Privacy Policy
Last updated: October 26, 2025
1. Introduction
Thank you for trusting Root Code Collective, a U.S.-based 501(c)(3) nonprofit organization (“RCC”). We are the creators of The Dream Drop, a privacy-first dream journaling platform. Protecting your anonymity, and the privacy that makes our mission possible, is central to everything we build.
Not medical advice; not HIPAA-covered. The Dream Drop is for self-reflection and research. We do not assess, diagnose, treat, or predict any health or mental-health condition, and we are not health-care providers, health plans, or health-care clearinghouses. Accordingly, our services are not subject to HIPAA.
Questions? You can reach us at support@rootcodecollective.org.
2. Our Commitment to Anonymity
We do not ask for names, emails, device IDs, or other direct identifiers. Every user is represented only by an anonymous signature stored on the device.
We collect limited, pseudonymized data such as approximate location and birth year, which may be considered “personal” under privacy laws. This data is never used to identify you.
3. What We Collect and Why
| Category | Details | Purpose |
|---|---|---|
| Dream entries | Free-text logs you submit | Personal archive, public display on RCC services (see §4), and anonymized research |
| Approximate location | City-level or ~25 km radius | Location-based insights |
| Optional demographics | Birth year, gender | Research relevance |
| App usage metrics | Crash reports, tap events | Improve stability and experience |
We do not use cookies, ad IDs, or third-party trackers.
4. How We Use Your Data
- App Functionality – Display your dream history and insights
- Public Display on RCC Services – Dreams are public by default on RCC-controlled services (The Dream Drop app and RCC-operated websites). You can mark any individual dream Private at creation or later; Private dreams are not displayed publicly.
- Academic Research – Share de-identified data with accredited institutions under agreements that prohibit re-identification
- Product Improvements & Security – Monitor errors, prevent abuse, and improve features
We never sell or rent your data. Ever.
5. Editing or Deleting Your Data
| Action | How to do it |
|---|---|
| Edit or delete a single dream | Within 48 hours, use: Dream → ⋯ → Edit or Delete |
| Full account removal | Use Settings → Delete all data and dreams. Deletion is reviewed and completed within 3 business days for safety reasons. |
Note: When you delete content, we stop displaying it and remove it from active systems (with a reasonable period for technical backups). Previously generated de-identified research outputs may be retained as permitted by law.
6. Legal Bases (GDPR / UK GDPR)
- Consent – Dream logging you submit; optional demographics
- Legitimate interests –
- Public display of dreams on RCC-controlled services. Dreams are public by default; you can set any individual dream to Private at any time to stop its public display.
- De-identified academic research and aggregate statistics
- Product improvement, security, and fraud prevention
You may object to processing based on legitimate interests at any time (e.g., set specific dreams to Private or contact us to request broader restriction).
- Legal obligation – When required by law (e.g., responding to lawful requests)
7. International Data Transfers
Data is hosted in the United States and protected via the EU–U.S. Data Privacy Framework (where applicable) and/or Standard Contractual Clauses (EU) and the UK Addendum/IDTA (UK) for transfers.
8. Data Retention
| Data Type | Retention Period |
|---|---|
| Dream logs, demographics | Until deleted or removal is requested |
| Aggregated/de-identified research outputs | Retained indefinitely (not reasonably identifiable) |
| Support emails (if you contact us) | Up to 2 years |
9. Data Security
We use strong encryption, access controls, and routine security testing. While no system is perfect, we continuously improve our defenses. Because we do not collect contact information, if a material security issue arises we will post a Security Notice in-app and on our website to inform users.
10. Children
The app is for users aged 18 and older. If you believe data from a minor was submitted, please contact us for removal.
11. Your Privacy Rights
| Right | How to exercise it |
|---|---|
| Access / Portability | Use Export in the app (Text, CSV, JSON) |
| Deletion | Use Settings → Delete all data and dreams |
| Correction | Dreams can be edited within 48 hours; demographic data anytime |
| Objection (EU/UK) | Set a dream Private to stop public display, or email support@rootcodecollective.org to request broader restriction |
| Restriction & Complaints (EU/UK) | You may request restriction and you may lodge a complaint with your local supervisory authority |
We do not conduct behavioral advertising or share any data with advertisers.
We may share fully de-identified data with accredited researchers under formal agreements.
12. State-Specific Notices (U.S.)
Residents of certain U.S. states (e.g., Washington and Nevada) may have additional rights regarding consumer health data. See our Consumer Health Data Notice for disclosures and choices applicable in those jurisdictions.
13. Changes to This Policy
We may update this policy. Significant changes will be announced in-app or via email if you’ve contacted us previously.
Contact
Root Code Collective / The Dream Drop
Sonoma County, California, USA
support@rootcodecollective.org