Privacy policy
App: Night Heron (on the App Store: “Night Heron: Lucid Dreams”)
Version: 1.0 · Effective from: 13 October 2026
In short
- Night Heron is an iPhone app that guides you through 30 nights of practice for lucid dreaming (and then through your ongoing practice), and lets you record your dreams when you wake up. It is made by Francesca Barchietto, an individual based in Italy. She is the controller of your personal data.
- Your dreams, transcripts, nights and settings are stored on Google Firebase in Italy (Milan). This keeps them safe and lets you get them back on another iPhone. We store them only after your explicit consent, because dreams and sleep can say something about your health. Audio recordings, for now, stay on your iPhone (section 3.3).
- Sign-in data is handled by Firebase Authentication in the United States. That is your account ID and, only if you choose to protect your account, your Apple identifier or your email address.
- We never store your age, your answers to the safety check or the name you give for the greeting. Speech is turned into text on your iPhone, not by a server.
- No advertising, no tracking, no analytics or crash-reporting tools. We only see the statistics and crash reports Apple shows us, if you chose to share them with app developers (section 3.4). We don't sell your data and we don't use it to train AI.
- We don't read your dreams. The controller can technically access the database: she will do so only if you ask for support and agree to it. Google, which provides the servers, can access it only in a limited way, for maintenance and technical support (sections 6 and 7).
- You can export or delete your account data in the app, at any time. Section 10 explains what remains. Withdrawing your consent means deleting your data.
1. Who is responsible for your data
The controller is:
Francesca Barchietto, individual
Strada Garella 78, 13900 Biella (BI), Italy
Email: info@nightheron.app
No data protection officer (DPO) has been appointed. For any privacy question, write to the address above.
In this policy, "we" and "us" mean Francesca Barchietto, who develops the app and is responsible for it.
2. What this policy covers
It covers:
- the Night Heron iPhone app, including the TestFlight test version (the "beta");
- the nightheron.app website;
- the emails you send us, for support or to join the beta.
It doesn't cover the Apple services you use with the app: App Store, TestFlight, iCloud and Sign in with Apple. Apple's privacy policies apply to those.
3. What data we process
3.1 Your account
If you choose Get started, your account is created only after the age question, and only if you say you are 18 or older. At first it is anonymous: no name, no email.
If instead you choose I've used Night Heron before and sign in with Apple, signing in immediately creates an account linked to your Apple identifier, if you didn't already have one. If the account has no dreams, you can undo it ("Use another Apple Account" deletes it and disconnects the app), or start fresh: in that case the app asks your age, and if you're under 18 it offers to delete what was saved. Signing in with email never creates an account.
| Data | When |
|---|---|
| The account ID | Always |
| The identifier Apple gives your Apple Account for this app | Only if you protect your dreams with Sign in with Apple, or sign in with Apple to get them back. We never ask Apple for your name or email. |
| Your email address and a protected form of your password (a hash that nobody can read, not even us) | Only if you protect your dreams with email and password |
| When the account was created and last signed in; the IP address and technical information about the app and device making the request (user agent) | Always: Firebase Authentication records them when you sign in |
We use your email only for your account: to sign you in and, if you ask, to send you the link to reset your password. Never newsletters or advertising.
3.2 Profile, settings and path
- Your app language (English or Italian) and time zone (for example "Europe/Rome"). They come from your iPhone's settings. The time zone isn't your location.
- When the profile was created.
- Consent: the version of the text you accepted, and the date.
- Safety check: only the version of the questions and the date you did it. Never your answers.
- Settings: when you turn off the light, how long you take to fall asleep, the night alarm (how long after falling asleep, on which days), the evening reminder, the confirmation sound, the language of your dreams for transcription, whether you have an Apple Watch, and "Audio only on this iPhone".
- Path: which path you follow, when you started it, whether it's active, paused or completed, and any review weeks.
3.3 Nights and dreams
This is the most personal data. It can concern your health (article 9 GDPR). That's why we store it only after your explicit consent.
- Nights: the date of the evening, that evening's lesson (including practice evenings after night 30), your intention, the night plan (with or without an alarm, and when), whether you recorded a dream or marked "No dream last night", and the time zone.
- Dreams: date, time and length of the recording, which device you recorded it on, the transcript, the text you write or correct, tags (including "Lucid dream" and "Nightmare") and, when the feature exists, the lucidity level.
