Controller and scope
The controller for the website operation and enquiries is Matthias Böhm, Moorstraße 1a, 15526 Bad Saarow, Germany. Contact: support@dreaminterpretations.org. This notice covers dreaminterpretations.org and its browser tools at tools.dreaminterpretations.org.
This website provides a public library, search and free browser tools. It has no visitor accounts, checkout, paid reading service, advertising analytics or submission of dream text to a model provider. Any future change to those features requires a new privacy assessment and an updated notice before use.
Website delivery and security
IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, supplies the Virtual Server Cloud XL infrastructure. Matthias Böhm administers the webserver in Berlin, Germany.
Website requests transmit connection and request data, including an IP address, requested address, time and browser-related headers. Fonts and search files are served with the website. Necessary delivery and security processing uses Article 6(1)(f) GDPR: the legitimate interest in providing a secure, usable educational website. This basis does not permit unrelated profiling or indefinite request logging.
Server access logs can contain your IP address, the time, HTTP method and requested path, response status and size, browser identification and any referrer your browser supplies. These records support limited troubleshooting and security work; they are not used to build advertising profiles.
For the library and tools sites, domain logs are configured for daily rotation, with up to seven compressed rotated files per log in addition to the current active file. The oldest rotated file is removed when that limit is exceeded. This is a file-count rule, not a guaranteed seven-day deletion period: quiet logs or interrupted maintenance can leave older files. Any incident record retained separately must have a specific reason and its own review and deletion date.
Search and navigation privacy
Search matching runs in the browser, but searching can still produce network requests. Typing may load search-index files whose addresses reveal a query prefix or topic. Search-result fragments and article visits can reveal related topics to the website host.
Search words can appear in the page address and browser history. Opening, submitting, reloading or sharing a search address can send its query to the server or to the person receiving the link. Use a general description without names, contact details or private medical history.
Return navigation can temporarily keep the full search address, filters and section anchor in session storage and browser history state. The temporary handover entry is removed when the article restores the return context, but a history entry can remain. Browser session restoration may retain such information.
The pages request a no-referrer policy to reduce disclosure through referrer headers. This does not hide the address of the request itself, remove browser history or establish how server logs are configured.
Guided reflection
Reflection text is handled in page memory to generate optional prompts in the browser. The exercise does not submit that text to a private API, model provider or analytics service, and it does not automatically save it to the journal.
Resetting, leaving or reloading can discard the exercise. Browser session recovery, extensions, screenshots and device features are outside the exercise’s control. The exercise provides no clinical assessment.
Encrypted browser journal
Creating a journal requires a passphrase and an affirmative storage choice. Saved entries are encrypted with a key derived from that passphrase and stored in this browser. The journal does not send the entries or passphrase to the website server, and the passphrase is not saved by the journal.
Entries are readable on screen while unlocked. Lock the journal before leaving a shared device. Storage encryption cannot protect an unlocked screen, a compromised device or a readable export.
Journal records have no automatic expiry. Delete entries or the journal through its controls, or clear the tools site’s browser data. There is no automatic synchronisation or server recovery. The library and tools use separate site storage.
- A lost passphrase may make saved entries and encrypted backups unreadable.
- Clearing browser data, changing profiles or losing the device can remove the local journal.
- An encrypted backup remains a separate file and needs the passphrase.
- A readable export contains private text. Deletion in the journal does not delete downloads, device backups or copies you shared.
Saved guides, preferences and device storage
The saved-guide list stores titles, links and reading positions without encryption in local storage on the library site. Chosen text-size and quiet-reading preferences are also stored there. Someone using the same browser profile may see these choices.
These records have no automatic expiry. Remove individual saved guides using their controls; clear the library site’s browser data to remove the stored list and reading preferences. This does not erase separate browsing history or the tools site’s journal.
Browser storage supports the features you choose: saving a guide, keeping your reading preferences, returning to your search and using the local journal. Existing settings may be read when a page opens to restore an earlier choice. The storage is limited to providing those features, not advertising or visitor profiling. New uses would need a separate assessment and any required permission before they begin.
Email and enquiry records
If you email the operator, the sender details, message, necessary attachments and reply history are handled through IONOS Mail Basic. Matthias Böhm uses the mailbox to record enquiries and their progress. This managed email service is separate from his self-administered webserver.
