Legal
Privacy Policy
Last updated: October 6, 2026
Who we are
The Service is operated by Master Sanker LLC.
1. Scope
This Privacy Policy explains what personal data Dreamaster, operated by Master Sanker LLC, collects through our website and app, why we collect it, who we share it with, and the choices and rights you have. It applies wherever you access the Service, and is written to meet the requirements of major global privacy frameworks (including the EU/UK GDPR and the California CCPA/CPRA), so your rights below apply to you regardless of where you're located, to the extent applicable local law grants them.
2. Information We Collect
Account data: name, email address, and password (stored as a salted hash, never in plain text) or, if you sign in with Google, your Google account identifier and profile info. Content you create: goals, sub-step plans, journal entries and mood tags, AI coach messages, Daily Big 3 entries, Business DNA and career assessment answers, and the work history, education, and achievements you type into the CV builder. Voice input: if you use the microphone in a chat, a short audio recording, used only to turn it into text (see Section 4) and not saved. Member Network and Community: the display name you choose (shown to other members with a short tag), the profile details you choose to make discoverable, your Community posts, your private Messages, and your blocks and reports. Moderation records: automatic word warnings, temporary mutes, and actions our team takes on messages (see Section 16). Billing data: your subscription plan, period and status, the payment method you used, and a record of each successful payment (provider, amount, currency, plan, period, date, and the payment processor's reference); card and payment details are collected and processed directly by our payment processors, and we never see or store your full card number. Usage and device data: pages visited, in-product activity events (such as which features you use) stored against your account, browser type, and approximate location (via IP), collected automatically. Referral and campaign data: if you arrive through a referral link, the referral code (kept in a cookie for 30 days and stored against your account at signup); if you accepted marketing cookies, the campaign tags of the link you arrived through (such as utm_source), stored against your account at signup. Communications: messages you send us via the Contact page or support email. Contact details: if you fill in the form shown after the Business DNA questionnaire and before payment, your full name, phone number and field of work, together with two separate permissions you may tick or leave empty (to contact you with updates and offers, and to pass your details to selected partners for their own marketing), the version of the wording you saw and when you gave the permission.
3. How We Use Your Information
To provide the Service: create and secure your account, save your content, and run features like goal tracking, journaling, Business DNA, Mastery progression, the Community and Messages, and the downloadable CV (PDF) you ask for. To power AI features: send relevant context (your goals, journal entries, and coaching history) to our AI providers so they can generate coaching responses, plans, and insights. To process payments: through our payment processors. To communicate with you: service emails such as email verification and password resets. We contact you for marketing, and pass your details to partners, only if you ticked the matching permission on the contact-details form, and you can withdraw either at any time from the Contact page; without the permission we send no marketing or product-update email. Billing receipts, if any, come from our payment processors. To keep the Community and Messages safe: automatic word warnings, temporary mutes, review of member reports, and enforcement of our Terms. To improve the Service: aggregate usage analysis. To protect the Service: fraud and abuse prevention, security monitoring. To keep financial records: our payment records, for accounting and tax. To comply with law: responding to legal requests and enforcing our Terms.
4. AI Processing and Your Data
The messages you send, your goals, and the context needed to answer you (such as your recent journal entries and coaching history) are sent to third-party AI providers to generate Master Sanker AI's and your coaches' replies, your plans, your Daily Big 3, and our other AI features (for example Business DNA refinement, the career assessment, and the optional "Improve wording" tool in the CV builder, which sends only the one CV field you ask it to reword). Master Sanker AI and your coaches are AI, not people. We currently use Groq for most chat replies and for speech-to-text, Google (Gemini API) for our other AI features and as a fallback, and OpenRouter as a further fallback when the others are unavailable. Each provider processes that content under its own terms and privacy policy, so please avoid including information you would not want a service provider to process. Voice input: if you use the microphone in a chat, your recording is sent to Groq to be turned into text. We hold the recording in memory only for that request and do not save it or write it to our logs; the text is then sent as your message and stored like any other message. Voice output: if you use Voice Mode, the text of Master Sanker AI's reply (English replies only) is also sent to ElevenLabs to generate synthetic speech, and the resulting audio is stored with that reply. We do not use your personal content to train any AI model ourselves. Besides your messages and goals, the context sent for a reply can include your name, your profile bio and your onboarding answers. Providers set their own terms for the plan we use with them. In particular, the unpaid tier of Google's Gemini API allows Google to use submitted content and responses to improve its products and to have them reviewed by people, and we use that tier at times; a paid tier does not. If that matters to you, avoid putting sensitive personal information into your messages, and read each provider's own terms.
