revery is a private space for your days, your people, and your stories. This policy explains what we collect, why, and what we deliberately cannot see.
The short version. The content you create in revery is end-to-end encrypted on your device before it reaches our servers. We store it as ciphertext, we do not hold the keys, and we cannot read it. The only personal information we can actually see is the basic account information Apple or Google gives us when you sign in. We do not sell your data, show you ads, or use your data to train anything.
Who we are
revery is an application published by Mad Becks Creative ("revery", "we", "us"). If you have any question about this policy or about your data, write to reveryadmin@madbecks.com.
Information we collect
Account information. revery uses Sign in with Apple and Sign in with Google. There is no revery password to create or forget.
- Sign in with Apple — Apple shares your name, an email address, and the unique identifier Apple assigns to your account. If you choose Hide My Email, the address we receive is Apple's private relay address rather than your personal one, and that is the address we store and write to.
- Sign in with Google — Google shares a limited profile with us: your name, your email address, your profile picture, and the unique identifier Google assigns to your account.
We use this to create and identify your account, and to show the people in a shared space who wrote which entry. We never receive your Apple or Google password. We do not request access to Gmail, Drive, Contacts, iCloud, or any other service either company offers.
Content you create. Entries, photos, and anything else you put into revery are encrypted on your device before they are uploaded. What our servers hold is encrypted data plus the minimal technical metadata needed to store and sync it — for example, record identifiers and timestamps. We cannot decrypt your content, and neither can our hosting providers.
Invitations. When you invite someone to share a space with you, we generate an invite link containing a random token so that the invitation can be matched to the right space when it is opened.
Waitlist. If you give us your email address on revery.club before launch, we store that address, the date you gave it, and which form on the page you used. We use it for exactly one thing: to email you once, when revery is available. It is not added to a mailing list, not used for any other message, and not shared with anyone. Ask us at any time and we will remove it. When you submit the form, Cloudflare Turnstile runs a check that you are a real browser rather than an automated script — it processes only what that check needs and does not read what you type (see section 5).
Technical logs. Like any service on the internet, our servers record basic request information such as IP address, timestamp, and error diagnostics. We use these to keep the service running and to investigate abuse or outages, and we retain them only for a short operational period.
We do not use third-party analytics, advertising, or tracking SDKs in the app.
How we use information
- To authenticate you and maintain your account.
- To store and sync your encrypted content across your devices.
- To deliver invitations and let you share spaces with people you choose.
- To operate, secure, debug, and improve the service.
- To respond to you when you contact us for support.
- To email you once at launch, if you joined the waitlist on our website.
We do not sell or rent personal information. We do not share it with advertisers or data brokers. We do not use your information to build advertising profiles, and we do not use it to train machine learning or artificial intelligence models.
Google user data
revery's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically, the account information we receive from Google is used only to provide and improve the user-facing features of revery; it is not transferred to others except as necessary to provide the service, to comply with applicable law, or as part of a merger or acquisition; it is never used for advertising; and no humans read it except with your explicit consent, to resolve a specific support issue, or where required by law.
Service providers
We rely on a small number of infrastructure providers who process data on our behalf, under contract, and only to run the service:
- Google Cloud and Firebase — authentication and application infrastructure.
- Supabase — managed database and storage hosting.
- Cloudflare — hosting for this website, the database that holds pre-launch waitlist addresses, and the bot check on the waitlist form (Cloudflare Turnstile), which confirms a submission came from a real browser. Turnstile does not read what you type, is not used to profile you or track you across sites, and serves no advertising. Cloudflare describes what it processes in its Turnstile Privacy Addendum.
Because your content is encrypted before it leaves your device, these providers store ciphertext they cannot read. The website waitlist is the one exception: an address you give us there is held as ordinary text, because we have to be able to write to it.
Where your data is stored
We and our providers may store and process your information in countries other than your own. Wherever it is held, this policy and the protections described in it apply to it.
Retention and deletion
We keep your account information and your encrypted content for as long as your account is active. You can delete individual content at any time from within the app, and you can delete your entire account from the app's settings. You can also request deletion by emailing reveryadmin@madbecks.com from the address associated with your account.
Waitlist addresses are kept only until the launch email has been sent, and are deleted afterwards. You can have yours removed sooner by writing to reveryadmin@madbecks.com.
When you delete your account, we remove your account information and your stored content from our production systems within 30 days. Residual copies may persist in encrypted backups for a limited period before being overwritten on our normal backup rotation.
Security
Your content is end-to-end encrypted, meaning encryption and decryption happen on your devices using keys we do not have. Data is additionally protected in transit with TLS and at rest by our infrastructure providers. No system is perfectly secure, and we cannot guarantee absolute security, but end-to-end encryption is designed so that even a compromise of our servers does not expose the contents of your entries.
Your rights
Depending on where you live, you may have the right to access, correct, export, or delete the personal information we hold about you, to object to or restrict certain processing, and to withdraw consent. To exercise any of these, email reveryadmin@madbecks.com and we will respond within the period required by applicable law.
One honest limitation: because your content is end-to-end encrypted, we can return the encrypted records we hold and the account information we can read, but we cannot produce a plaintext copy of your entries. Export your content from within the app, where the keys live.
We will never discriminate against you for exercising these rights.
Children
revery is not directed to children. You must be at least 13 years old to use it, or at least 16 if you are in the European Economic Area or the United Kingdom. We do not knowingly collect information from children below these ages. If you believe a child has given us information, contact us and we will delete it.
Changes to this policy
If we change this policy we will update the effective date above, and for material changes we will give notice in the app or by email before the change takes effect.
Contact
Mad Becks Creative
reveryadmin@madbecks.com