Privacy Policy

Version 1.0 · Effective 16 August 2026

This Privacy Policy explains how that dream handles personal information across that dream-operated websites and services, including the authenticated app, public Profiles and Routes, and the public landing site.

It describes the service as it operates today. When our data practices materially change, we will update this Policy as appropriate.

1. Who we are

that dream is an independently operated online service based in Hong Kong.

For purposes of applicable data protection law, the person responsible for the processing of personal information through that dream is:

Controller / operator: Aiden Fan, operating that dream Privacy contact: inquiriesthatdream@gmail.com Website: thatdream.space Location: Hong Kong

You can contact us using the email address above for privacy questions or requests involving your personal information.

2. Who can use that dream

that dream is intended for a general audience aged 13 and older. It is not directed to children under 13.

The service does not currently ask users to provide their date of birth or use a general age-verification system.

If we learn that a user is under 13, we may take steps to suspend or remove the account and associated personal information as appropriate. A parent or guardian who believes that a child under 13 has provided personal information through that dream may contact us at inquiriesthatdream@gmail.com.

Users between 13 and 17 may use the service subject to applicable law and our Terms. Where a particular optional feature legally requires parental authorization or another age-related safeguard, we may restrict that feature or request the required authorization.

3. Information we handle

The information we handle depends on which parts of that dream you use.

Account and sign-in information

When you sign in, Firebase Authentication creates an account identifier and may receive basic identity information from the authentication provider you choose.

This may include:

• a Firebase user identifier;
• provider identifier;
• name or display name;
• email address; and
• provider profile image.

The current service supports Google, Apple and email/password sign-in. When you use email/password sign-in, Firebase Authentication processes the email address and password credential needed to create and authenticate the account; that dream does not receive or store your password in the application database.

that dream requests basic authentication information and does not currently request additional Google API access such as Google Drive, Contacts, YouTube, or similar account data.

Your account email address is treated as private account information and is not intended to appear on your public Profile.

Profile information

You may provide public Profile information such as:

• display name;
• username;
• short biography;
• profile image;
• banner image;
• Instagram information; and
• TikTok information.

Profiles are public by design. Information you choose to place in your Profile can be viewed by other people.

You should not place information in your Profile that you do not want to make public.

Routes, Rooms, Nexus and uploaded content

You may create and upload content including:

• Routes;
• Rooms;
• your Nexus;
• images;
• titles;
• writing and descriptions;
• connections between Rooms;
• Signals;
• atmosphere and motif information;
• color and other creative metadata; and
• related creation data.

Routes may use the visibility states made available by the service, including Private, Unlisted, and Discoverable where supported.

Rooms follow the visibility and release state of the Route to which they belong rather than independently selecting their own visibility.

Your Nexus is designed to be publicly accessible.

Uploaded images are processed for service delivery and stored in optimized formats, including normalized WebP versions and thumbnails where supported.

Private spaces, saved content and preferences

that dream may store private information associated with features such as:

• Field Notes;
• saved Rooms;
• Backpack content and ordering;
• Dream Retriever preferences;
• recommendation and taste signals;
• returning Route or Room state;
• interface preferences; and
• other account-specific application state.

These features are intended to remain private unless the service explicitly tells you otherwise.

Technical and security information

When you use that dream, we and the providers that operate the service may process technical information necessary to deliver, secure and troubleshoot it.

This may include:

• IP address;
• browser and device characteristics;
• network information;
• authentication events;
• request timing;
• error and diagnostic information;
• security and abuse-prevention signals; and
• application-integrity information.

For error and reliability monitoring, that dream uses Sentry. Sentry may receive browser and device characteristics, the URL path and app surface, error stack traces, and sampled timing or performance trace data. Where authentication is known, that dream may send only a stable Firebase user ID for troubleshooting. This integration does not send email addresses, display names, usernames, biographies, social links, Field Note text, private Route or Room records, uploaded image contents, authentication tokens or passwords. Session Replay, generic log forwarding, advertising analytics and custom application metrics are not enabled.

that dream does not currently ask for precise GPS location and does not use precise location as a Profile field.

4. Information we do not currently collect or use

The current service does not intentionally provide functionality to collect:

• precise GPS location;
• address-book or contact-list data;
• telephone numbers as a normal account field;
• direct-message contents, because that dream does not currently provide direct messaging;
• date of birth as a normal registration field; or
• payment-card information.