- Audio recordings of your dreams. Today they stay only on your iPhone (and in its backup, section 4): saving them on the servers isn't switched on. If we switch it on, so you can get your recordings back on another iPhone, we'll first update this policy and ask for your consent again: recordings will go to Firebase Cloud Storage in Milan, except those made while "Audio only on this iPhone" is on.
- A random identifier for this iPhone. The app creates it. It tells us which iPhone holds a recording that isn't on the servers. It isn't an advertising identifier. After "Delete all my data" a new one is created, which can't be linked to the old one.
Before you consent, our database receives only your account ID, the creation date, your language, your time zone, and the version and date of the safety check. Firebase Authentication meanwhile records what section 3.1 describes: the ID, the IP address, the user agent and, if you signed in with Apple, your Apple identifier. Our database rules refuse nights, dreams, settings and path data for an account without consent.
3.4 Technical data, crashes and security
- IP address. Whenever the app talks to the servers, they see the IP address of your connection. Firebase Authentication keeps it in its logs for a few weeks. We don't use it to locate you or for anything else.
- Statistics and crashes, through Apple. We don't use Google Analytics or any other analytics or crash-reporting tool. If you chose to share analytics with app developers in your iPhone's settings (Settings › Privacy & Security › Analytics & Improvements), Apple shows us in App Store Connect aggregated statistics (for example installs and sessions) and the app's crash reports, without your name. Apple processes them under its own privacy policy; we use them only to fix errors. You can stop at any time in the same setting.
3.5 The TestFlight beta
- Joining the beta. To join the beta you write to us at info@nightheron.app. We use your address only to invite you to TestFlight: to do that, we enter it in App Store Connect, Apple's service for developers.
- TestFlight data. If you test the app with TestFlight, Apple shows us your invitation status, your device model and a device identifier, your OS version and language, how many times you installed and opened the app (sessions), crashes with their logs, and the feedback you send from the TestFlight app, with any screenshots. If we invite you by email, we are the ones who enter your address (and possibly your name) in App Store Connect; when you accept, Apple shows us your name and address. If you joined with a public link, it doesn't (but if you send feedback by email, we see the address you write from). Apple processes this data as an independent controller, under its TestFlight privacy notice.
- Screenshots you send with TestFlight show whatever is on screen, including the text of a dream. If you don't want us to see it, don't send screenshots of the Journal, and don't write details about your health in your comments.
3.6 When you write to us
If you contact support, we process your email address, your message and any attachments. Please don't send us your dream texts unless they're needed.
3.7 What we don't collect
- your name: we don't ask for it or store it in the app (the name for the greeting stays on your iPhone). We only see it if you write to us or if we invite you to TestFlight by email (sections 3.5 and 3.6);
- the email address of your Apple Account;
- your age (the question is yes or no, and the answer isn't saved);
- your answers to the safety check;
- data from the Health app (HealthKit);
- your location, your contacts, your photos;
- advertising identifiers. The app doesn't track you across other companies' apps and websites;
- usage analytics: no Google Analytics, no other analytics or advertising tools (we only see what Apple shows us, sections 3.4 and 3.5);
- payment data (cards, accounts). If purchases come one day, Apple handles them (section 6).
3.8 The website
The nightheron.app website uses no cookies, analytics or third-party tools. Like any website, the service that hosts it (Firebase Hosting, by Google) receives your IP address and technical details of the request (browser, page, time) to show you the pages and protect the site from abuse.
4. What stays only on your iPhone
- Turning speech into text. It happens on your iPhone, with iOS's own transcription, without going through a server. The resulting text is saved as section 3.3 explains.
- The name for the greeting, if you give one.
- Your age and your safety answers stay in memory only long enough to move on, then they're discarded.
- Alarms and reminders are scheduled on your iPhone, with iOS alarms and notifications: no notifications from our servers. The times you choose are saved with your settings (section 3.2).
- Lessons read aloud, with iOS voices.
- Audio recordings: today, all of them (section 3.3); if we ever switch on saving them on the servers, those made while "Audio only on this iPhone" is on.
- Health data, if the app uses it one day to suggest times: read-only, only on your devices, never on our servers.
The copy on your phone. So that the night works without internet, the app keeps a copy of your data and your recordings on your iPhone. That copy is part of your iPhone's backup (iCloud or Mac), if you have one turned on. Apple handles the backup under your agreement with Apple: we can't see it or delete it.
