system version, referrer, visited pages, dwell time and approximate region (country). Cookie retention: up to 13 months. Legal basis: consent under Art. 6(1)(a) GDPR in conjunction with § 25 TTDSG.

You can withdraw or update your consent at any time via the "Cookie settings" link in the footer. Google also offers a browser add-on to disable Google Analytics: tools.google.com/dlpage/gaoptout.

2.7 Error tracking (Sentry)

We use Sentry (Functional Software Inc. dba Sentry) to detect and fix technical errors. We use the EU ingest endpoint (ingest.de.sentry.io). No personal data is transmitted. IP addresses and user-identifying information are disabled. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

2.8 Server logs and CDN

When you visit this website, technical access data (IP address, browser, timestamp) is recorded in server logs by GitHub Pages and Cloudflare. This data is deleted after 7 days at the latest. Cloudflare acts as CDN and security layer in front of the web server. Legal basis: legitimate interest according to Art. 6 (1) (f) GDPR.

2.9 Early Access program (email membership)

When you sign up for the Ethyria Early Access program, we collect your email address, language and the page from which you signed up. The data is stored in our database (Supabase Postgres, EU-region). Your sign-up becomes active immediately and your status is set to confirmed right away, no additional confirmation email is needed. Your consent is documented by the checkbox in the sign-up form. You can unsubscribe at any time via the Unsubscribe link in every email.

Retention period: until revocation, maximum 7 years. Legal basis: Art. 6 (1) (a) GDPR (consent). We send only program-related emails (welcome, program updates, occasional dream reflections). We never share your email with external advertising networks.

Sending is performed via Resend Inc. (USA). Resend is certified under the EU-US Data Privacy Framework (DPF). You can find the certification list at dataprivacyframework.gov.

2.10 Chat assistant (Ethyria-KI-powered)

Our chat assistant (chat icon at the right edge of the screen) answers questions about Ethyria and helps with signing up for the Early Access program. It only becomes active after your explicit consent in the cookie settings. Your chat messages are transmitted to the Google API (USA) for answering. If you use voice input (microphone button), your browser recognises the spoken text locally via the Web Speech API. In Chromium browsers (Chrome, Edge, Opera) the microphone audio is transmitted to Google servers (USA) for this purpose; we only ever receive the recognised text, never the audio. We store the chat transcripts together with a pseudonymous session ID, your language and the page visited for 30 days on our database server (Supabase, EU region); they are deleted automatically afterwards. Please do not enter sensitive personal data in the chat. The legal basis is your consent (Art. 6 (1) (a) GDPR); you can withdraw it anytime via the cookie settings in the footer.

3. Cookies and local storage

This website uses only technically necessary storage (localStorage, sessionStorage) to manage analysis credits, consents, session cache, cookie settings and Early Access modal gates (suppression after dismiss). When you use the chat assistant, the chat history (ethyria_chat_history) and a pseudonymous session ID (ethyria_chat_session) are additionally stored locally. No tracking or marketing cookies are used unless you explicitly opt in to analytics through the Cookie Consent popup. A cookie consent under § 25 TTDSG is required for non-essential cookies and is collected via the Cookie Consent popup.

The service worker enables offline use through local caching of website resources.

4. Ethyria-KI processing and EU AI Act

Dream interpretation is performed by an Ethyria-KI model connected via our Cloudflare Workers API. The following transparency obligations apply:

• The Ethyria-KI nature of all analyses is always clearly communicated to users.
• Ethyria analyses do not replace professional psychological or therapeutic advice.
• Input texts are used solely to generate the analysis and are not used to train Ethyria-KI models.
• The Ethyria app and browser live analysis are classified as general-purpose AI applications at the lowest risk level under the EU AI Act (Regulation (EU) 2024/1689).

5. Data transfers to third countries

The following services transfer data to countries outside the EEA:

• Cloudflare (USA): Certified under EU-US Data Privacy Framework (DPF). Processing for our API and CDN.
• Stripe (USA): Certified under EU-US DPF. Payment processing on the website.
• Google Play (USA): Payment processing for app purchases. Standard Contractual Clauses (SCC) per Art. 46 GDPR.
• Sentry (USA): EU ingest endpoint active. No personal data transmitted.
• Google Analytics (USA): Google Ireland Ltd. is certified under the EU-US Data Privacy Framework. Transmission only after your explicit consent (see section 2.6).
• Google API (USA): Processing of the messages of our chat assistant. Google LLC is certified under the EU-US Data Privacy Framework. Transmission only after your explicit consent (see section 2.10).
• Supabase (USA, EU region): Storage of Early Access memberships in the EU region (Frankfurt). Data center and storage in Frankfurt/EU, GDPR-compliant. Standard Contractual Clauses and DPF certification at the parent company.
• Resend (USA): Sending of Early Access emails. Resend Inc. is certified under the EU-US DPF (see section 2.9).

An adequate level of data protection is ensured through DPF certification, standard contractual clauses or technical measures.

6. Your rights

Under the GDPR you have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to object (Art. 21 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to withdraw consent (Art. 7(3) GDPR)

Please direct requests to: support@ethyria.at

You also have the right to lodge a complaint with the Austrian Data Protection Authority: www.dsb.gv.at

7. Changes to this policy

We reserve the right to update this Privacy Policy as necessary. The current version is always available on this page. In the event of significant changes, registered users will be notified by email.