We also do not currently operate a dedicated advertising system or external AI-processing feature as described further below.

Users may nevertheless choose to include personal information in content they upload. Please avoid publishing sensitive information that you do not want others to see.

5. What is public, unlisted and private

Public information

Public information may include:

• your Profile;
• username;
• display name;
• biography;
• profile image and banner;
• optional social links;
• Nexus;
• Discoverable Routes;
• Rooms belonging to public Routes;
• uploaded images contained in public content; and
• metadata associated with that content.

Public information can be viewed, linked to, copied, saved or redistributed by other people.

Unlisted content

Unlisted content is intended to be accessible through its direct link or other intended access path without appearing in normal public discovery.

Anyone who obtains that access path may be able to view the content. Unlisted content should therefore not be treated as confidential storage.

Private information

Private information includes features such as:

• private Routes and their Rooms;
• Field Notes;
• saved content and Backpack information;
• Dream Retriever preferences;
• recommendation taste;
• account email;
• returning state; and
• other private account settings.

Private information is not intended to be displayed publicly.

Authorized operation of that dream may nevertheless permit limited operator access where reasonably necessary for moderation, support, security, copyright handling, abuse investigations, enforcement, service operation or legal compliance.

6. How we use information

We use information where reasonably necessary to:

• create, authenticate and maintain accounts;
• provide and restore your account session;
• create, store, display and traverse Routes and Rooms;
• provide Profiles and Nexus;
• deliver uploaded images and media;
• provide Field Notes, Backpack and saved-content features;
• provide Dream Retriever and recommendation functionality;
• remember preferences and returning state;
• search, rank and recommend content;
• operate public discovery;
• secure that dream and prevent abuse;
• enforce visibility and access controls;
• investigate bugs, security incidents or misuse;
• moderate public content;
• respond to support requests;
• process copyright or other legal requests;
• enforce our Terms and policies;
• protect users, the service and others; and
• comply with applicable law and valid legal process.

We do not use personal information for purposes that are materially incompatible with the purposes described here without providing additional notice or obtaining authorization where required.

7. Legal bases for EEA and similar privacy laws

Where the GDPR, UK GDPR, or another law requiring a lawful basis applies to our processing, we rely on one or more of the following bases depending on the activity.

Performance of a contract or steps requested by you

We process information when necessary to provide the service you request, including:

• account authentication;
• storing your Profile;
• saving Routes and Rooms;
• storing private features such as Field Notes and Backpack content;
• providing discovery and recommendation features;
• maintaining your settings; and
• displaying content according to the visibility choices you make.

Legitimate interests

We may process information where necessary for legitimate interests that are not overridden by your rights and interests, including:

• securing the service;
• preventing abuse and fraud;
• maintaining reliability;
• debugging technical problems;
• moderating content;
• protecting users;
• enforcing our policies; and
• understanding and improving basic service functionality without unnecessary tracking.

When relying on legitimate interests, we consider the nature of the information, the purpose of processing and the reasonable expectations and rights of affected users.

Legal obligations

We may process information when necessary to comply with legal obligations, lawful requests, court orders, copyright procedures or other applicable legal requirements.

Consent

Where a feature requires consent under applicable law, we will request consent for that specific purpose.

If processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that was lawful before withdrawal.

We do not rely on blanket acceptance of this Privacy Policy as consent for every processing activity.

8. Recommendations and automated processing

that dream uses private recommendation and taste signals to personalize discovery and help determine which content may be relevant to you.

This processing may involve automated ranking and personalization.

that dream does not currently use automated processing to make decisions about you that produce legal effects or similarly significant effects, such as determining access to employment, credit, housing, insurance or comparable opportunities.

9. Service providers

We use third-party infrastructure and authentication providers to operate that dream.

These currently include Google and Firebase services used for purposes such as:

• Firebase Authentication;
• Cloud Firestore;
• Cloud Storage for Firebase;
• Firebase Hosting;
• Firebase App Check;
• Google reCAPTCHA Enterprise; and
• related Google Cloud infrastructure.

Sentry may process the technical error, diagnostic and sampled performance information described in this Policy to help us monitor reliability and troubleshoot the service.