5. Why we process your data, and on what legal basis
The GDPR requires a legal basis for each use of data (article 6) and, for health data, an extra condition (article 9).
| Why | Which data | Legal basis |
|---|---|---|
| Create your account, sign you in, protect and restore your dreams, send you account emails | 3.1, language and time zone | Contract: needed to provide the service you ask for (art. 6(1)(b)) |
| Store, sync, show and export your dreams, recordings, nights, settings and path | 3.2 (settings and path), 3.3 | Contract (art. 6(1)(b)), together with your explicit consent (art. 9(2)(a)) |
| Remember which version of the consent and of the safety check you saw, so we can ask again when they change | Version and date of consent and safety check | Obligation to be able to show your consent (art. 6(1)(c) and 7(1)) and legitimate interest in offering a careful app (art. 6(1)(f)) |
| Show you the website and protect the app, the website and your data from unauthorised access and abuse | IP address, sign-in logs and technical data about visits (3.1, 3.4, 3.8) | Legitimate interest (art. 6(1)(f)) |
| Fix errors that make the app close | The statistics and crash reports Apple shows us (3.4) | Legitimate interest (art. 6(1)(f)) |
| Invite you to the TestFlight beta | The email you write from (3.5) | Steps you ask for before entering a contract (art. 6(1)(b)) |
| Improve the beta | TestFlight data (3.5) | Legitimate interest (art. 6(1)(f)). If a comment or screenshot contains health data, we look at it only to fix the app and don't copy it outside App Store Connect |
| Answer your support requests | 3.6 | Contract (art. 6(1)(b)) or legitimate interest (art. 6(1)(f)). If we need to look at your stored data to help you, we do so only with your explicit consent (art. 9(2)(a)) |
| Comply with the law, for example answer an authority | What the law requires | Legal obligation (art. 6(1)(c)) |
Legitimate interest, explained. We rely on it for the website, for security, for app crashes, for TestFlight data, to remember the versions of the consent and of the safety check and, in part, for support. Our interest is an app that doesn't crash at night and that protects your dreams from abuse. We believe it doesn't override your rights because:
- the data is limited and technical, with no dream content (except what you choose to send us, section 3.5);
- the identifiers are technical, not your name;
- we keep it for a short time (section 8);
- we never use it for advertising or profiling;
- people expect an app to fix its errors.
Your right to object. You can object at any time, on grounds relating to your particular situation, to processing based on legitimate interest: security, crash reports, TestFlight data. Write to info@nightheron.app. For the statistics and crash reports Apple shows us, just turn off sharing with app developers in your iPhone's settings.
Do you have to give us this data? Without an account and without consent the app can't work. There's no "phone-only" mode, because dreams are stored on the servers so they're never lost. If you don't consent, the account that was just created holds only a few technical details, and you can delete it in the app. To take part in the beta you need to write to us, but the beta is optional: the App Store app works without it.
6. Who can see your data
You, through the app.
The controller. As the owner of the project, Francesca Barchietto can technically access the database. Her promise: she'll look at your data only if you ask for support and agree to it, and only at what's needed to help you. She doesn't read dreams out of curiosity, for statistics or to improve the app. We never compute statistics by reading users' data in the database.
Google, which provides the servers (Firebase). Google processes the data only on our behalf, as our processor, under the Cloud Data Processing Addendum, part of the Google Cloud and Firebase terms. That agreement requires Google to protect the data with confidentiality and security safeguards that comply with the GDPR (article 28) and are no weaker than those described in this policy. Google uses its own providers in turn, including other Google group companies (Google Cloud subprocessors, Firebase subprocessors). Some of them may access the data in a limited way, for maintenance and technical support (section 7).
| Firebase service | What it holds | Where |
|---|---|---|
| Cloud Firestore | Profile, settings, path, nights, dreams (texts, transcripts, tags) | EU, Milan (europe-west8) |
| Cloud Storage (not active yet) | Audio recordings, only if we switch on saving them on the servers (3.3) | EU, Milan (europe-west8) |
| Authentication | Account ID, Apple identifier, email, protected password, IP | United States |
| Hosting | The nightheron.app website: IP and technical data about visits (3.8) | Global service |
Apple, as an independent controller, under its own terms and privacy policy, for:
- Sign in with Apple, if you choose it;
- TestFlight, during the beta, including the invitation (section 3.5);
- App Store statistics and crash reports, if you chose to share them with app developers (section 3.4);
- purchases on the App Store, if there are any one day: Apple handles payments, invoices and refunds, and we don't receive your payment details;
- your iPhone's backup on iCloud, if you use it.
