Privacy policy

Last updated: September 2026

Who processes your data

The data controller is Sapobi. For any request about your data you can write to us at info@rimmofatt.com.

What we collect

• Registration data: email address, first and last name, password (stored only in encrypted form, we can’t read it) and your statement that you are at least 18 years old, with the date.
• Optional profile data: date of birth, sex and name day, and where you live (the country and, for Italy, the region and the province, with the time zone and daylight saving time), only if you choose to provide them. The place is used to show you the sky over your area: the moon, the stars, sunrise and sunset, and the website’s colors when the theme follows the time of day; and to have mail and notifications reach you in the morning where you are.
• Language: the one you use Rimmofatt! in, taken from the page you sign up from, which you can change from your Profile. It decides the language of the website when you sign in, of the emails and of the notifications.
• Notifications: if you turn them on, the address at which your browser or phone receives them, with the language and time zone of the device, so we can send them in your language and in the morning where you are, even if you haven’t set these in your Profile.
• If you sign in with Google: the identifier of your Google account, the email address, and the first and last name that Google shares with us.
• Your dreams: the text of the dreams you tell us, the readings generated and the symbols we find in them.
• Friends: friend requests, friends, the people you’ve blocked and the letters you send each other, with their message. If “Let people find you” is on — it is at first, and you can turn it off from your Profile — other members can find you by searching for your name.
• Usage data: DreamPoint, events you take part in, invitations (who invited you and whom you invited).
• Home page notices: which notice stars you have already seen and when, so we show them to you only once.
• The Android app test: if you ask for the steps to try the app before it’s released, the date you asked for them.
• Minimal technical data: IP address and device, stored only as a fingerprint computed with a secret key, to prevent abuse and to show you where you are signed in from. The address cannot be traced back from the fingerprint.
• Reports: if you report a story, a letter, a person or a reading, we keep the report, the reason, your note and a copy of the reported content, so that we can assess it. Whoever is reported doesn’t know who reported them.
• The mail we send you: who it went to, with what subject and when, so we know whether it arrived.
• Your choices on statistics and advertising: when you accept or decline, we set aside what you chose, when and through which consent request. It serves only to be able to prove it.

What we do NOT keep

• The audio of your voice: it is transcribed and immediately discarded, we never save it.
• Messenger stars: the few words you send a friend with a star stay in the server’s memory only until the star falls on their screen, and we don’t save them anywhere.
• Payment data: cards are handled directly by Stripe, we neither see nor store them.

Why we process your data

• To provide you with the service (interpreting your dreams, keeping your Journal, managing your DreamPoint and friends, showing you the notices and the sky over your area, in your language): the legal basis is the contract.
• To prevent abuse of bonuses and free trials: legitimate interest.
• To handle reports and keep the community safe, including by hiding content or suspending accounts: legitimate interest.
• To send you our mail — the proverb of the day and the saint of the day, the weekly thread, the month in symbols, news: only with your consent. With consent you get all of them; you turn them off one by one from the link at the bottom of each, or from Email subscriptions in your Profile, and you can withdraw consent whenever you like from your Profile. If your mailbox has a button to unsubscribe, like Gmail’s “Unsubscribe” button, tapping it turns off all our mail.
• To send you the steps to try the Android app before it’s released, if you ask for them with the checkbox at sign-up or from the test page: a single email, with your consent. The tester group is on Google Groups, and you join it yourself, with your Google account.
• For usage statistics and to publish your good-fortune stories: only with your explicit consent, which you can withdraw whenever you like from your Profile.

Who we share it with

• OpenAI, which processes the text of your dream to generate the reading and the voice transcription, and, if you tell your dream in another language, to translate it into Italian: our dictionary of symbols is in Italian, and the reading reaches you in your language. Your dream is sent with the instruction not to keep it and not to use it to train models. With the same instruction, when it helps us reply, it receives the text of the comments on our posts, without the name of the person who wrote them.
• Stripe, for subscriptions.
• Aruba, which sends our emails.
• OVH, where the servers that run the service are located.
• Google, which shows the ads included in the free plan: on the website with AdSense, in the Android app with AdMob. In the app, Google’s SDK directly collects the IP address, the phone’s advertising ID and technical data on how the app and the ads are used, in order to show them, measure them and prevent fraud. Google is an independent controller of the data collected with its own cookies and its own SDK, and it personalizes ads only if you have given your consent; otherwise it shows you non-personalized ones.
• Rewarded videos (Android app only): when you watch a video to receive a DreamPoint, we give Google your account’s internal code, not your email or your name, and a token valid only once. Google sends them back to us when the video is over, and that’s how the DreamPoint reaches you.
• Google Firebase Cloud Messaging, which delivers the Android app’s notifications to those who turn them on: it receives the code that identifies the app on your phone and the text of the notification.

