Guno — Privacy Policy

Last updated: 26 July 2026 Version: 2026-07-26

Guno is operated by Guno, Türkiye, reachable at yusufali.cezik@hotmail.com. For the purposes of the GDPR and the Turkish KVKK we are the data controller for everything described below.

This policy is written to be read, not to be survived. If anything here is unclear, write to us and we will answer in plain language.

1. The short version

There is no account. No name, no email, no phone number, no date of birth.
Your dreams are stored on our server under a random identifier created on your device.
Dream text is sent to our AI provider (OpenAI) to produce a reading. It is not used to train any model.
Every dream is screened automatically for signs of danger before and after a reading. No human reads your journal.
You can download everything we hold, or delete all of it, from inside the app.
Guno is entertainment. Nothing in it is medical, psychological, legal, financial or religious advice.

2. What we collect

Data	Why	Legal basis (GDPR)
Random device identifier (UUID) generated on first launch	To keep your dreams and credits attached to you without an account	Art. 6(1)(b) — performance of the contract
Dream text, mood, tags	The service itself: producing and storing readings	Art. 6(1)(b)
Readings and chat messages	To show your history and continue conversations	Art. 6(1)(b)
Credit balance, purchase records (Apple transaction ID, product ID)	To grant what you paid for and prevent duplicate grants	Art. 6(1)(b), Art. 6(1)(c) — accounting obligations
Consent record (version, timestamp, language)	To prove you were asked and what you agreed to	Art. 6(1)(c)
Safety events (category of the trigger, timestamp, no dream text)	To keep the safety system honest and auditable	Art. 6(1)(f) — legitimate interest in user safety
Technical logs (request time, model used, token counts, latency)	To run and pay for the service	Art. 6(1)(f)
A one-way hash (SHA-256) of the device identifier	To give the opening credit granted to a new account once per device	Art. 6(1)(f)
Language preference	To answer in your language	Art. 6(1)(b)
App usage events (which screen, which voice, whether a reading succeeded, purchase totals) and crash reports (device model, iOS version, stack trace)	To see what breaks and what nobody uses	Art. 6(1)(f) — legitimate interest in a working app

Because the content of a dream can incidentally reveal things like health, beliefs or sexual life, we treat all dream text as if it were special category data under Art. 9 GDPR. It is processed only on the basis of your explicit consent (Art. 9(2)(a)), collected in the consent gate before your first reading, and you can withdraw it at any time by deleting your data.

What we do not collect

Name, email address, phone number, contacts, photos, precise location, IDFA or any advertising identifier, health data from HealthKit, or anything from other apps. We run no advertising SDKs and no ad tracking of any kind.

Never sent to analytics. Your dream text, your chat messages and the readings themselves never leave our own servers for measurement purposes. What the analytics tool receives is the shape of a session — a voice was opened, a reading took eleven seconds, a purchase completed — never a word you wrote.

3. Children

Guno is not for children. You must be 18 or older to use it, and you confirm this before the first reading. We do not knowingly process data from anyone under 18. If you believe a minor is using the app, write to yusufali.cezik@hotmail.com and we will delete the account.

4. How readings are produced (AI disclosure)

Readings and chat replies are generated by a large language model operated by OpenAI, L.L.C. When you ask for a reading, the following leaves our server: the dream text, the mood you selected, the language detected, and the persona instructions. Your device identifier is not sent — the provider cannot link the text to you.

We use OpenAI's API under its business terms. API inputs and outputs are not used to train OpenAI models.
OpenAI may retain API data for a limited period for abuse monitoring, after which it is deleted. Where our agreement provides for Zero Data Retention, no copy is retained at all.
OpenAI processes data in the United States. Transfers rely on the EU Standard Contractual Clauses; for KVKK purposes your explicit consent to this transfer is taken in the consent gate.
The output is machine-generated fiction about symbols. It is not a diagnosis, a prediction or professional advice, and it can be wrong, strange or unhelpful.

5. Automated screening and content moderation

This section describes exactly what the safety system does, because you have a right to know that your dream is machine-read before it is answered.

