Short answer: Before putting a private dream into an app, check where the first copy lives, which feature can send it off your device, who receives it, who can open or recover it, and whether you can export and erase each copy. “Private,” “local,” “encrypted,” and “not sold” answer different questions; none is a complete data map.
If you cannot tell whether a dream goes to a vendor cloud, speech service, AI provider, analytics tool, crash reporter, or advertiser, use a harmless fictional entry first—or use paper or a local journal until the route is clear. You do not need to become a security engineer. You need five concrete answers and permission to mark an answer unknown.
First, choose the storage model you actually want
On a narrow screen, scroll sideways to compare every column.
| Model | What it may offer | Main tradeoff | Question before writing |
|---|---|---|---|
| Device-only | No account; may work offline. | Loss after device, app, or browser data removal; shared-device access. | Is the journal separately protected, and can I export it? |
| Device + personal cloud | Backup or sync through iCloud or another account. | A second service has its own access, recovery, and deletion rules. | Is sync optional, and how do I remove the cloud copy? |
| Vendor account + cloud | Cross-device access, web login, search, managed backup. | The vendor stores entries and identifiers; retention matters. | What is stored, for how long, and how do I export and close the account? |
| AI or voice assisted | Transcription, interpretation, tags, images, or summaries. | Content may be processed on-device, by the vendor, or by another company. | Which feature sends which fields to which provider? |
An app may occupy several rows. “Local by default” can become cloud-based after sign-in. A device-only journal can create a cloud copy after backup is enabled. An AI feature may send one selected dream even when the rest stays local. Privacy is not a badge; it is a state produced by the features you turn on.
The DREAM Data Route Map
This is an original Meaning Catalog editorial tool—not a security certification, legal assessment, or validated privacy score.
D — Device: where does the first copy live?
Identify whether the entry sits in the app, the phone's file system, browser local storage, or a database tied to a login. Then ask who else can reach that location. “Only on this device” describes a location; it does not automatically mean encryption, a separate app lock, or exclusive access.
Record whether the journal works without an account or internet connection, what clearing the app or browser does, and whether an app lock exists in addition to the device lock.
R — Routes out: which action makes the dream leave?
Look beyond Save. Optional sync, backup, voice transcription, AI interpretation, image generation, sharing, analytics, crash reporting, and advertising can create separate routes. For each feature, ask whether it is off by default and whether a notice appears before transfer.
Working route: dream entry → device storage → optional cloud → optional voice or AI processor → analytics, diagnostics, or advertising → export or deletion. Cross out only what current documentation clearly excludes; mark the rest unknown.
E — External receivers: who processes content or metadata?
“Service providers,” “AI services,” and “trusted partners” do not explain whether a company receives a full dream, selected fields, audio, an identifier, or only a technical event. Look for a named receiver and a purpose: storage, authentication, speech-to-text, AI generation, diagnostics, advertising, or payments.
“Not sold” does not mean no vendor processing. “Not used for AI training” does not mean no transmission; selected text may still be sent to produce the requested response.
A — Access and account: who can open or recover it?
Check the device passcode, separate PIN or biometrics, multi-factor authentication, account recovery, other signed-in devices, and any web session. A biometric gate may reduce casual access. It does not explain server encryption, who holds keys, or what an AI provider receives.
M — Move or erase: can you leave with your data?
Export and deletion are different exits. Check whether exports include complete text, dates, tags, audio, attachments, and generated analysis in a usable format. Then separate deleting one entry, clearing the current device, removing a cloud copy, closing the vendor account, and addressing recovery windows or external processors.
Uninstalling an app proves that the app left one device. It does not, by itself, prove that a vendor account or synced copy was erased.
App Store and Google Play labels are starting points
Apple requires developers to provide App Store privacy information and keep it current. Its definitions distinguish on-device processing from collection and data retained by an app from some data sent only long enough to service a request. Read Apple's App Privacy Details guidance.
Google Play says developers are responsible for accurate Data safety declarations, including data handled by third-party code. Google's user guidance also describes on-device access, ephemeral processing, and some user-initiated transfers separately. Read the developer guidance and the user guidance.
Do not expand “Data not collected” into a claim that an app stores nothing on your device. Do not treat a store label as a source-code audit. Use it to identify categories, then read the current policy for feature-specific routes, retention, export, and deletion.
Four public policies show why one privacy score fails
The examples below report developer statements reviewed September 8, 2026. Meaning Catalog did not install these apps, inspect code, capture network traffic, certify security, rank products, or endorse them. Policies and features can change.
Local by default can change after sign-in or AI use
Dream Catcher's policy says dreams remain on the device unless the user signs in for sync. It separately describes sending one selected dream to Google's Gemini service for optional interpretation, names analytics, crash-reporting, and advertising services, and explains export and account deletion. Read the current developer policy.
The useful lesson is structural: basic recording, sync, AI interpretation, diagnostics, and advertising can take different routes. “Where is my dream?” depends on the feature used.
Account storage needs a deletion timeline
Dreams Journal's policy says dream content, waking context, and generated analyses are stored as account-scoped records. It describes relevant details going to a configured AI provider when interpretation is requested and a soft-deletion recovery window before permanent removal of associated non-billing dream data. Read the current developer policy.
That raises separate questions: which provider receives the entry, how long recovery lasts, whether deleting a dream removes its generated analysis, and what happens to a copy processed outside the main account. Where the page does not answer, unknown is the accurate label.
