Privacy Policy

1. About this policy

Somora is a personal journal for dreams and reflections. This policy explains what information the Somora iOS app and its account service handle, why, how long it is kept, and the choices you have. It applies to the app and the pages on justsomora.com linked from the app. By using Somora you agree to this policy.

Somora runs no advertising, sells no personal information, and does not use third-party analytics or tracking tools.

2. What stays on your device

Most of what you create in Somora never leaves your phone. Dreams, reflections, bedtime intentions, avatars, favorites, preview conversations, messages, and voice recordings are stored on this device. Private reflections are excluded from dream cards and shared images. People, automated replies, and remote call participants in Somora are local simulations with no real person and no real recipient.

If you sign in with Apple, the account service receives the limited account and technical information described below. Enabling the account service does not upload your dreams, messages, or recordings.

3. Information we collect

• Account information. Sign in with Apple gives the account service the stable Apple user identifier Apple creates for you and the email address you choose to share, whether your real address or a private relay address. Completing your profile submits a name, your age, an account gender, and an optional bio. Avatars and later edits to your local profile stay on the device.
• Device and request information. Requests to the account service include an installation identifier, operating system, app version, app name, language and region setting, and the app's bundle identifier. Authenticated requests carry a sign-in credential. Our servers also keep standard security logs: the request IP address, time, and the endpoint contacted.
• Approximate location. You can let Somora suggest an approximate city or choose one manually. This is coarse, city-level information, not precise GPS. It is used on the device and is not sent to the account service.
• Photos and videos. The system photo picker provides only the images and videos you select. The app cannot scan or read the rest of your library.
• Contacts. With your permission, Somora reads your contacts on this device to help you choose people when you share a dream card or message. Matching and selection happen on the device; your contacts are not uploaded to the account service or stored on our servers.
• Microphone and camera. The microphone records voice messages you start. The camera shows a local preview you turn on. Neither is active in the background, and nothing is captured without an action you take.
• Notifications. Reminders are scheduled as local notifications on the device. There is no push server.
• Support messages. When you email us, we receive your email address, your message, and any details you include, such as the app version and the steps you took.

4. How we use it

• to authenticate your account and keep you signed in;
• to provide the features you turn on, including sharing, reminders, and backups;
• to keep the service secure and reliable, and to diagnose problems through security logs;
• to answer your support messages;
• to meet our legal obligations.

We do not use your information for advertising, profiling, or automated decisions about you.

5. Permissions

iOS shows a system prompt before the app uses location, the microphone, camera, photo library, or contacts. Each prompt explains the purpose, and you can withdraw any permission in iOS Settings > Somora. Notifications can be switched off there as well. Most of the app works without these permissions; account sign-in requires Sign in with Apple.

6. How information is shared

Information is shared only with the following:

• Apple, when you use Sign in with Apple. Apple handles that exchange under its own privacy policy.
• Infrastructure providers that host the account service for us in the United States. They process account and technical information under written contracts and only as instructed.
• People you choose, when you use the system share sheet or send an export.
• Authorities or successors, where disclosure is required by law, is needed to protect the safety of users or the public, or accompanies a merger, acquisition, or asset sale. In that case, the information must remain protected under this policy.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not collect an advertising identifier and we do not use tracking or advertising SDKs.

7. Retention and deletion

• Local content, including dreams, reflections, recordings, and avatars, stays on the device until you clear it inside the app or delete the app.
• Account information is kept while your account exists. After you delete your account, we delete the personal information associated with it no later than 30 days after the deletion request completes. Copies held in routine backups are overwritten on a rolling cycle of no more than 90 days.
• Security logs, including IP addresses, are deleted within 30 days.
• Support correspondence is deleted within 12 months after the request is closed, unless a longer period is required by law.
• Information may be kept longer when a legal hold or binding order applies, and only for as long as it is required.

8. Deleting your account and your local data

Accounts are created in the app and deleted in the app, under Settings > Account > Delete account. Deleting the server account and clearing local data are separate actions, so you can do either or both. If a deletion request cannot be confirmed, for example because of a network timeout, the app shows the outcome as unconfirmed instead of reporting success; check the account status before trying again. Local cleanup follows confirmed server deletion. You can also sign out and continue as a guest, or delete the app to remove all local data.

9. United States privacy rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act gives you these rights:

• Know the categories of personal information collected, the sources and purposes, the categories of recipients, and the specific pieces of information held about you;
• Delete personal information collected from you;
• Correct inaccurate information;
• Limit the use of sensitive personal information;
• Opt out of any sale or sharing for cross-context advertising. We do not sell or share personal information, so there is nothing to opt out of;
• Non-discrimination for exercising these rights.

Make a request by emailing somoraiosfeedback@justsomora.com from the address associated with your account. We acknowledge requests within 10 business days and respond within 45 days. An authorized agent may act for you with written authorization.

In CCPA terms, the categories we collect are: identifiers (Apple identifier, installation identifier, IP address, email); customer records (name, age, gender, bio); device and network information (operating system, app version, locale, bundle identifier); approximate geolocation; and your correspondence with support. Your dreams, messages, and recordings stay on your device and are not collected by the service. We do not collect sensitive personal information beyond the categories above, and no personal information of anyone under 16 is sold or shared. Residents of other U.S. states may have comparable rights under state law, and we handle those requests in the same way.

10. Children

Somora is for adults aged 18 or older. Before the app opens, including for guest access with no account, you must select your age. Anyone under 18 is blocked from using Somora and cannot create an account. We do not knowingly collect personal information from anyone under 18, and, consistent with U.S. law, no information from children under 13. If you believe a minor has provided us information, email somoraiosfeedback@justsomora.com and we will delete it promptly.

A self-selected age gate cannot perfectly stop a determined minor, and we do not claim otherwise. If an under-age account is brought to our attention, we close it and delete the associated information.

11. Security

Account traffic uses TLS in transit. Sign-in credentials are stored in the iOS Keychain, and development, production, individual accounts, and guest storage are isolated from one another. Access to the account service is limited to the people who operate it, and the service verifies Sign in with Apple tokens with Apple. Local content is protected by the data protection built into iOS.

12. Where data is stored

The account service is hosted in the United States, and we do not transfer personal information across national borders. Sign in with Apple is operated by Apple under its own terms, and anything you share yourself through the system share sheet goes to recipients you choose. If our hosting arrangements change, we will update this section before any transfer occurs.

13. Changes to this policy

We update this policy when the app changes or the law requires. The effective date above identifies the current version. Material changes are noted in the app or on this page, and continued use after the effective date counts as acceptance.

14. Contact

Questions, privacy requests, and reports go to somoraiosfeedback@justsomora.com. The app opens a system email draft for you to review before sending. Please do not include private dreams, account credentials, or other sensitive personal information unless it is needed to resolve the request.