Security

Your conversations, your dreams, and what you report back on your challenges, with Shadowmark’s replies, are encrypted in the database. Stored records hold ciphertext, not plain text. Content is decrypted only to serve it back to you.

Access is enforced at the database level: every row is scoped to its owner, so one account can never read another’s data.

Everything travels over HTTPS between your device, our API, and the database.

To answer you, the relevant part of your conversation is sent to AI models from Anthropic and Google, through Vercel’s AI Gateway with zero data retention: neither the gateway nor the providers store the prompt or the reply, and your words are never used to train models. This holds for every reply, including dream analysis and the quiet background work that personalises the experience. The Privacy page lists what is sent.

Data is stored in the EU, Shadowmark’s servers run in the EU, and the AI models that write replies run in EU data centers. Nothing about you is sold or used to target ads.

Deleting your account permanently removes your conversations, dreams, challenges and their reports, and profile. There’s no shadow copy waiting around.

Responsible disclosure is welcome at security@shadowmark.app.