Information we collect
Account information. When you sign up we collect your email address and, if you sign in with Google, your name and basic profile information from Google. Authentication is handled by our infrastructure provider, Supabase.
Billing information. Payments are processed by Stripe. Your card number goes directly to Stripe and never touches our servers. We receive your subscription status, plan, and billing history (for example, that a payment succeeded), and we keep a ledger of your credit balance and usage.
Project content you create in Daydream. Daydream saves your project work to your account so it survives a lost laptop, a new browser, or a rebuilt workspace. This synced content includes your chats, notes, documents, reports, personas, interview transcripts, the text records of test runs, and the source files and assets of the creations and designs you build. It is stored on our servers (hosted by Supabase), scoped to your account, and protected so that only your account can read or write it. Some things are deliberately not synced: screenshots captured during test runs, the browser profiles used by simulated users, your application settings, any API keys or tokens you provide, and regenerable build output such as dependency folders and compiled bundles.
Your cloud workspace. When you use Daydream on the web, your work runs in a private cloud workspace provisioned for your account alone (an isolated sandbox hosted by Vercel). Files you and the agent create live there while you work, and the content listed above syncs to your account so nothing is lost. Workspaces that sit idle are shut down and eventually discarded to keep costs down; your synced content is what rebuilds them.
AI usage and metering. When the app makes AI requests through our hosted gateway, we record metering data: which model was used, token counts, cost, timestamps, the kind of work the request was for (for example, a build session or a conversation), and your account identifier. We use this to enforce your plan limits, keep your billing accurate, and show you what your credits were spent on. This records the type of activity, not the content of your prompts.
Content processed for AI features. To generate responses, the app sends your prompts and relevant project content through our gateway to AI model providers (currently Anthropic and xAI). Under the API terms we use them through, these providers process your content to generate the response and for safety and abuse monitoring, retain it only for a limited period for those purposes, and do not use it to train their models. We do not use your content to train AI models either.
Keys and secrets. API keys and connection tokens you give Daydream (for example a GitHub token or your own product's API keys) are never stored in our databases. On the web they are held inside your own cloud workspace, in restricted files that only that workspace can read. In the legacy macOS application they are held in the macOS Keychain on your machine.
Optional connections. If you connect GitHub, Telegram, Stripe, PostHog, or similar services, Daydream uses tokens you authorize to act on your behalf. Those tokens are held the same way as any other key, described just above. Some connections are there so your dashboard can show you your own numbers: when you connect Stripe, Daydream reads your active subscriptions to work out your recurring revenue, and when you connect PostHog it reads the counts you point it at. A read-only key is enough for both. Those figures are read at the moment you look at them, shown to you, and not stored by us or sent to our servers. What you do through those connections is governed by those services' own privacy policies.
Website and diagnostics. Our website and services keep standard server logs (IP address, browser type, pages requested) for security and reliability. The application may send crash reports and basic diagnostics so we can fix problems.
How we use information
- To provide, operate, and improve the Service
- To authenticate you, sync your work to your account, and keep your account secure
- To process payments, meter usage, and manage subscriptions and credits
- To respond to support requests
- To prevent fraud and abuse
- To comply with law
We do not sell personal information. We do not use your content or personal information for advertising. We do not use your content to train AI models.
Who we share information with
We share information only with service providers who help us run Daydream, and only what they need:
| Provider | What they do | What they handle |
|---|---|---|
| Supabase | Authentication, database, and synced project content | Email, account records, billing ledger, synced project files |
| Stripe | Payment processing | Payment details, billing contact |
| Vercel | Website and app hosting, and the isolated cloud workspace your work runs in | Server logs, API traffic, the files in your workspace |
| Railway | Hosting for our AI gateway | AI request traffic, metering |
| Anthropic | AI model provider | Prompts and content sent for AI responses |
| xAI | AI model provider | Prompts and content sent for AI responses |
| Neon | Databases provisioned for apps you build | Data your own apps store |
| Sign-in (if you choose it) | Sign-in identity |
We may also disclose information if required by law, to protect the rights and safety of our users or others, or as part of a business transaction such as a merger or acquisition (in which case this policy continues to apply to information collected before the change).
Apps you build and deploy
Daydream helps you build and ship your own products. Data that your users give to your product (accounts in your app, rows in your app's database, deployments on your behalf) belongs to your relationship with your users, and you are responsible for it. We are not a party to it, though the infrastructure we provision (such as a Neon database) processes it on your instructions.
Usage analytics in the products you build
So that we can show you whether anything is working, Daydream can add basic usage analytics to a product it builds for you. You should know exactly what that means, because it happens in your product and it is your users it counts.
Where it goes. Your product's pages send events to Daydream, and we write them straight into the database we provisioned for that product, in a separate analytics schema. They pass through our servers in order to get there and we do not keep a copy of our own: the events are not pooled with other customers, not used to build any profile, and not sold or shared with anyone. They sit in your database, which you can claim into your own Neon account at any time and take with you.
We do it this way so that analytics works on a product you already had before you met us, wherever you host it. Your pages carry a public site identifier, which tells us whose events these are and nothing else, so there is never a database password sitting on your web host. Anyone who reads your page source can see that identifier; the worst it allows is sending us made-up events for your own product, which is why we rate limit it.
What it records. The name of an event (a page view, a click, or something your product reports such as finishing signup), when it happened, the page path, the origin a visitor arrived from, and a random identifier stored in your visitor's own browser so that repeat visits can be counted as one person.
What it does not record. No names, no email addresses, no passwords, no form contents, no free text a visitor typed, and no full referring URL (we keep only the site, never the address, because query strings are where personal data tends to hide). The random identifier is not tied to any real-world identity and is not used to follow anyone across other sites.
How long. Events are deleted after 90 days.
Your responsibility. For these events you are the controller and we are processing on your instructions, exactly as with the rest of your app's database. The identifier is stored on your visitor's device, which in some places (including the EU and UK) means your own privacy notice should mention it and you may need consent. When Daydream instruments a product it will offer to add that line to your product's own privacy page; keeping it accurate is yours. You can ask us to turn analytics off for any product, or delete the events yourself at any time, and nothing else about your product changes.
Retention
We keep account records, billing records, and synced project content while your account is active, and as long as needed for legal, tax, and accounting purposes. Usage events collected in a product you built are deleted after 90 days. Metering records are kept to support billing accuracy and dispute resolution. If you delete your account, we delete or de-identify your personal information and synced content within a reasonable period, except where the law requires us to keep it, and we release your cloud workspace. Content that lives only on your own device, and is never synced to us, is yours and is untouched by account deletion.
Security
We use encryption in transit for all communication with our services, isolate each account's synced content so only that account can access it, run every account's work in a cloud workspace isolated from every other account's, keep your keys and secrets out of our databases (see Keys and secrets above), and limit access to production systems. No system is perfectly secure; if we learn of a breach affecting your personal information, we will notify you as required by law.
Your choices and rights
- Access, correction, deletion. You can request a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it by contacting us at the address in the Contact section.
- Cancel anytime. You can cancel your subscription from your account; billing stops at the end of the current period.
- California residents. You have the right to know what personal information we collect, to request deletion, and to not be discriminated against for exercising those rights. We do not sell or share personal information as defined by the California Consumer Privacy Act. To exercise these rights, use the contact address below.
Children
Daydream is a professional tool and is not directed to anyone under 18. We do not knowingly collect personal information from children.
Changes to this policy
If we make material changes, we will post the updated policy on our website and update the effective date. Continued use of the Service after changes take effect means you accept the updated policy.
Contact
Astral AI Inc.
savannah@astral.now