Kebijakan Privasi

Effective Date: March 31, 2026
Last Updated: April 2, 2026

Kkumi ("we", "us", "our") operates the website https://kkumi.app (the "Service"). This Privacy Policy explains how we collect, use, and protect your personal information.

1. Information We Collect

1.1 Account Information

When you create an account, we collect your email address and display name. If you sign in with Google, we receive your name, email, and profile picture from Google.

1.2 Dream Content (End-to-End Encrypted)

Your dream journal entries are encrypted on your device before being sent to our servers using AES-256-GCM encryption. We store only the encrypted data. We cannot read, access, or decrypt your dream content. This applies to all team members, including administrators.

• Password-based accounts: encryption key derived from your password (PBKDF2, 100,000 iterations)
• Social login accounts: encryption key generated and stored locally on your device (IndexedDB)
• If you lose your device (social login), your encryption key cannot be recovered and your journal entries will be unreadable

1.3 Dream Interpretation (AI Processing)

When you request a dream interpretation, the text you type is sent to Google Gemini AI for analysis. This is the only moment your dream content exists in plaintext on a server — during the AI processing request. The AI response is encrypted on your device before being saved. We do not store plaintext dream content in our database or logs.

1.4 Metadata (Not Encrypted)

The following metadata is stored without encryption for service functionality:

• Dream symbols (e.g., "snake", "water") — for pattern analysis
• Emotion tags (e.g., "joy", "anxiety") — for trend tracking
• Dream type, date, language preference

1.5 Analytics

We use PostHog for anonymous usage analytics (page views, feature usage). We do not track dream content in analytics. You can opt out by using browser ad-blockers or privacy extensions.

2. How We Use Your Information

• Provide and improve the dream interpretation service
• Generate monthly dream pattern reports (premium users)
• Send monthly report emails (premium users, via Resend)
• Process payments (via LemonSqueezy as Merchant of Record)
• Enforce rate limits and prevent abuse

3. What We Do NOT Do

• We do not sell your personal data to third parties
• We do not use your dream content to train AI models
• We do not share your dream content with anyone
• We cannot read your encrypted dream journal entries

4. Third-Party Services

5. Data Retention & Deletion

• You can delete individual dream entries at any time
• You can export your data as PDF (premium)
• You can delete your entire account from Settings — this permanently removes all your data (CASCADE delete)
• We retain server logs for up to 30 days for security purposes

6. Cookies

• NEXT_LOCALE — stores your language preference (1 year)
• Supabase auth cookies — session management
• AdSense cookies — advertising (third-party)

7. Your Rights (GDPR)

If you are in the EU/EEA, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Delete your account and all associated data
• Export your data
• Object to processing

8. Children's Privacy

Kkumi is not intended for children under 13. We do not knowingly collect information from children under 13.

9. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes via email or in-app notification.

10. Contact

For privacy-related questions, contact us at: privacy@kkumi.app