5. Cookies and Similar Technologies
We use strictly necessary cookies to keep you signed in and to remember your interface language; these cannot be disabled without breaking the ability to log in. Your cookie choice itself is kept in your browser's local storage. With your consent, given via the cookie banner on first visit, we also load Google Analytics and the Meta Pixel for aggregate usage and marketing-effectiveness measurement - these do not load until you accept, and you can withdraw consent at any time from the Cookie Policy page (scripts already loaded are removed and the analytics cookies we can see are cleared straight away). When you accept, we also set a signed security cookie as proof of your choice, and page views and contact-form submissions are relayed from our server to Meta: your IP address and browser details, and, for a contact submission, a hashed (SHA-256) version of the email you entered and the topic you chose (never your message), so Meta can match them; nothing is relayed if you decline. We also set a referral cookie when you follow a referral link (?ref=...), a short-lived sign-in state cookie while you use Google sign-in, and a small security cookie that lists, as one-way codes, which accounts have signed in on this browser so that nobody can earn referral rewards by referring themselves; it contains no personal data. See our Cookie Policy for the full list of cookies and how to manage them.
6. How We Share Your Information
Except for the partner permission described below, we do not sell your personal data or share it for cross-context behavioral advertising in the sense prohibited by CCPA/CPRA. We share data only with: selected marketing partners, but only your name, email address, phone number and field of work and only if you ticked the partner permission on the contact-details form (withdrawing it stops future sharing, and we will ask partners who already received your details to stop using them); service providers who process it on our behalf under contract - Groq, Google, and OpenRouter (AI text generation; Groq also converts microphone recordings to text), ElevenLabs (synthetic voice, only when you use Voice Mode), Stripe and Dodo Payments (card and other payments), NOWPayments (cryptocurrency payments), Resend (transactional email delivery), Railway (hosting), and Backblaze (storage of our encrypted backups, which it cannot read); analytics/advertising partners - Google Analytics and Meta, but only for users who consented to non-essential cookies; other Dreamaster members, to the extent you use the Member Network (your display name and tag, your Community posts, the profile details you chose to make discoverable, and any private Message you send to someone); and legal/safety recipients where required to comply with law, enforce our Terms, or protect rights and safety. If we're ever involved in a merger, acquisition, or asset sale, your data may transfer as part of that transaction, subject to this Policy.
7. International Data Transfers
Because we and our service providers operate internationally, your data may be processed in countries other than the one you're located in, including countries whose data protection laws may differ from your own. Where applicable law requires it, we rely on appropriate safeguards for such transfers, such as standard contractual clauses or equivalent mechanisms offered by our providers.
8. Data Retention
We retain your data for as long as your account is active. You can delete your account yourself (Settings → Privacy → Delete account) once any paid subscription has been cancelled; while a paid subscription is active we ask you to cancel it first so you are not billed for an account that no longer exists. Deletion removes your data from our live production database immediately - this is not a soft delete - including your profile, goals, journal, coach conversations and voice clips, assessments, CV details, Member Network profile, Community posts, private conversations, moderation records, and any Contact-page messages sent from the same email address. Copies may persist in backups or logs that we keep for disaster recovery; they are not used for any other purpose and are overwritten as older backups are rotated out, which takes up to 12 months for encrypted off-site backups. What we keep after deletion: a record of each payment (provider, amount, currency, plan, period, date, the payment processor's reference, and an internal account reference, but no name or email), for as long as required by applicable tax and accounting law; records of affiliate commissions (an amount, a currency and a month, with no name or email), which are financial records referenced only by a one-way code; voice usage accounting, with the link to you removed; and our administrator audit entries about the account, rewritten so they no longer contain your details. Our payment processors keep their own records under their own terms, and cryptocurrency transactions are recorded on public blockchains, which neither we nor you can alter or delete. When an automatic word warning blocks a Community message, the blocked text is kept for 90 days as evidence for our team and then removed; the rest of that warning record (the time, the matched rule, and the outcome) is kept while your account exists. For a deleted or closed account, 12 months is the default maximum period for which any remaining copy of your personal data is kept (for example in backups), and we do not promise deletion at exactly that point where data must be kept longer for legal or technical reasons. Payment and accounting records are kept for as long as the law requires, and security, fraud-prevention and audit records may be kept longer where reasonably necessary. While your account is active, we keep the data needed to provide the Service.
