1. The short version

2. Who is responsible

Dream Tray is a product of 14447701 Canada Inc. ("we"). For any question about your privacy, or to exercise any of the rights in §8, write to [email protected].

3. What stays on your device

• Your tray. The images, words, colours and arrangement you put together stay in your browser while you work. They are not sent to us, not stored on our servers, and not visible to us at any point.
• Images you add yourself. A photo you upload is held in your browser for that session only. It is never uploaded to us. Close the tab and it's gone.
• Save and Keep. These download a file to your own device. Nothing about that file passes through us.
• Small preferences. Your light/dark choice and the language you last read these documents in are kept in your browser's local storage. They stay on your device, say nothing about who you are, and disappear when you clear your browser data.

We don't use cookies.

4. What leaves your device

Only these two, and only at your initiative:

Image search. When you search for a photo, the words you type are sent to Pexels so it can return results. Your tray is never sent — only the search words. What Pexels does with a search request is covered by their privacy policy.

Feedback. If you use the feedback form, we receive and store the message you write, the email address you optionally provide, and the time you sent it. Nothing else. Please don't put anything in that box you wouldn't want us to read.

5. What other companies see because the page loads

We should be straightforward about this: any website you visit reveals ordinary technical information to the machines that serve it — your IP address, your browser and device type, and the time of the request.

For Dream Tray that means Cloudflare (our web host, which serves every page and also holds any feedback you send), Cloudinary (which serves the built-in images) and Pexels (which serves search results).

Cloudflare is a United States company. The machines serving this site, and the database holding feedback, are located outside Canada.

Like any web host, Cloudflare counts the requests it serves. That gives us totals — how many people opened Dream Tray on a given day, roughly which countries they were in, which pages they landed on. We would rather say so plainly than let “we collect nothing” imply otherwise. These are counts, not profiles: there is no script on the page watching you, nothing that follows you between visits or between sites, and no way for us to connect any of it to a person or to anything you made.

This is a normal part of how the web works, we don't control it, and we don't collect it, combine it, or use it to build any picture of you.

6. What we never do

• We never sell, rent or trade your information.
• We never show advertising, and we never let anyone else track you here.
• We never use anything you make to train an AI model.
• We never build a profile of you, because we hold nothing to build one from.

A note about AI, since some of the images were made with it. Some symbols in the library were generated with an AI tool before they were ever put into Dream Tray. That happened on our side and in advance: no AI service is contacted while you use the app, none of them sees your tray, and nothing you make is sent to one. Which images those are is named on the Thank-You page.

7. How long we keep things

The only thing we hold is feedback. We keep it while we're acting on it and for as long as it's useful for improving Dream Tray, then delete it. If you'd like your message removed sooner, ask and we'll remove it.

Your IP address is used to limit how often the feedback form and image search can be called, so neither can be flooded. It is never stored as an address: it is scrambled into a hash with a secret value, which cannot be turned back into the address it came from, and the hash is kept with nothing but a list of request times.

Those hashes are deleted on two different clocks, because the two limits need different amounts of history. A hash from the feedback form is deleted within the hour. A hash from image search is deleted within the day, because the search limit is a daily one and enforcing it requires remembering that long. Nothing else is ever attached to either, and neither is stored alongside your message.

8. Your rights

Because we hold so little, most of these will have short answers — but they are yours, and you can use them at any time by writing to [email protected]:

• Access — ask what we hold about you.
• Correction — ask us to fix anything inaccurate.
• Deletion — ask us to delete it.
• Withdraw consent — tell us to stop, at any time.

Depending on where you live, these rights come from Quebec's Act respecting the protection of personal information in the private sector (Law 25) or Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

If you aren't satisfied with how we respond, you can complain to the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.

9. Children

Dream Tray is for people 16 and older, the same as the Terms of Use. We don't knowingly collect anything from anyone younger. If you believe a child has sent us something through the feedback form, write to us and we'll delete it.

10. How we protect what little we hold

Feedback is stored in a database that no web address reaches. It is not a file sitting in a folder that a rule has to keep hidden — there is no URL that returns it, and nothing that serves it. Only the site's owner can read it, using credentials held outside the site. The site is served over HTTPS everywhere.

What we publish is decided by a list of permitted files rather than a list of forbidden ones: anything not explicitly named is never uploaded at all. That is a deliberate choice — a forbidden-list protects only the things somebody remembered to add to it.

The honest security story here is that the best protection is holding almost nothing: there is no database of dreams to breach, because your tray never leaves your device. No system is perfect, and we won't claim otherwise.

11. Changes to this policy

We may update this policy. The date at the top always shows the current version. If a change is significant — especially once accounts arrive — we'll say so in the app rather than change it quietly.

12. Contact

Questions, requests, or concerns: [email protected]

This policy is governed by the laws of Ontario, Canada. It exists in English and in French. In case of any discrepancy between the two versions, the English version prevails.