Privacy Policy
Effective date: March 21, 2026
Last updated: October 25, 2026
REMstack ("we," "us," "our") is operated by Maksim Mezhigurskii, a private individual based in Sweden. This Privacy Policy explains how we collect, use, and protect your personal data when you use remstack.io (the "Platform").
We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) and other applicable data protection laws.
1. Data Controller
The data controller for the Platform is:
- Name: Maksim Mezhigurskii
- Business form: Private individual, Sweden
- Email: help@remstack.io
- Website: remstack.io
2. What Data We Collect
Account Data
- Email address
- Username / display name
- Password (hashed, we never store plaintext passwords)
- Account creation date
Practice Data (provided by you)
- Dream journal entries
- Practice session logs (techniques, supplements, results, timestamps)
- Protocol settings and preferences
- Notes and tags
- Recall learning path progress and morning check-ins ("nothing this morning"), when you use the recall path in the mobile app
- Guided lucid-dreaming program progress and settings, answers about whether you did the night's step, and answers about how quickly you fell back asleep after the wake-up, when you use the program in the mobile app
Sleep & Health Data (with your consent)
- Data synced from wearable devices (e.g., Polar) including sleep stages, REM windows, heart rate variability
- Sleep sessions, step count, and active-energy data read from your phone's health platform (Health Connect on Android, Apple Health on iOS) and sent to our servers, if you enable this sync in the mobile app
- This data is only collected when you explicitly connect a device or enable health sync
Voice Recordings (mobile app, optional)
- Audio you record when logging a dream or practice session by voice instead of typing, in the mobile app
- Sent to OpenAI's Whisper API to be transcribed into text
- Only collected when you actively choose voice input
Technical Data (collected automatically)
- IP address (kept in full only in the security log and consent records described under Data Retention; otherwise anonymized)
- Browser type and version
- Device type
- Pages visited and time spent
- Referral source
Analytics Data
On the website: we do not use analytics or tracking tools. Our servers keep standard technical logs (described under Technical Data) to run and secure the Platform.
In the mobile app: we use Google Analytics for Firebase to understand which features are used and where people get stuck. It records screen views and a small set of in-app actions (saving a dream, logging a practice session, sending an AI Coach message, connecting a wearable or health platform, changing the interface language), together with an app-instance identifier generated by Firebase and basic device and country information. It does not record the content of your dreams, your journal entries, or your coach conversations.
This is optional. You can turn it off at any time under Settings → Privacy & data in the mobile app; switching it off stops collection and clears the app-instance identifier.
3. How We Use Your Data
We use your data to:
- Provide the Platform: Display your dashboard, track progress, generate analytics and correlations
- Improve the Platform: Understand usage patterns, fix bugs, develop new features
- Communicate with you: Send account-related notifications, respond to support requests
- Transcribe voice recordings: Convert audio you record in the mobile app into text, via OpenAI's Whisper API, only when you use voice input
- Analyse your dreams: Send the text of a dream you log (typed, or the transcript of a voice recording) to Anthropic's Claude API to generate a title, summary, tags and dream signs, only after you allow AI processing in the app
- Provide AI Coach (Premium feature): Send the titles and AI summaries of your recent dreams, counts from your journal (nights with a remembered dream, dream signs, lucid dreams), your practice logs, your reality-check counts, your practice level and daily plan, your onboarding answers, and your coach conversation to Anthropic's Claude API to generate personalized coaching responses, only when you actively use the AI Coach feature. The coach never receives sleep data from wearables or health platforms (Apple Health, Health Connect, Polar and others) or the health notes in your profile
- Generate aggregated statistics: Create anonymous, aggregated insights across all users (e.g., "which techniques have the highest success rate"). Individual users are never identifiable in aggregated data.
Legal Basis for Processing (GDPR)
| Purpose | Legal Basis |
|---|---|
| Providing the Platform | Performance of contract (Art. 6(1)(b)) |
| Analytics | Legitimate interest (Art. 6(1)(f)) |
| Communications | Legitimate interest (Art. 6(1)(f)) |
| Sleep data sync (Polar, Garmin, Health Connect, Apple Health) | Your explicit consent (Art. 6(1)(a) and, as health data, Art. 9(2)(a)) |
| Voice transcription | Your explicit consent (Art. 6(1)(a)) — only when you use voice input |
| Dream analysis | Your explicit consent (Art. 6(1)(a)) — asked in the app before the first analysis |
| AI Coach (Premium) | Your explicit consent (Art. 6(1)(a)) — only when you use the feature |
| Marketing emails | Your explicit consent (Art. 6(1)(a)) |
| Consent records and security log | Legal obligation to be able to show your consent (Art. 6(1)(c), Art. 7(1)) and legitimate interest in defending legal claims (Art. 6(1)(f)) |
4. What We Do NOT Do With Your Data
- We do not sell your personal data to third parties
- We do not share your individual practice data with other users
- We do not use your data for advertising or ad targeting
- We do not share your data with data brokers
- We do not use your personal data to train AI models without your explicit consent — we use third-party AI providers (OpenAI, Anthropic) only to power in-app features (voice transcription, dream analysis, AI Coach) under agreements that exclude our data from being used to train their models
5. Data Sharing
We share data only with:
| Service | Purpose | Data Shared | Location |
|---|---|---|---|
| Hetzner | Servers and database | All data | Germany (EU) |
| Google Cloud Storage | Database backups and voice recordings | Encrypted backups, audio files | Belgium (EU) |
| Resend | Account emails (verification, password reset) | Email address, email content | EU / USA |
| Sentry | Error reports, so we can fix crashes | Technical error details, which may include your user ID and IP address | Germany (EU) |
| OpenAI | Voice-to-text transcription (mobile app, optional) | Audio recordings you submit via voice input | USA |
| Anthropic | Dream analysis and AI Coach (optional) | Dream text and voice transcripts you analyse; for the AI Coach, recent dream titles and AI summaries, journal counts, practice logs, reality-check counts, practice level and plan, onboarding answers, and the coach messages you send. No wearable or health-platform data and no health notes | USA |
| Google (Firebase) | Mobile app usage analytics (optional) | Screen views, a small set of in-app actions, app-instance identifier, device and country | EU / USA |
| Polar | Sleep data sync (optional) | Authentication tokens | EU |
| Stripe | Payment processing (not active yet) | Email, payment details | EU / USA |
The mobile app and the website ask for your permission before sending anything to OpenAI or Anthropic for the first time. You can withdraw it at any time under AI processing in the app's settings; the app then keeps working as a plain journal, without transcription, analysis or the AI Coach.