Apple may process information when Apple Sign-In is used.

These providers process information according to their own terms, privacy notices, security practices and data-processing arrangements.

We do not authorize these providers to use our user data for advertising on our behalf.

10. International processing and transfers

that dream is operated from Hong Kong, while our service providers operate infrastructure internationally.

As a result, personal information may be processed in jurisdictions other than the place where you live.

Where European data protection law applies to an international transfer, we rely on applicable lawful transfer mechanisms provided through our service arrangements where required, which may include adequacy decisions, Standard Contractual Clauses, recognized data-transfer frameworks, or another valid safeguard.

Firebase's applicable data-processing terms include data-transfer provisions and Standard Contractual Clauses for covered Firebase services.

Different service components may process information in different locations.

11. Browser storage, cookies and similar technologies

that dream uses browser storage technologies to provide and improve normal service operation.

Depending on the feature and browser, these may include:

• localStorage for preferences and application state;
• sessionStorage for short-lived navigation or session state;
• IndexedDB for local image caching or locally retained application data;
• Cache Storage and service workers for cached resources and images; and
• authentication persistence used by Firebase Authentication.

that dream's own application code does not currently set first-party cookies.

Google, Firebase, Apple, reCAPTCHA, hosting providers or browsers may use cookies or similar technologies as part of authentication, security, infrastructure or provider operation.

Browser storage such as localStorage and IndexedDB is technically different from cookies even though both can retain information on a device.

12. Analytics

that dream does not currently use a dedicated product-analytics SDK such as Google Analytics to measure user behavior across the service. Sentry's limited error and reliability monitoring is technical service operation, not product analytics, advertising measurement or session replay.

We may introduce privacy-conscious analytics or performance measurement in the future.

If doing so materially changes the information we collect or how we use it, we will update this Policy and provide consent controls or other choices where required before or when the processing begins.

13. Advertising, sale and targeted advertising

that dream does not currently display advertising.

We do not sell personal information for money or other valuable consideration.

We do not currently share personal information for cross-context behavioral advertising or use personal information for targeted advertising.

We do not currently use third-party advertising networks to track users across unrelated websites or apps for advertising purposes.

If these practices ever change, we will update this Policy and provide legally required notices and choices before or when the change occurs.

14. Do Not Track and Global Privacy Control

Some browsers provide a Do Not Track signal.

There is no universally applied technical standard requiring every website to respond to Do Not Track in the same way. Because that dream does not currently conduct cross-site behavioral advertising or sell personal information, we do not currently change the service's behavior in response to a Do Not Track signal.

Some browsers and extensions also provide privacy preference signals such as Global Privacy Control (GPC).

Because that dream does not currently sell or share personal information for targeted advertising, there is currently no such sale or targeted-advertising sharing for a GPC signal to opt out of.

Where applicable law requires us to recognize a legally valid universal opt-out mechanism for processing we conduct in the future, we will implement the required response.

15. Artificial intelligence

that dream does not currently transmit user-uploaded content or personal information to an external AI or model provider for AI processing as part of the production service.

The presence of metadata fields or labels that refer to AI does not by itself mean user content is sent to an AI provider.

If we later introduce an AI-powered feature that transmits user information or content to another provider, we will disclose that processing before or when the feature is introduced and obtain authorization where required.

16. Payments and donations

that dream does not currently process payments or donations through the app.

If we later introduce donations, purchases, subscriptions or other payment functionality, payment information may be processed by a third-party payment provider.

We will update this Policy before or when payment processing is introduced as appropriate.

17. Emails and service communications

We may use your account email address for communications reasonably necessary to operate or protect that dream.

These may include:

• account and security messages;
• authentication-related communications;
• important service notices;
• moderation decisions;
• responses to support requests;
• copyright or legal notices;
• privacy-request communications; and
• significant policy or service changes.

We do not currently operate a general promotional-email program.

If we later introduce newsletters or marketing communications, we will provide consent or unsubscribe mechanisms where required by applicable law.

18. External links and social profiles

Users may choose to link an Instagram or TikTok account from their public Profile.

When you follow an external link, you leave that dream and interact with another service.

We do not control the privacy practices, security or content of external services. Their own privacy policies and terms apply to their processing.