Squarespace, which manages the nightheron.app domain and forwards mail sent to info@nightheron.app (through its provider Mailgun), as our processor. The mail arrives in a Gmail mailbox, Google's email service, where we read it and reply from: Google handles it under its own terms and privacy policy.
Authorities, only when the law requires it.
Nobody else. We don't sell or rent your data. We don't give it to advertisers, data brokers or AI services.
7. Transfers outside the European Union
- Firebase Authentication processes data only in the United States (Google LLC).
- Firebase Hosting, which hosts the website, is a global service: technical data about visits may be processed in any country where Google has data centres.
- Your dreams, nights and settings are stored in Italy (Milan). Google, as our processor, may also access them in a limited way from countries outside the EU (for example the United States), only for maintenance, security or technical support, with the safeguards below.
- Mail to info@nightheron.app goes through Squarespace and Mailgun, in the United States, and arrives in Google's Gmail mailbox, which may also process it outside the EU, with the safeguards below.
Safeguards. Google LLC, Squarespace, Inc. and Mailgun Technologies, Inc. participate in the EU-U.S. Data Privacy Framework, which the European Commission found adequate (decision of 10 July 2023). We checked this in the official list (dataprivacyframework.gov) on 13 October 2026. If the Data Privacy Framework stopped applying, Google Cloud's data processing terms (the Cloud Data Processing Addendum) and Squarespace's provide for the Standard Contractual Clauses approved by the Commission. You can ask us for information or a copy of these safeguards at the address in section 1.
8. How long we keep your data
| Data | How long |
|---|---|
| Account, profile, settings, path, nights and dreams on the servers | Until you delete them. You delete a dream in the Journal; everything else with "Delete all my data", "Delete account" or "Withdraw consent". After deletion, Google also removes the data from its internal backups within 180 days. |
| The same data, if we close your account (terms, section 14) or shut down the service (terms, section 10) | After the notice period to export it, we delete it within 30 days. Google removes it from its backups within 180 days. |
| IP addresses in Firebase Authentication logs | A few weeks |
| IP addresses of website visits (Firebase Hosting) | A few months, then Google deletes them. We don't copy them anywhere else. |
| Apple's statistics and crash reports | Kept by Apple, under its rules. We view them in App Store Connect. |
| The copy on your iPhone | Until you delete your data, sign out or uninstall the app. After uninstalling, your sign-in and this iPhone's identifier may remain in the iPhone's Keychain, so the app finds you again if you reinstall it. |
| Emails to join the beta | Up to 3 months after the beta ends, or earlier if you ask us |
| TestFlight data | Kept by Apple, under its rules. We view it in App Store Connect and don't copy it elsewhere. |
| Support emails | 12 months after the request is closed, or earlier if you ask us |
| A small sign-in record left after a deletion (section 10) | We delete it ourselves within 30 days, even if you don't write to us: every month we check for sign-in accounts left with no data. If you write to us, we remove it straight away. |
If you lose your iPhone with an anonymous account. If you haven't protected your account with Apple or with your email, your data stays on the servers, but you can no longer access it. And we can't give it back to you or delete it at your request, because we can't check that the account is yours. That's why the app suggests protecting your dreams, or exporting them.
9. Your rights
At any time you can ask us to:
- access your data and get a copy (art. 15);
- correct it (art. 16). You correct dream texts and tags yourself in the Journal; to change your account's email, write to us from the address you use now;
- delete it (art. 17). You do it in the app (section 10);
- restrict its processing (art. 18);
- take it with you (art. 20). You do it in the app with "Export my data": a zip file with your profile, settings, nights and dreams (in JSON), a Markdown page for each night and your recordings (in m4a). Without a connection, recordings that aren't on this iPhone are missing. Sign-in data (for example email and IP) isn't included: for that, write to us;
- object to processing based on legitimate interest (art. 21: see the box in section 5);
- withdraw your consent at any time (art. 7(3)). Because the app can't work without it, withdrawing means deleting your data. Withdrawing doesn't make what happened before unlawful.
We don't make decisions based solely on automated processing that have legal or similarly significant effects on you (art. 22). See section 13.
How to exercise them.