Each of these providers processes your data on our behalf under a data processing agreement (Art. 28 GDPR) and may use it only to provide its service to us.
If you choose to sign in with Google, Apple, Facebook or Telegram, that company confirms your identity to us and receives the fact that you are signing in to REMstack. It acts under its own privacy policy, not on our behalf. The same applies to Apple Health and Health Connect, which stay under your control on your phone.
6. Data Storage & Security
- Location: Your data is stored on servers in the European Union (Hetzner, Nuremberg, Germany). Encrypted database backups and voice recordings are kept in Google Cloud Storage in Belgium (EU)
- Encryption: Data is encrypted in transit (TLS/HTTPS). Backups and voice recordings are encrypted at rest by Google Cloud Storage. In the database, the text of your dreams, their AI summaries, your notes and connected-service tokens are additionally encrypted field by field. The database runs on a server in a Hetzner data centre with physical access control and is not reachable from the internet
- Access: Only the Platform operator has access to the database
- Passwords: Stored using industry-standard hashing (never in plaintext)
- Backups: Encrypted database backup every night, kept for 30 days
- If something goes wrong: If a security breach puts your data at risk, we will report it to the Swedish data protection authority (IMY) within 72 hours and tell you without undue delay when the risk to you is high
7. Data Retention
- Account data: Retained for as long as your account is active. Deleted within 30 days of account deletion.
- Practice data: Retained for as long as your account is active. Deleted within 30 days of account deletion.
- Voice recordings & transcripts: Retained for as long as your account is active, same as other practice data. Deleted within 30 days of account deletion.
- Technical/analytics data: Retained in anonymized form for up to 24 months.
- Backup data: Backups are kept for 30 days and then erased; our storage provider keeps an erased backup recoverable for a further 7 days. A deleted account is therefore gone from all backups within 37 days of deletion.
- Consent records: When you give or withdraw a consent (AI processing, health data, these terms), we record what you chose, which version of the text you saw, when, from which app version and IP address. You can see your own records in your data export. After you delete your account we keep these records, no longer linked to your account, for up to 3 years so we can show what you agreed to if a dispute arises, and then delete them.
- Security log: Sign-ins are logged with time and IP address for security and kept for 12 months. After account deletion the log no longer names you; the record that a deletion happened is kept for 3 years.
8. Your Rights (GDPR)
Under GDPR, you have the following rights:
- Right of access: Request a copy of all personal data we hold about you
- Right to rectification: Request correction of inaccurate data
- Right to erasure ("right to be forgotten"): Request deletion of your personal data
- Right to data portability: Request your data in a machine-readable format (JSON)
- Right to restrict processing: Request that we limit how we use your data
- Right to object: Object to processing based on legitimate interest
- Right to withdraw consent: Withdraw consent for optional data processing (e.g., AI processing, sleep data sync, marketing emails) at any time. Withdrawal does not affect processing that happened before it
How to Exercise Your Rights
- Delete your account: Use the account deletion feature in Platform settings, or email us
- Export your data: Use the data export feature in Platform settings, or email us
- Other requests: Email us at help@remstack.io
We will respond to all requests within 30 days as required by GDPR.
9. Cookies
The website uses only essential cookies required for authentication and session management. We do not use tracking cookies, advertising cookies, or third-party cookies for analytics.
The mobile app does not use cookies. It does use Google Analytics for Firebase, which relies on an app-instance identifier rather than cookies — see "Analytics Data" above, including how to turn it off.
If we introduce non-essential cookies in the future, we will implement a cookie consent mechanism before setting them.
10. Children
The Platform is not intended for anyone under the age of 18. We do not knowingly collect personal data from children. If we learn that we have collected data from a child under 18, we will delete it promptly.
11. International Data Transfers
Your account, journal and health data are stored within the European Economic Area (EEA).
Some features send data to providers in the USA (see the Location column in section 5):
- OpenAI receives voice recordings for transcription, and Anthropic receives dream text and coach messages, only after you allow AI processing in the app.
- Google (Firebase Analytics) and Resend may process usage data and email data in the USA.
These transfers are protected by the EU–US Data Privacy Framework where the provider is certified under it, and by the European Commission's Standard Contractual Clauses included in these providers' data processing agreements. You can ask us for a copy of the relevant safeguards at help@remstack.io.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify registered users of material changes via email or through the Platform. The "Last updated" date at the top reflects the most recent revision.
13. Supervisory Authority
If you believe we are processing your data unlawfully, you have the right to lodge a complaint with a supervisory authority. In Sweden, this is:
Integritetsskyddsmyndigheten (IMY)
- Website: www.imy.se
- Email: imy@imy.se
14. Contact
For any privacy-related questions or requests:
- Email: help@remstack.io
- Website: remstack.io