Privacy Policy — DreamFamily
1. Introduction
DreamFamily ("we," "us," "our," or "Company") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services, including DreamFond, DreamFund, DreamFind, and accounts.dreamfamily.cloud.
Please read this policy carefully. If you do not agree with our practices, do not use DreamFamily.
2. Scope and Jurisdiction
This Privacy Policy applies to all DreamFamily products and services. We comply with:
- California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA) for California residents.
- Ley Federal de Protección de Datos Personales en Posesión de Particulares (LFPDPPP) for Mexico residents.
This policy does not address GDPR compliance; DreamFamily does not intentionally collect data from or target European Union residents.
3. Information We Collect
A. Information You Provide Directly
Shared Identity (All Products)
- Email address
- Full name and display name
- Profile image/avatar
- User role or account type
- Linked SSO accounts
- Session tokens
DreamFond
- Menus and menu items you create
- Cooking and shopping-list progress
- Favorite recipes
- Recipe ratings and reviews
- Gusto AI chat history and conversational content
- AI-learned facts about your preferences, tastes, and dietary needs
- Nutrition, dietary restrictions, and allergen profile (encrypted at rest)
- Push notification subscriptions and alarm schedules
- Gathering and potluck participation details
- Deletion-request records
DreamFund
- Bank account connections and linked financial institutions
- Transaction history and account balances (via Plaid/Belvo)
- Encrypted banking secrets and API tokens
- Waitlist email addresses (separately encrypted)
DreamFind
- No personal data collected.
B. Information Collected Automatically
Analytics and Site Usage
- Pages visited and time spent on each
- Device type, browser, and operating system
- IP address and approximate geographic location
- Referral source and links clicked
- Interaction events (button clicks, form submissions)
This data is collected via Google Analytics (GA4) as described in Section 5 below.
Session and Technical Data
- Cookies and similar tracking technologies
- Session identifiers and login timestamps
- API calls and service requests
4. How We Use Your Information
We use the information we collect to:
- Provide, maintain, and improve DreamFamily services.
- Personalize your experience and deliver tailored content.
- Process payments and manage subscriptions (via Stripe).
- Send transactional emails (e.g., password resets, order confirmations).
- Send push notifications for DreamFond features (cook-along alarms, potluck invitations).
- Respond to your inquiries and customer support requests.
- Detect, investigate, and prevent fraudulent or unauthorized activity.
- Comply with legal obligations and enforce these terms.
- Conduct analytics and improve our services (via Google Analytics).
AI and Machine Learning
[TODO: consider dedicated AI-data consent step] — Currently, consent to use your data with Gusto is blanket, included in your acceptance of the ToS and Privacy Policy at sign-up. MedievoLabs may consider a separate, explicit opt-in for AI-powered features in a future release.
5. Data Sharing and Third-Party Processors
We do not sell your personal data. We share data with third-party service providers only as necessary to deliver the services you have requested.
Third-Party Data Processors
1. Anthropic (Claude API)
- Purpose: Powers Gusto, DreamFond's AI cooking assistant.
- Data Shared: Cooking-related conversation history and dietary/preference data.
- Processing: Subject to Anthropic's Privacy Policy. See https://www.anthropic.com/privacy.
2. Stripe
- Purpose: Payment processing and subscription billing.
- Data Shared: Stripe customer ID, subscription status, and billing information (not raw card numbers).
- Processing: Subject to Stripe's Services Agreement and Privacy Policy. See https://stripe.com/privacy.
3. Plaid (US) and Belvo (Latin America)
- Purpose: Bank-account connectivity for DreamFund's budgeting features.
- Data Shared: Bank account login credentials (encrypted), transaction history, and account balances.
- Processing: Subject to Plaid's and Belvo's respective privacy policies. See https://plaid.com/legal and https://belvo.io/privacy-policy.
4. Resend
- Purpose: Transactional email delivery (password resets, receipts, account notifications).
- Data Shared: Email address, account information, and email content.
- Processing: Subject to Resend's Privacy Policy.
5. Cloudflare R2
- Purpose: Object storage for user-uploaded profile photos and media.
- Data Shared: Profile images and associated metadata.
- Processing: Subject to Cloudflare's Privacy Policy. See https://www.cloudflare.com/privacypolicy.
6. Google Analytics (GA4)
- Purpose: Website analytics and user-behavior insights.
- Data Shared: Anonymized and aggregated usage data, page views, device information, referral sources.
- Processing: Subject to Google's Privacy Policy. See https://policies.google.com/privacy.
7. Browser Push Notification Services
- Purpose: Delivery of cook-along alarms and other real-time notifications for DreamFond.
- Data Shared: Your device's push subscription endpoint and notification content (e.g. step reminders).
- Processing: DreamFond uses the standard Web Push protocol, which routes notifications through your browser's own push service (for example Google's push service for Chrome, or Mozilla's for Firefox) — the same infrastructure any website's browser notifications use, not a separate DreamFamily-selected vendor.
Cookies and Analytics
We use Google Analytics (GA4) to collect usage data via cookies and the gtag.js script. GA4 enables us to understand how you interact with DreamFamily and to improve our services.
Managing Cookies: You can manage or disable cookies through your browser settings. However, disabling cookies may limit your ability to use certain features of DreamFamily. For more information about GA4 cookies, see Google's documentation at https://support.google.com/analytics.
We do not use Meta Pixel, Segment, Mixpanel, PostHog, or other third-party ad-tracking or analytics pixels.
6. Data Retention and Deletion
General Retention
DreamFond
DreamFund
Deletion Timeline
Retention for Legal Compliance
7. Your Rights and Choices
Depending on your location, you may have the following rights:
California (CCPA/CPRA) Residents
Mexico (LFPDPPP) Residents
Exercising Your Rights
[TODO: provision mailbox — does not exist yet, route via Resend once set up]
8. Data Security
We implement industry-standard encryption, access controls, and other technical safeguards to protect your data. Sensitive data such as banking credentials, encryption keys, and dietary profiles are encrypted at rest and in transit.
No system is perfectly secure. We cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.
9. Cross-Border Data Transfers
DreamFamily is currently operated as an unincorporated project based in the United States. Your data is processed primarily in the United States. If you are a Mexico resident, your data may be transferred to and processed in the United States and other jurisdictions.
We implement appropriate contractual and technical safeguards for data transferred from Mexico, including standard contractual clauses and encryption, to ensure your data receives equivalent protection.
We do not have formal Standard Contractual Clauses (SCCs) or EU adequacy determinations in place; this policy reflects our current approach and will be updated as our legal framework evolves.
10. Children's Privacy
DreamFamily services are not directed to children under the age of 13. We do not knowingly collect personal information from children. If we become aware that a child under 13 has provided us with personal information, we will delete such information promptly.
11. Third-Party Links
DreamFamily may contain links to third-party websites and services. We are not responsible for the privacy practices of third parties. Please review their privacy policies before providing personal information.
12. Privacy Policy Changes
We may update this Privacy Policy at any time. Changes will be effective upon posting. Your continued use of DreamFamily after changes are posted constitutes your acceptance of the revised policy.
13. Contact
For questions, requests, or concerns about this Privacy Policy or our privacy practices, contact us at:
`privacy@dreamfamily.cloud`
[TODO: provision mailbox — does not exist yet, route via Resend once set up]