Privacy note

In Reverie Lab is a journalling app, independently operated. The data controller for anything you share here can be reached at hello@inreverielab.com.

When you create an account, we store:

• 01Your email address, and your password in hashed form (we never see the password itself).
• 02Your name, if you give one, and your timezone, so each day starts at the right time for you.
• 03Your settings: paper, handwriting or type, which journals are on your shelf, and whether you want a reminder.
• 04When your free week started and ends, and whether you have a subscription.

Everything you write in your journals is stored against your account: entries, answers to prompts and guided pages, tasks, notes, highlights, and any photos you add. It is there so you can read it back, search it and export it.

Joining the waitlist stores:

• 01Your email address.
• 02Where you arrived from, if your browser passed that along (the referring URL and any UTM tags on the page you came from).
• 03A one-way SHA-256 hash of your IP address, so we can detect signup abuse without ever storing the raw IP.
• 04Your browser’s user-agent string, for the same reason.
• 05The fact that you ticked the consent box, and when.

1. 01To run your account: to sign you in, keep your journals, and show them back to you.
2. 02To take payment if you subscribe, and to send the emails the account needs (sign-in codes, password resets, receipts).
3. 03If you agreed to hear from us, to send occasional updates. We’ll send these sparingly.
4. 04To understand which channels (a friend, a podcast, a search result) bring people in.

For your account and what you write, the lawful basis is the contract between us (UK GDPR Art. 6(1)(b)). For updates and marketing cookies, it is your consent (UK GDPR Art. 6(1)(a) and equivalent provisions in other jurisdictions).

• 01Sell, rent, or share your email or your writing with anyone.
• 02Send you marketing emails you didn’t agree to receive.

Your account and your journals are stored in a Supabase Postgres database hosted on AWS, and photos in Supabase storage. Emails are sent through Resend. Payments are handled by LemonSqueezy, who act as the merchant and hold your card details; we never see them. The site is hosted on Vercel. Each provider is contractually bound to keep your data secure and to use it only to deliver the service we have contracted them for.

Your account and everything in it stay on file for as long as you have the account, including after the free week ends, so you can still read and export what you wrote. You can delete the account yourself from Settings. Everything in it, every entry and every photo, is deleted seven days after you ask, and until then you can sign in and keep it. Waitlist entries are kept until they are moved into the account system or you ask to be removed.

You can ask us, at any time, to:

• 01Show you what we hold about you.
• 02Correct anything that is wrong.
• 03Delete your account and everything in it, or remove you from the waitlist.
• 04Stop processing your data while we sort the rest out.
• 05Send your data to you in a portable format (JSON or CSV). You can also print or save every entry as a PDF from Settings.
• 06Withdraw your consent.

You can delete your account yourself, from Settings. For anything else, email hello@inreverielab.com with the subject line data request and we will act on it inside one calendar week.

If you turn on a reminder in Settings, your browser gives us a push address for this device, which we store so we can send one reminder a day. Turning the reminder off removes it.

We use Vercel Analytics and Speed Insights to count page views and measure performance. Both are cookie-free and aggregate. No individual visitor can be identified by us from analytics data alone.

Two kinds of cookies run on this site.

• 01Functional cookies keep you signed in and remember small preferences. They are strictly necessary and run for everyone.
• 02Marketing cookies let us measure which channels brought people in and run the small set of advertising tools described below. We only load these if you agree on the banner when you arrive.

You can change your answer at any time: Update your cookie preferences.

If you agree to marketing cookies, we may load Meta’s Pixel on the site so we can understand which adverts (if we run any) actually brought people in, and so we can show you the occasional update on platforms you use.

We may also, from time to time, share a list of email addresses with advertising platforms in a hashed form, so we can show updates to people who have already chosen to hear from us. We do this under the consent you gave when you agreed to receive updates; the platforms only ever see a hashed value, never the plain email.

We will update the date at the top, and if the change is meaningful we will email everyone with an account or on the waitlist. We won’t change the substance of what we do with your data without telling you.