Ordinary support, correction and accessibility enquiries are handled under Article 6(1)(f) GDPR: the legitimate interest in answering a message you send and maintaining accurate, usable content. The information used must be necessary for that purpose. Statutory privacy-request handling uses Article 6(1)(c); necessary steps for a specific contract-related request may use Article 6(1)(b). Sending an email is not consent to unrelated marketing.
Giving optional message details is your choice; without enough contact/context information a request may be harder to answer. Do not send passwords, journal passphrases, identity documents by default, or unnecessary dream and medical histories. Ordinary email is not protected by the journal’s encryption. Any necessary processing of health or other special-category information requires its own applicable condition; a general support purpose is not enough.
Service providers and international access
IONOS supplies hosting infrastructure and managed email under a processing agreement. Its published subprocessor list identifies 1&1 Mail & Media GmbH and Open-Xchange GmbH, both in Germany, for Mail Basic delivery and webmail. It also lists Arsys Internet S.L.U. in Spain for specified server-platform and support services, and Plesk International GmbH in Switzerland for server-administration software.
The webserver and mailbox storage locations are Germany. This does not guarantee that every support operation or network route stays there. The IONOS agreement provides for EU/EEA processing, with other transfers where required for the service and subject to GDPR safeguards. The listed Plesk arrangement relies on the European Commission’s adequacy decision for Switzerland. This describes the documented provider arrangement, not evidence that a particular visitor’s information was accessed abroad.
The linked provider documents describe the services, recipients and safeguards. You can also ask support@dreaminterpretations.org for the relevant information or a copy of applicable safeguards. A change of provider, enabled service or transfer arrangement must be assessed before it is introduced.
Retention and deletion
Our policy is to delete ordinary support, correction and accessibility correspondence no later than six calendar months after the request is closed, and sooner when it is no longer needed. Closure means the answer and necessary follow-up are complete. This is a manual task for Matthias Böhm during weekly mailbox housekeeping; it does not run on an automatic timer. Unnecessary sensitive details and attachments are removed promptly rather than kept until that maximum.
A minimal privacy-request decision record is kept for no more than twelve calendar months after completion to document the handling of a recent request. Full correspondence follows the ordinary six-month limit. A specific legal obligation or dispute can require a limited exception with a recorded reason and review date; it does not extend every mailbox item. Browser retention is described above. Web-log retention follows the rotation rule explained under Website delivery and security.
The IONOS product description states maximum periods of seven days for email-service data after customer deletion or contract end and 28 days for email-service logs after creation. These are provider limits after the relevant event, not automatic expiry of an enquiry in the mailbox. They do not set the webserver’s log rotation. The optional IONOS email archive is not enabled for this mailbox.
Project recovery archives contain public website files and server configuration, not visitor request logs, mailbox messages or journal entries. They are stored outside the public website directories. There are no scheduled project backups of visitor records. A new backup method must have a defined scope, expiry and procedure to prevent deleted records from being put back into use. The email-provider periods above remain separate. Copies you download or share, including browser or device backups, remain under your control; the operator cannot remotely erase them.
Your privacy rights
Depending on the applicable conditions, GDPR rights include access, correction, erasure, restriction, portability and objection. Where consent is the basis, you can withdraw it for the future without affecting the lawfulness of earlier processing. A legitimate-interest processing activity can be challenged on grounds relating to your situation.
Send a request to support@dreaminterpretations.org; no special form is required. Describe the relevant feature and request without sending your journal passphrase. Identity checks, where reasonably needed, should be proportionate. The operator cannot retrieve a server copy of a browser-only journal that was never sent to him.
GDPR requests must normally be answered without undue delay and within one calendar month of receipt. A permitted extension for complexity or number of requests requires notice and reasons within that first month. The ordinary email-response target does not replace a complete response to a rights request or change the statutory time limit.
You may complain to a competent supervisory authority, including the authority where you live, work or consider that an infringement occurred. The authority for the operator’s establishment is the Brandenburg data protection authority (LDA Brandenburg), Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany.
Audience and changes
The library is written for English-speaking readers; the interactive reflection and journal tools are intended for adults aged 18 and over. They are not designed to collect children’s personal information or make decisions with legal or similarly significant effects.
Additional rights may apply depending on your location and the actual service activity. English-language availability is not a certification of compliance with every country’s laws. New accounts, advertising, payments, providers or server processing require a new assessment and notice before use.