19. Moderation and operator access

that dream is a user-generated-content service.

The operator may access account or content information where reasonably necessary to:

• moderate public content;
• investigate user reports;
• provide support;
• diagnose technical problems;
• prevent or investigate abuse;
• maintain security;
• process copyright complaints;
• enforce our Terms and policies;
• respond to legal requests; or
• operate and maintain the service.

The technical ability to access stored information does not mean private information is routinely reviewed.

Access is restricted to service-operation purposes as practical for an independently operated service.

20. When we disclose information

We may disclose information:

• to service providers that help operate that dream;
• when you intentionally make information public;
• when you direct us to make information available;
• when reasonably necessary to investigate abuse, fraud or security incidents;
• to process moderation, copyright or legal complaints;
• to comply with applicable law, court orders or lawful governmental requests;
• to establish, exercise or defend legal claims;
• to protect the safety, rights or security of users, that dream or others; or
• in connection with a future merger, acquisition, restructuring or transfer of the service, subject to applicable legal requirements.

We do not sell personal information.

21. Data retention

We keep personal information only for as long as reasonably necessary for the purposes described in this Policy, including operating your account, providing requested features, maintaining security, resolving disputes, enforcing agreements and complying with legal obligations.

Retention depends on the type of information and why it is held.

For example:

• active account information may remain while the account exists;
• uploaded content may remain while you keep that content in the service;
• private preferences and state may remain while needed to provide their associated features;
• security and abuse-prevention information may be kept for an appropriate period where necessary to protect the service; and
• provider-controlled logs, backups and security records may follow the provider's own retention schedules.

When information is no longer reasonably necessary, we aim to delete, anonymize or otherwise stop actively using it as appropriate.

We do not promise that deletion from active application systems causes every backup, cache or provider security record to disappear instantaneously.

22. Account and content deletion

You can delete your account using the account controls provided by that dream.

Account deletion is designed to remove the user's app-controlled account data and associated content from our active systems through an ordered cleanup process.

This includes, as applicable:

• public Profile information;
• username records;
• Nexus;
• Routes and Rooms;
• public discovery representations;
• known associated uploaded media;
• private records such as saved content and Field Notes;
• account preferences and recommendation information;
• relevant browser-local account state; and
• the authentication account.

Deletion across databases, file storage, authentication systems, browser storage, caches and provider infrastructure cannot always occur as a single instantaneous operation.

If a critical deletion step fails, the service may keep the authenticated account available temporarily so deletion can be retried instead of falsely reporting success.

Some information may remain temporarily or longer where reasonably necessary for:

• security;
• fraud or abuse prevention;
• legal compliance;
• dispute resolution;
• legal claims;
• provider-managed backups;
• technical logs; or
• other lawful purposes.

You may contact inquiriesthatdream@gmail.com if you have difficulty deleting your account or content.

23. Security

We use reasonable technical and organizational measures intended to protect information handled by that dream.

Current measures include, where applicable:

• authenticated access;
• Firestore and Storage security rules;
• Firebase App Check;
• reCAPTCHA Enterprise protections;
• HTTPS-encrypted network connections;
• restricted administrative access; and
• security controls provided by our infrastructure providers.

No online service, network or storage system can guarantee absolute security.

You are responsible for maintaining the security of the Google, Apple, email/password or other account used to authenticate to that dream.

If we become aware of a personal-data breach, we will investigate it and provide notifications to affected users or authorities where required by applicable law.

24. Your privacy rights

Depending on where you live and which privacy law applies to that dream, you may have rights concerning your personal information.

These may include rights to:

• ask whether we process personal information about you;
• access personal information we hold about you;
• correct inaccurate or incomplete information;
• request deletion;
• request restriction of certain processing;
• object to certain processing;
• receive certain information in a portable format where applicable;
• withdraw consent where processing relies on consent;
• opt out of sale, targeted advertising or certain profiling where applicable;
• appeal certain privacy-request decisions where applicable; and
• complain to an applicable privacy or data-protection authority.

Not every right applies in every jurisdiction or circumstance.

Where a request is subject to a legal exception, we may decline or limit the request and explain the reason where required.