We don’t sell your data to anyone. The content of your dreams is never used for advertising or shared with Google: the ads don’t know what you dreamed. You can change your mind about personalization whenever you like from your Profile, or from [Google Ad Settings](https://adssettings.google.com). On your phone you can also reset or delete the advertising ID in your Android settings. Details on which cookies we use are in the Cookie policy.

Where this data goes

The servers that run Rimmofatt! are in Europe, and your dreams and your Journal stay in Europe. Some of the providers above, however, are based in the United States, and what we send them crosses the Atlantic:

• OpenAI (United States) — receives the text of your dream and the audio to be transcribed, and the text of the comments on our posts when it helps us reply. The transfer takes place on the basis of the standard contractual clauses approved by the European Commission.
• Stripe (United States) — receives the data needed for the payment. Stripe participates in the EU-U.S. Data Privacy Framework and also applies the standard contractual clauses.
• Google (United States) — ads, statistics, sign-in with Google and notifications. Google participates in the EU-U.S. Data Privacy Framework and also applies the standard contractual clauses.

Aruba, which sends our emails, and OVH, where the servers are, are European companies: that data doesn’t leave the European Union. You can ask us for a copy of the safeguards by writing to info@rimmofatt.com.

Automated decisions and artificial intelligence

The reading of your dream is written by an artificial intelligence, based on what you told us and on our dictionary of symbols. It is entertainment and tradition: it is not medical, psychological, legal or financial advice, and it is not a forecast.

Before giving a reading, an automatic check reads your dream and, if it touches on sensitive topics — for example the intention to harm yourself — it stops and doesn’t interpret it, replying with a message that encourages you to talk to someone about it. It is a keyword check: it concerns that single dream, not you, and it leaves no judgment on your account.

No decision about you is made by a machine on its own: we don’t profile people, we don’t assign scores, and suspending or closing an account is always decided by a person, after looking into it. If a decision made about you doesn’t convince you, write to us at info@rimmofatt.com: you have the right to obtain the intervention of a person, to give your side and to contest it.

How long we keep it

Your dreams stay as long as you keep them in your Journal: you can delete them one at a time or delete your entire account. For everything else, we keep things for as long as needed, and no longer:

When you delete your account we erase your profile data, your dreams with their symbols, your stories, your friends and letters, the notices already seen, your DreamPoint, your invitations and the mail log; statistics and reports remain with nothing left that leads back to you. What remains is the data of paid subscriptions — plan, dates, Stripe identifiers — which tax law requires us to keep for ten years.

If you’re not a member and still end up in our data

It can happen in three cases, and in none of them did we go looking for you:

• Someone invited you. A member entered your email address to invite you. About you, we keep that address and the date, to recognize the invitation if you sign up and so as not to count it twice. We don’t write to you: the link is passed on to you by the person who invited you. Legal basis: our legitimate interest in recognizing invitations.
• Someone reported you, or mentioned you in a dream. In that case your name or what concerns you is inside a text written by someone else, and we process it only to assess the report. Legal basis: legitimate interest in keeping the service safe.
• You commented on one of our posts on Instagram or Facebook. We read the comments on our posts, with your username, to reply to you and to hide spam and insults. We don’t copy them into our archives: they stay on Instagram and Facebook, where you manage them. To help us write a reply we may send OpenAI only the text of the comment, without your username, with the instruction not to keep it; the reply is always chosen and published by a person. Legal basis: our legitimate interest in replying to those who write to us and in keeping our pages in order. For what Meta does with your data, its own privacy policy applies.

Even if you’re not a member you have the same rights: you can ask us what data we hold about you, correct it, object to its processing and request its deletion, by writing to info@rimmofatt.com. If you ask us not to contact you anymore, saying it once is enough.

Your rights

You can access your data, correct it, export it in a readable format, restrict its processing, object to it or delete it. You’ll find everything in your Profile: “Download my data” and “Delete my account” work right away, without having to write to anyone. You also have the right to lodge a complaint with the Garante per la protezione dei dati personali (the Italian Data Protection Authority: Piazza Venezia 11, 00187 Roma — garanteprivacy.it).

Minors

Rimmofatt! is reserved for people who are at least 18 years old: those who sign up declare it, and those who sign in with Google are asked the same before they begin. If we find out that an account belongs to a minor, we close it and delete its data.