Privacy Policy

This Policy applies to anyone who creates an account or uses the Service. It does not apply to third-party websites or services we link to but do not control.

We collect the following categories of information:

Information you provide directly

• Account information: email address, username, password (hashed), and your account preferences.
• Age verification: information necessary to verify that you are 18+ (or the age of majority in your jurisdiction). This is processed by our verification partner; we receive a pass/fail result and minimal supporting metadata, not the underlying identity document.
• Payment information: processed by our third-party payment processor. We receive transaction records and status (succeeded, refunded, charged-back) but not full card numbers or bank credentials.
• User-generated content: characters, personas, lorebooks, scenarios, prompts, conversations, generated images and videos, story drafts and submissions, voice clips, and any other content you create within the Service.
• Communications: messages you send to us (e.g. support emails), direct messages to other users, and feedback you submit.

Information collected automatically

• Usage data: features you use, characters you chat with, images you generate, credits spent, timestamps, and similar interaction telemetry needed to operate the Service and to detect abuse.
• Device and connection data: IP address, browser type, operating system, device identifiers, and referrer URLs, collected through our hosting and analytics providers (e.g. Cloudflare).
• Cookies and similar technologies: session tokens (required for login), and a small number of functional cookies. We do not currently use third-party advertising cookies.
• Error and performance data: stack traces, request paths, and performance metrics collected through error monitoring (e.g. Glitchtip) and basic analytics (e.g. Cloudflare Analytics).

We use the information we collect to:

• Operate, maintain, and improve the Service, including model routing, prompt assembly, generation, moderation, and billing.
• Verify age and identity where required by law or by our compliance partners.
• Detect, investigate, and prevent abuse, fraud, security incidents, and violations of our Terms of Service.
• Process payments and prevent chargeback fraud through our payment partners.
• Communicate with you about your account, service updates, and (with separate opt-in where required) marketing messages.
• Comply with legal obligations, respond to lawful requests, and protect our rights and the rights and safety of users and the public.

The Service is designed for adult creative fiction. We scan uploaded and generated images for known child sexual abuse material (CSAM) using industry-standard hashing technology. Confirmed matches are reported to the National Center for Missing & Exploited Children (NCMEC) and to law enforcement as required by 18 U.S.C. § 2258A and equivalent laws. We retain associated account information, content, and metadata for the period required to support such reports.

We also operate text-based safety classifiers that screen prompts and outputs for prohibited content described in our Terms. These classifiers run automatically and may block, interrupt, or modify generation in real time.

We share information only as described below. We do not sell your personal information.

With service providers

We rely on third-party providers to deliver the Service. Information necessary to perform each function is transmitted to the corresponding provider. Current providers include:

• Large language model providers (such as Together AI and DeepSeek). Your conversations, prompts, persona, character cards, and recent message history are transmitted to these providers when generating responses. Providers may retain transmitted data for a short period for abuse detection per their own terms.
• Image, video, and audio generation providers (such as Novita AI). Your prompts (and, for video features, source images) are transmitted to these providers; generated images are downloaded and re-hosted on our infrastructure.
• Cloud infrastructure (Hetzner) and object storage (Cloudflare R2). Service code runs on Hetzner servers; uploaded and generated media is stored on Cloudflare R2.
• Database service (Supabase, hosted in the United States). Account, character, conversation, and credit data are stored here.
• Payment processor. Payment method details are collected and processed by our payment processor under their own terms; we receive transaction status only.
• Age verification provider. Identity documents and biometric data are processed by the verification provider under their own terms; we receive a pass/fail result.
• Error monitoring and analytics (such as Glitchtip, Cloudflare Analytics, UptimeRobot).
• Safety scanning for known CSAM via industry-standard image-hashing services.
• Optional communications: if we send transactional or marketing email, we use a deliverability partner such as a hosted SMTP service.

For legal reasons

We may disclose information when we believe in good faith that disclosure is necessary to comply with applicable law, legal process (such as a subpoena), or a lawful request from government authorities; to enforce our Terms; to protect the rights, property, or safety of Dreamcrawler, our users, or others; or to investigate suspected fraud or abuse.

Business transfers

If Dreamcrawler is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will provide notice (e.g. in this Policy and by reasonable means) before your information becomes subject to a different privacy policy.

With your direction

If you submit content to a public area of the Service (such as a character gallery, stories index, or shareable character link), other users will see that content as described in our Terms.

We retain account information and User Content for as long as your account is active and for a reasonable period afterward to support legitimate operational, legal, and safety purposes. Specifically:

• Active accounts: retained until you request deletion.
• Deleted accounts: account record and associated content are soft-deleted on request and hard- deleted within a reasonable period (typically 30–60 days), except for records we are legally required to retain longer (e.g. payment records, abuse reports, NCMEC referrals).
• Backups: may persist beyond the deletion window per our standard backup rotation and will be overwritten in the normal course.
• Aggregated or de-identified data that does not identify you may be retained indefinitely for analytics and product improvement.

Depending on where you live you may have rights regarding your personal information, including the right to access, correct, export, or delete it, and the right to object to or restrict certain processing. To exercise these rights, write to us at privacy@dreamcrawler.ai. We will respond within the time required by applicable law.

If you reside in the European Economic Area, the United Kingdom, or Switzerland, our legal bases for processing your information include performance of a contract (operating the Service), legitimate interests (operating, securing, and improving the Service; preventing abuse), consent (where required, e.g. for certain communications), and compliance with legal obligations.

If you reside in California, you have specific rights under the California Consumer Privacy Act (CCPA/CPRA) including the right to know, delete, and opt out of “sale” or “sharing” of personal information. We do not sell or share your personal information as those terms are defined.

We use reasonable administrative, technical, and physical safeguards to protect the information we collect. These include encryption of data in transit (TLS), hashed and salted password storage, scoped access controls for staff, and ongoing monitoring. No system is perfectly secure; we cannot guarantee the security of your information.

If we become aware of a security incident that affects your personal information, we will notify you and any regulator as required by law.

We are based in the United States, and the providers that process information on our behalf may operate in the United States and elsewhere. If you are located outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country. By using the Service you consent to this transfer.

The Service is strictly limited to users 18 and over. We do not knowingly collect information from anyone under 18. If we become aware that we have collected information from a person under 18, we will delete it and terminate the associated account. If you believe a minor has provided us information, please contact us at privacy@dreamcrawler.ai.

We may update this Policy from time to time. The updated Policy will be posted at this URL with a new effective date. Material changes will be communicated by reasonable means, which may include in-product notice or email. Your continued use of the Service after the effective date constitutes acceptance.

For privacy questions, requests, or complaints, contact us at privacy@dreamcrawler.ai. You can also reach Dreamcrawler at Dream Crawler LLC, Wyoming, USA.