Privacy

What we store, and why

Last updated 23 October 2026. Written to be read.

If you visit a site that uses a widget

A DreamWidget on someone's site loads from our CDN. We count page views on this site by page and referring site, with no cookie and nothing that identifies you. A widget sets no cookie and does not identify you. Unless you type something into it (below), we keep nothing about you. The widget counts that it was shown, that a logo was clicked, or that a video was played, as a number against that widget, with no address, no browser detail and no visitor identity attached. Those counts are what the widget's owner sees as "views" and "clicks".

If you sign up through a widget: a Popup or an Announcement bar can carry a signup form, and only when its owner has switched on Collect email addresses. When you send it, we store what you typed (your email address and, if the form asks, your name), the address of the page you sent it from without anything after a ? or #, and when you sent it. We keep it for the owner of the site that runs the widget, who sees it on their Signups page and can download it, and we email them the new address once, through our email provider Resend. To stop a form being sent over and over, we also keep a scrambled, one way form of your network address with the times of your sends in the last hour; it cannot be turned back into the address. All of it stays until the site's owner deletes your row from their Signups page, deletes the widget, or deletes their DreamWidget account, and each of those removes it at once. To have it removed, ask the site's owner, or write to us at hello@dreamwidget.com with the address you used and we will delete it. What the site's owner does with the copy they downloaded or were emailed is theirs to answer for.

Notes kept in your own browser: a few widget settings keep a small note in your browser's storage on that site, never sent to us: that you closed a popup, so it stays closed for as long as the site chose; that you closed a Showreel's moving words, for the rest of that visit; and the date you first saw the widget, when the site shows it only to new or only to returning visitors. Clearing your browser's site data removes them.

Videos play in the player of the platform they are on, YouTube, Vimeo, Twitch or TikTok, and when you press play that platform's own privacy terms apply to what it does. We use YouTube's "no cookie" player address. Nothing plays until you press play.

If you have an account

What we store: your email address and sign-in, which plan you are on, the widgets you make and everything in them, the logos, photos, videos and fonts you upload (kept in your account's library, so any of your widgets can use them), and, if you paste one, your YouTube Data API key, kept privately against your account and never included in a published widget.

Billing by card: card payments are taken by Lemon Squeezy, our merchant of record. Their checkout receives your email address, an account number that ties the order to your DreamWidget account, and the card and billing details you enter, and they hold your card and your invoices under their privacy policy. We store what they tell us about your subscription, its plan, status, renewal date and the last four digits and brand of the card, so the account page can show it, and never the card number.

Billing in crypto: paying from the account page in XRP, HBAR, SOL or USDC goes through NOWPayments. They receive the price in dollars, the coin you chose, an order number and the plan's name, never your email address, and your wallet sends the payment to an address they give, so they see the paying wallet and the transaction, under their own privacy policy. We keep the order: your account, your email address, the plan and term, the coin and the amount paid.

Paying by x402 (for programs): a plan bought through our API by x402 is checked and settled on its network by a facilitator: Coinbase for USDC on Base and USDC on Solana, t54 for XRP on the XRP Ledger, and AMNT for HBAR and USDC on Hedera. Each receives only the signed payment: the paying wallet, the amount, our receiving address and the network, never an email address. The payment itself is public on that network, as every on-chain payment is. We keep the payment, the plan and the account it went to, including the email address the program gave us for it.

Where it lives: accounts and widget settings in Google Firebase (Google Cloud, United States); published widgets, your uploaded files and the counts in Cloudflare's network; card payment records at Lemon Squeezy, crypto payments at NOWPayments, and emails sent through Resend. Each of them is a processor acting on our instructions. We do not sell or share your data with anyone else.

Emails: we send the emails an account needs: sign-in links, password resets, a notice when your email changes, a note when a visitor signs up through one of your widgets, receipts from Lemon Squeezy, and a reminder a week before a crypto term ends. We send them through Resend. No newsletter unless you ask for one.

Cookies on this site: the sign-in cookie that keeps you signed in to the dashboard, and nothing else.

Connected accounts (TikTok, Instagram): if you connect a TikTok or Instagram account so a widget can show its videos or posts, that platform gives us a token for the account. We use it to read the account's public profile (name, picture, handle, follower and post counts) and its public videos or posts, and nothing else: we never post, edit, delete or read messages. We store the token, the profile, and the posts we display, against your account. Tokens are renewed in the background for as long as the platform allows. Press Disconnect in the editor and we take the posts and profile out of every widget, tell the platform to cancel the permission, and delete the token and everything we held from it; deleting your DreamWidget account does the same. You can also remove DreamWidget from inside the platform's own settings, and we treat that as a disconnect. Full instructions: how to delete your data.

How long, and how to delete it

As long as your account exists. Cancelling or downgrading a plan deletes nothing: your widgets stay with your account, drawn under the free plan's limits, so they are there if you come back. Delete the account from its settings page and everything goes at once: every widget, everything published, every signup your widgets collected, every file you uploaded, your statements and your sign-in. Sites still embedding a widget show nothing where it was. Lemon Squeezy keeps invoices for the period tax law requires; that is theirs to keep, not ours. Counts are kept for ninety days and then fall away on their own.

If a paid plan ends, we may email you up to three times over the following year to say your widgets are still here. Every such email has a link that stops them at once. Emails you ask for yourself, such as a password reset, are not affected.

Your rights

You can see everything we hold on the account page and in your widgets, change it there, export a widget's settings from its editor, and delete the account yourself. For anything else, including a copy of your data or a correction, email us and we will answer within a week.

Contact

DreamWidget is run by its owner. Write to hello@dreamwidget.com, or reply to any email we have sent you.

DreamWidget
5642 E La Palma Ave, Ste 106 PMB 2020
Anaheim, CA 92807
United States