Security and Data

1Architecture#

1.1 DreamGate is local-first. All data lives in one SQLite database on your phone, and all processing (sorting, speech to text, the rest check, sun times) happens on the phone.

1.2 There is no DreamGate account, no sign-in and no server. The app contains no analytics, advertising, tracking or crash-reporting libraries, and no code that loads anything from the internet.

2The database on your phone#

3Encrypted backups#

3.1 Backups are encrypted-only. The readable journal exists only in memory while the backup is built, and the only file written is ciphertext. Older unencrypted backups can still be restored, but none can be created.

3.2 Your passphrase is the only way in. We can't recover or reset it. Choose one you'll remember, or store it in a password manager.

3.3 What a backup contains. Everything in the database except your saved location, which stays on the phone (see the App Privacy Policy, Table 1).

4Network#

4.1 Android. Release builds don't request the INTERNET permission, so the operating system doesn't allow the app to open network connections at all.

4.2 iOS. iOS has no internet permission to remove. Release builds turn on App Transport Security fully (no arbitrary loads and no local-network exceptions), and the app contains no code that makes network requests.

4.3 Speech recognition runs in the platform's on-device mode only (section 6).

5Permissions#

Blocked or never requested: internet (Android release), precise location, storage read/write, drawing over other apps, contacts, calendar, photos, camera, motion, any health data other than reading sleep, writing to Health, background health delivery, Face ID, background location and tracking (iOS App Tracking Transparency).

6Speech to text#

6.1 The app calls the platform recogniser with on-device recognition required, and with audio recording persistence turned off.

6.2 Before offering voice, the app checks that on-device recognition is available for your language. On Android it checks the on-device service's installed languages. If the check fails, voice stays off with a reason, and there is no cloud fallback.

6.3 The app asks for final results only, with no interim text, and holds them in memory, never in screen state or storage. When you finish, the whole text goes once to the sorter and is stored only as cards, and filing, dropping or deleting a card erases it with SQLite's secure delete and a checked checkpoint.

7Device backups and moving phones#

7.1 Android: the app sets allowBackup to false, so Android's automatic cloud backup and device-to-device transfer don't copy its data.

7.2 iPhone: iCloud and computer backups can include the database file, which stays encrypted. Its key is "this device only", so a backup restored to a different phone can't unlock it.

7.3 To move to a new phone, export an encrypted backup and restore it there.

8Deleting data#

8.1 Delete all data (Settings › Your data) erases every entry, task, record, setting and the saved location, after a confirmation.

8.2 Deleting an entry (from its screen, after an Undo) erases its words, themes and saved notes with SQLite's secure deletion on, in one transaction, and then empties the write-ahead log, so no trace is left in the App's database files or in new backups. A test checks this.

8.3 Delete all data also removes backup files the app left in its own temporary storage, and replaces the database and its encryption key with new ones, so erased data can't be recovered from the phone's storage.

8.4 Deleting the app removes its database file from the phone.

9iOS privacy manifest and app store labels#

9.1 The iOS build includes a privacy manifest that declares no tracking, no tracking domains and no collected data types, and lists the "required reason" system APIs the app's libraries use.

9.2 The app store privacy labels are "Data Not Collected" (Apple) and "No data collected or shared" (Google Play) [TO CONFIRM: answer the store questionnaires before submission and keep these in line].

10The web preview#

A private, unlisted browser preview of the app exists for testing (not linked from this website). It has no on-device speech recognition, and it encrypts its stored data with a non-extractable key held by the browser, which is weaker than a phone's hardware-backed keystore. This page describes the phone apps [TO CONFIRM: describe the web preview here only if it becomes public].

11Reporting a security problem#

If you think you've found a security issue in DreamGate, email security@dreamgate.one. The same contact is published in /.well-known/security.txt. Please give us a reasonable time to fix it before making it public.

12Version history#