Before a reading is produced, the text passes two checks:

A pattern check that runs on our own server, looking for wording associated with self-harm, suicide, abuse, eating disorders, intent to harm others, sexual content involving minors, and instructions for serious crimes. The patterns cover multiple languages.
OpenAI's Moderation API, a free classification service. Only the dream text is sent; it is not used for training.

After a reading is produced, the output is checked again for statements that overstep what this app is allowed to say — medical or psychiatric claims, predictions presented as certain, and religious pronouncements.

What happens on a hit:

If the text suggests you may be in danger, the reading stops and the app shows a pre-written support message with helplines. No credits are charged. No automated report is made to anyone, and no authority is contacted.
If a generated reading breaks the rules, it is discarded and regenerated or replaced by a neutral message. You are not charged for a discarded reading.
We log that an event happened: its category, the time, and the account identifier. The dream text itself is not copied into the safety log.

These are automated decisions in the sense of GDPR Art. 22, but they do not produce legal or similarly significant effects: the only consequence is that a piece of entertainment content is withheld and support information is shown instead. You can ask us to review any such decision at yusufali.cezik@hotmail.com.

No human at Guno reads your dreams as a matter of course. We access individual records only when you ask us to (for example a support request), when required by law, or to investigate a specific security incident.

6. Who else sees your data

Recipient	What they get	Where
OpenAI, L.L.C.	Dream text, mood, language, persona prompt. No identifier.	USA
Our hosting provider (Fly.io, Inc.)	Encrypted server storage of the database	Frankfurt, Germany (EU)
Apple	Purchase transactions. Apple never sends us your name or Apple ID.	Global
Google (Firebase Analytics and Crashlytics)	Usage events and crash reports, tied to the same random account id. No dream text, no messages, no readings.	USA / EU
Google (Firebase Cloud Messaging)	A notification token issued by Apple to your device, only if you allow notifications. We never store it and we cannot send a notification to one person.	USA / EU

We do not sell data, share it with advertisers, or use it to build profiles for marketing. There is nothing to sell — we do not know who you are.

7. How long we keep it

Dreams and readings: until you delete them, or until you delete your account.
Follow-up conversations: 12 months after the last message, or sooner if you delete the dream. The reading itself stays.
Purchase records: kept for the period required by tax and accounting law (typically 10 years in Türkiye), stripped of any dream content.
Safety event logs: 12 months.
Technical/usage logs: 90 days.
Consent records: for as long as the account exists, plus 3 years, because they are the evidence that we asked.
The one-way hash of the device identifier: indefinitely. It is the only way to know that a device has already had its opening credit. It holds no dream and no identity, and it cannot be reversed.

An account that has not been seen for 24 months is deleted along with its contents.

8. Your rights

Under the GDPR (Art. 15-22) and KVKK (Art. 11) you may:

Access everything we hold — in the app: You → Privacy & data → Download a copy of my data. You get a JSON file, immediately, without asking us.
Erase everything — in the app: You → Privacy & data → Erase my data. This deletes the account, dreams, readings, chats, credits and ledger from the server immediately and irreversibly. Unused credits are not refundable. All that remains is the one-way hash of the device identifier, which stops the opening credit from being claimed again and does not identify you.
Withdraw consent — erasing your data withdraws it. Withdrawal does not affect processing that already happened.
Rectify, restrict or object to processing, and to receive your data in a portable format (the export above is that format).
Complain to a supervisory authority: your local EU/EEA DPA, or in Türkiye the Kişisel Verileri Koruma Kurumu (KVKK).

Because we hold no contact details, we cannot identify you outside the app. That is the point — but it also means rights requests are exercised through the app itself, or by writing from the device in question to yusufali.cezik@hotmail.com.

9. Security

Traffic is encrypted in transit (TLS). The database sits on an access-restricted server; disk-level encryption and off-site encrypted backups are enabled. API keys never reach the app — the device talks only to our backend, and the backend talks to the AI provider. Sessions use short-lived signed tokens tied to the device identifier held in the iOS Keychain.

No system is perfect. If we discover a breach affecting your data we will publish a notice in the app and notify the relevant authority within 72 hours as required by Art. 33 GDPR.

10. Changes

If we change this policy in a way that matters, the app asks you to read and accept it again before your next reading; the version number at the top is what your account is checked against.

Contact: yusufali.cezik@hotmail.com