- In the app: Settings › Privacy and your data. There you'll find "Export my data", "Delete all my data", "Withdraw consent", "Read the consent" and "Audio only on this iPhone". In Settings, Account section, there's also "Delete account".
- By email: info@nightheron.app. We reply within one month. If the request is complex it can take up to three months, and if so we tell you within the first month.
Anonymous accounts. An anonymous account has no email or name, so by email we can't check that it's yours (art. 11 GDPR). Use the tools in the app, which always work and don't need anyone's approval.
Complaints. If you think we're handling your data wrongly, you can complain to the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it, page I miei diritti), or to the authority of the EU country where you live, where you work or where the alleged infringement took place. We'd appreciate it if you wrote to us first, so we can try to fix it.
10. How to delete everything, and what remains
In the app: Settings › Privacy and your data › Delete all my data, or Settings › Delete account (they do the same thing).
- If your account is protected, you first confirm with Apple or with your password.
- Then the app deletes any recordings on the servers, your dreams and nights, your profile and settings, the data and recordings on your iPhone and finally the account.
- If you confirm with Apple, the app also disconnects Night Heron from your Apple Account. If you confirm with your password, or delete without confirming, Night Heron stays in the list of apps that use Sign in with Apple: you can remove it in your iPhone's Settings app.
- You can ask for deletion even without internet: it starts as soon as you're back online. With a protected account, the confirmation with Apple or your password also happens once you're back online. If the app closes halfway, it finishes the next time you open it.
Uninstalling the app doesn't delete your data from the servers. To delete it, use "Delete all my data".
What isn't affected:
- copies in your iPhone backups (iCloud or Mac), in exports you saved, or on another iPhone;
- TestFlight data, which Apple keeps;
- the emails you sent us (support or beta): we delete them as section 8 explains, or earlier if you ask us;
- Google's internal backups: Google removes sign-in data and other data within 180 days.
If deleting the account doesn't fully succeed (for example you can't confirm with Apple or with your password, or the account is anonymous and Firebase doesn't delete it), the app still deletes your data. A small sign-in record may remain in Firebase Authentication: the account ID, the link to your Apple identifier if there was one and, if the account had an email, your address. With a protected account, the app tells you. We remove it ourselves within 30 days; if you like, write to us and we'll do it straight away.
11. Minors
The app is only for people aged 18 and over, because the practices can disturb sleep. Usually the age question comes before the account is created: if you say you're under 18, the app creates nothing and saves nothing, not even your answer. If the account already exists (for example you've just signed in with Apple or with your email and you choose to start fresh, section 3.1), the app saves nothing else and offers to delete what's there. If we find out that we hold a minor's data anyway, we delete it. If you think this has happened, write to us.
12. How we protect your data
- Each account sees only its own data. The rules of the database and of the file storage enforce this on the server. We check them with automated tests every time they change.
- Before you consent, the server doesn't accept dreams, nights, settings or recordings.
- Encrypted connections (HTTPS) between the app and the servers, and for the website. Google also encrypts the data where it's stored.
- No dream text in technical logs or crash reports.
- We don't store your password. Firebase keeps only a protected form of it.
- Sign-in messages never reveal whether an email has an account. One exception: sign-up, which has to tell you if the email is already in use, so it can offer you the right way forward.
- Administrator keys are not in the app's code. Access to the Firebase console is protected.
What we don't do (yet). Your data isn't end-to-end encrypted, where only you would hold the key: that's why the controller can technically access the database (section 6). The export file isn't password-protected: keep it somewhere safe.
If a data breach happens, we notify the Garante and, if there's a high risk for you, you too, as the law requires (articles 33 and 34 GDPR).
13. Automated decisions
We don't make automated decisions with legal or similarly significant effects on you. The app does some calculations on your iPhone to give you suggestions: tonight's night, alarm times, a suggested review. They're suggestions: you always decide. The safety check gives you advice, but it doesn't block you and your answers aren't saved.
14. Changes to this policy
If we change this policy, we update the version and date at the top and publish the new version at nightheron.app/privacy. If you'd like to read an earlier version, write to us and we'll send it to you.
If the consent text changes, the app shows it to you again when you open it (never at night) and asks whether you agree. Until you answer, the version you accepted before applies, and anything new stays switched off. If you don't agree, you can export your data and delete it.
15. Contact
Francesca Barchietto · Strada Garella 78, 13900 Biella (BI), Italy · info@nightheron.app
Support: nightheron.app/support