No vendor server can still include personal cloud sync
DreamJournal's public site says recording, transcription, and analysis run on the iPhone, with no vendor account or DreamJournal server receiving the journal. It also offers optional iCloud sync and plain-text export. Read the developer's current description. Enabling iCloud creates a copy governed by that service and its settings; exporting creates a new file whose privacy depends on where it is saved.
Local and cloud deletion can have separate rules
Somni's public site says entries are local by default, optional iCloud sync is available, and no account is required. Its deletion answer distinguishes uninstalling local data from managing iCloud data through sync settings. Read the current developer page and policy links.
AI and voice features deserve their own row
Speech transcription may run on the device, through an operating-system service, or on a vendor server. AI interpretation may run on-device, through the developer, or through a third-party model. One company may retain the answer even if another says it does not retain the prompt.
Search a policy for dream, journal, voice, audio, transcription, AI, model, training, prompt, provider, analytics, crash, advertising, identifier, sync, backup, retention, delete, and export. If a receiver is unnamed, keep it unnamed. Consumer-chat and paid API terms can differ; do not substitute one for the other.
The Fictional Entry Exit Test
Before recording an intimate dream, test the visible controls with a harmless fictional note. This checks usability—not hidden network behavior or backend deletion.
Fictional test: a blue paper boat crossed an empty kitchen. No real person or event is described.
- Save without an account if possible. Note what works offline and what changes after sign-in.
- Inspect optional routes. Open sync, voice, AI, sharing, and backup settings without submitting private material. Read the notice before activation.
- Export. Confirm whether the complete note, date, tags, and generated material appear. Protect or remove the test export afterward.
- Delete. Determine whether entry, cloud, and account deletion are separate controls.
- Record unknowns. Visible deletion does not prove backup erasure; an offline screen does not prove every feature is offline.
What “private” should never be allowed to imply
- Local does not automatically mean encrypted.
- Encrypted in transit does not describe server storage or who can decrypt it.
- Biometric lock does not prove end-to-end encryption.
- No selling does not mean no service providers or processing.
- No AI training does not mean no AI transmission.
- Delete in app does not necessarily mean delete account, backups, or external copies.
- Export available does not mean the file is complete, open, or safely stored.
A 2026 preprint compared code, network behavior, and policies for 25 Android mental-health and life-coaching apps and reported disclosure gaps. It did not study dream journals, and Meaning Catalog did not repeat its tests. It is a caution against treating policy text as proof of behavior—not evidence that a particular dream app is unsafe. Read the preprint and its limitations.
How Meaning Catalog's own journal maps
The current private browser journal stores entries in that browser's local storage. It requires no account and sends no entry to Meaning Catalog, cloud sync, or an interpretation API. It exports a versioned JSON backup and restores compatible entries without replacing existing ones.
Its limitations remain visible: another person using the same browser profile may open the journal; browser or private-mode rules may block or remove entries; clearing browser data can erase them; the journal does not claim a separate encryption layer; an exported file becomes a new copy to protect; and there is no automatic cross-device sync or remote recovery. Read the site's privacy explanation before use.
Questions to answer before choosing a dream journal
Is a local journal always safer?
Not in every respect. Avoiding a vendor server removes some transfer and account risks, but device loss, shared access, local backups, malware, and unprotected exports still matter.
Does optional cloud sync break a local-first claim?
Not necessarily, if basic journaling stays local and sync is knowingly enabled as a separate route. The important questions are which service receives data and how the synced copy is removed.
Should I upload an entire journal for AI pattern analysis?
Only after deciding the benefit justifies disclosing that much personal history and identifying the receivers, retention, training statement, export, and deletion process. Start with a redacted or fictional entry while evaluating the workflow.
Does deleting the app delete my dreams?
It may remove local app data. It does not automatically prove deletion of an account, synced copy, backup, exported file, or data sent to another processor.
What if the policy is vague?
Mark the route unknown and avoid entering sensitive details until it is clarified. A short policy is not automatically bad, and a long policy is not automatically complete.
Choose the route, not the slogan
The most private app is not the one with the strongest adjective. It is the one whose routes match the risk you are willing to take—and whose unknowns you can accept. Map the device copy, routes out, external receivers, access path, and move-or-erase controls. If you still cannot explain where a real dream could go, do not give the app a more intimate record merely because its interface feels calm.
How this guide was made
Meaning Catalog reviewed public developer policies, Apple and Google platform guidance, English comparison pages, and one adjacent preprint. Vendor claims remain labeled as claims. The DREAM Data Route Map and Fictional Entry Exit Test are editorial constructions, not validated privacy frameworks, security tests, or legal advice.
- Apple: App Privacy Details.
- Google Play developer Data safety guidance and user guidance.
- Dream Catcher privacy policy; Dreams Journal privacy policy; DreamJournal public description; Somni public description and policy links.
- Georgiou C, Lu H, De Cristofaro E, Tsudik G. What's on Your Mind? Exploring Privacy of Mental Health Apps. Preprint, 2026. Used only as adjacent evidence.
- Hoefer M, Schumacher B, Voida S. Personal Dream Informatics. CHI 2022. DOI: 10.1145/3491102.3517669.
For the separate question of whether an AI answer deserves trust, use the Context-Before-Verdict test. Read our evidence method or request a correction.