25. Hong Kong privacy rights

Where the Hong Kong Personal Data (Privacy) Ordinance applies, you may request:

• confirmation of whether that dream holds personal data about you;
• access to personal data held about you; and
• correction of inaccurate personal data.

Requests can be sent to inquiriesthatdream@gmail.com.

We may ask for information reasonably necessary to verify your identity and locate the relevant data.

26. EEA privacy rights

Where the GDPR applies, you may have the right to:

• access your personal data;
• correct inaccurate personal data;
• request erasure;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive qualifying data in a portable format;
• withdraw consent where processing relies on consent; and
• lodge a complaint with the supervisory authority responsible for data protection in your country or region.

You may contact us first at inquiriesthatdream@gmail.com, but contacting us does not prevent you from contacting a supervisory authority.

27. United States and state privacy disclosures

Depending on where you live and whether a particular U.S. privacy law applies to that dream, you may have additional rights.

These can include rights to:

• know or access personal information;
• correct inaccurate personal information;
• delete qualifying personal information;
• obtain a portable copy of qualifying information;
• opt out of sale of personal information;
• opt out of targeted advertising;
• opt out of certain qualifying profiling;
• limit certain uses of sensitive personal information where applicable; and
• appeal a denied privacy request where applicable.

that dream currently:

• does not sell personal information;
• does not share personal information for cross-context behavioral advertising;
• does not use targeted advertising;
• does not operate an advertising network;
• does not currently use a dedicated third-party analytics SDK; and
• does not use qualifying automated processing to make decisions producing legal or similarly significant effects.

Because those practices do not currently occur, there is presently no sale, targeted-advertising sharing or similarly significant profiling activity for a user to opt out of.

We may voluntarily honor reasonable access, correction and deletion requests even where a specific state privacy statute does not apply to that dream.

We will not discriminate against you for exercising privacy rights that apply to you.

28. California online privacy disclosures

For California users, the categories of information handled by that dream are described throughout this Policy, including identifiers, account information, internet or technical activity, Profile and user-generated content, preferences, recommendation information and inferences used for personalization.

The categories of service providers receiving information are described in the Service providers section.

Do Not Track

As described above, that dream does not currently respond differently to browser Do Not Track signals because we do not currently conduct cross-site behavioral advertising or sell personal information.

Third-party collection

Google, Firebase, Apple, reCAPTCHA and related infrastructure providers may collect technical or authentication information through their services as described in this Policy and according to their own privacy practices.

that dream does not currently authorize advertising networks or analytics providers to collect personal information across unrelated services on our behalf for targeted advertising.

Reviewing or changing information

You can change various Profile and content fields through the app and can contact us at inquiriesthatdream@gmail.com to request access, correction or deletion where applicable.

29. Exercising your privacy rights

To make a privacy request, email:

inquiriesthatdream@gmail.com

Using a subject such as Privacy Request will help us identify the request.

Please describe what you are requesting and the account involved.

We may request reasonable information to verify your identity before giving access to, changing or deleting personal information.

We will respond within the period required by applicable law.

If we deny a request and applicable law gives you a right to appeal, you may appeal by replying to our decision and stating that you wish to appeal the privacy decision.

30. Public-content responsibility

Information you intentionally publish can be seen, copied, saved or redistributed by other people.

Even if you later delete public content, we cannot guarantee deletion of copies independently created or stored by other users or third parties outside that dream's systems.

Do not publish personal information that you need to keep confidential.

In particular, consider carefully before publishing information such as:

• home addresses;
• private contact details;
• school or workplace details;
• precise location information;
• private schedules or routines; or
• personal information belonging to another person.

You are responsible for having the rights and permissions necessary for information and content you publish.

31. Changes to this Privacy Policy

We may update this Privacy Policy when:

• the service changes;
• we introduce materially different data practices;
• we add new service providers or technologies;
• applicable legal requirements change; or
• clarification is otherwise appropriate.

When changes are material, we may provide additional notice through that dream, by email, through the website, or through another appropriate method.

The version number and effective date at the top identify the current version.

32. Contact

For privacy questions, requests for access or correction, deletion requests, or other concerns about personal information, contact:

that dream — Privacy

Operator / controller: Aiden Fan, operating that dream Email: inquiriesthatdream@gmail.com Website: thatdream.space Location: Hong Kong