9. Your Rights
Depending on where you live, you may have the right to: access the personal data we hold about you; correct inaccurate data; delete your data; receive a portable copy of your data; restrict or object to certain processing; withdraw consent (for anything based on consent, like non-essential cookies) without affecting past processing; and, in California, know what categories of data we've collected and not be discriminated against for exercising these rights (note: we don't sell data, so there is nothing to opt out of in that respect). Exercise most of these directly from Settings → Privacy, or email contact@dreamaster.app - we'll respond within 30 days or sooner where local law requires. You can download a copy of your data yourself, anytime, from Settings → Privacy → Export your data. That file covers your profile, settings, goals, Daily Big 3, journal, coach conversations, challenges, assessments, referral data, and activity. For anything it does not cover (such as your CV details, your Member Network and Community content, and your payment records), email us and we will provide it within the same 30 days. Access to, or a copy or export of, the personal data we support is provided subject to legal, security and technical limitations (for example, we may need to confirm your identity, and some records cannot be exported in full).
10. Data Security
We encrypt data in transit via TLS, hash passwords with bcrypt, scope database access to what each part of the Service needs, and set strict security headers (including a nonce-based Content-Security-Policy) to reduce injection risk. No system is perfectly secure, and we encourage you to use a strong, unique password and enable your device's own security features.
11. Children's Privacy
The Service is not directed to, and we do not knowingly collect personal data from, anyone under 18 - or under the higher minimum age that applies where you live, if local law sets one. Age verification relies on the user's own representation at signup (see our Terms); we do not independently verify age. If you believe a child has used the Service or provided us data in violation of this Policy, contact contact@dreamaster.app and we will delete it.
12. AI-Generated Content Is Not Verified by Us
Data we hold about you (goals, journal entries, coaching history) is used to generate AI output, but that output is produced automatically by a third-party model and is not reviewed, fact-checked, or approved by Dreamaster before you see it. We process your data to generate this output but do not warrant its accuracy; see our Terms of Service for the full disclaimer and limitation of liability governing AI-generated content.
13. Changes to This Policy
We may update this Policy as the Service or applicable law changes. For material changes we will notify you by email, an in-app notice or another reasonable service notice, and we will state the date on which the change takes effect. The "Last updated" date shows when the current version was published. We do not treat your silence as consent where applicable law requires your active consent.
14. Contact
For privacy questions or to exercise your rights, email contact@dreamaster.app or use our Contact page.
15. Internal Access by Authorized Personnel
Content you submit through the Service - including Business DNA assessment answers, CV/Resume information, messages to Master Sanker AI and specialist coaches, Member Network profile and messages, and Daily Big 3/goal entries - is not visible to other users except where you explicitly choose to share it (for example, a Member Network profile you make discoverable, or opting in to Business DNA Opportunity review). It is, however, stored on our systems and may be accessed internally by authorized Dreamaster personnel for legitimate purposes: operating and supporting the Service, responding to support requests, investigating safety or policy violations (such as abuse reports between Member Network users), troubleshooting technical issues, maintaining security, and improving the Service. Internal access is role-restricted, requires authenticated administrator sign-in with its own security controls, and sensitive actions (such as viewing a user's AI coaching conversation) are logged. This does not change who we share data with externally - see Section 6.
16. Community, Messages, and Moderation
The Member Network lets members find each other and talk. In the Community, your posts appear to other Dreamaster members next to the display name you chose and a short tag, never your account name or email; a member who never chose a display name appears only as "Member." A private Message is visible to the member you send it to and is stored in our database. You can block and report members. To keep these spaces safe, our system compares Community posts and display names with a list of words and phrases that our team manages. If a Community post uses wording that is not allowed, it is not posted and you receive an automatic warning, and repeated warnings lead to a temporary mute from posting in the Community (private Messages keep working). We record each warning with the time, the rule that matched, and the outcome; the blocked text itself is kept for 90 days for our team's review and then removed. Our team can also warn members and hide or remove messages, including after member reports, and we keep a record of those actions. Hidden or removed messages are not shown to members but stay in our records until the author's account is deleted. If you believe a warning, mute, hidden message or removal was a mistake, you can ask us to review it at contact@dreamaster.app. We will consider the request, but a review does not guarantee that the action will be reversed.