Privacy Policy — Moon

Last updated: 7 October 2026 · Version 3.4

1. Our Principles

In short:

• Your entries stay with you — on your device and in your iCloud, not on the Operator's servers; they are encrypted.
• We collect minimal data about you: the entries themselves remain on your device and in iCloud, not on our servers.
• We do not sell your data and do not use it for advertising.
• Statistics and charts are calculated locally on your device.

2. Who We Are

The Operator (the data controller within the meaning of the GDPR) is SIA SCADA, Rīga, Rūpniecības iela 32B - 1I, LV-1045, Latvia, European Union. For privacy matters: hello@moonapp.lv.

This Policy explains what data the Moon application (the "Application") processes, on what basis, to whom it is transferred, and what rights you have.

3. What Data We Process

• Diary entries and mood ratings. Texts, ratings on a 1–7 scale, date and time. Stored locally on your device and in your encrypted iCloud (including an automatic backup file in the Application's iCloud Drive container, which you can restore from or delete in the Application); the Operator does not store them on its servers and cannot access the copies on your device and in iCloud. When you use the AI or voice features, the relevant content passes through the Operator's proxy only in transit to the providers; the content is not stored on the proxy.
• Voice input (optional). If you dictate an entry by voice, the audio recording is transmitted to a speech-recognition provider (OpenAI Ireland Ltd.) solely for conversion to text. The audio is used only for recognition and is not stored by the Operator as separate content; thereafter the recognized text is processed. If you do not use voice input, no audio is recorded. Voice input is unavailable in Local Mode, so no audio leaves the device in that mode.
• Data transmitted for the AI analysis (optional). If you use the AI features, the entry text as written by you, the rating, and the metrics attached to the entry (including Apple Health data, if connected) are transmitted to the AI provider (Anthropic, PBC) solely to generate the analysis. For period recaps (weekly, monthly, and yearly), daily aggregate Apple Health metrics for the analyzed period and the previous period (sleep, workouts, steps) are transmitted as well. The transmission carries no user or account identifiers. Entries created in Local Mode are never transmitted for AI processing — neither as the subject of analysis nor as context for analyzing other entries — and remain only on your device and in your iCloud, even if you later switch back to AI Mode.
• Apple Health data (optional). If you connect Apple Health, the relevant metrics (for example, sleep, activity) are used to enrich entries. We do not transfer them to third parties for their own purposes and do not use them for advertising.
• Purchases and subscriptions. Payments are processed by Apple. The Operator does not receive or store your payment details.
• Technical usage metrics. When you use the AI or voice features, the Operator records numeric usage counters — the number of requests, token counts, voice-recording duration, and the computed cost — linked to a random technical identifier generated in the Application, together with the two-letter country code of the request as determined by the hosting provider from the network address (the address itself is not stored). These counters contain no entry text, no transcripts, and no account data (such as your name, email, or Apple ID), and are used solely for fair-use enforcement and service-cost accounting. This identifier is not transmitted to the AI or speech-recognition providers.
• Activity check-ins. To count how many people keep their diary regularly — in AI Mode and in Local Mode alike — the Application sends the Operator's proxy, at most a few times a day, a short check-in tied to the random technical identifier described above: the calendar dates within the last 14 days on which entries were saved, how many entries on each of those dates were saved in AI Mode and how many in Local Mode, the date of the first entry in the diary, the plan (free, free trial or subscription), the current mode and the Application version, together with the two-letter country code of the request as determined by the hosting provider. A check-in contains no entry text, no mood ratings, no times of day and no health data. Each check-in replaces the previous one and is deleted automatically after 60 days without a new one. Because it concerns only the fact that the diary is used, not what is written in it, it is sent in Local Mode too.
• Anonymous app-usage statistics. The Application reports anonymous usage events to an analytics service (Google Analytics for Firebase, or Google Analytics directly): the fact that the Application was opened, which screens were shown, and which features were used (for example, "an entry was saved", "a recap was generated", "voice input was used", "a backup was made", "a subscription was purchased"), together with technical context — Application version, device model, operating system version, language, and the country or region derived from a masked IP address. These events are tied to a random identifier generated solely for these statistics (it is different from the technical identifier described above and is not linked to it, and it is not the advertising identifier — IDFA and IDFV collection are switched off). These events contain no entry text, no mood ratings, no health data, and no account data: an event records, for example, that an entry was saved, whether it contained text and its approximate size bracket (short / medium / long — never the text itself), how many entries that day already had, roughly how many days had passed since the previous entry, from which screen the entry was started, and the hour of the day (in the device’s local time) at which it was saved, but never what the text or the rating was; the subscription screen reports which day of the free trial it was shown on; and the reminder schedule that is switched on (none, once a day, or four times a day) is recorded so that entry times can be compared with and without reminders. They are used solely to understand how the Application is used and which features matter. These statistics concern only the fact of Application usage — not your entries — and are therefore sent regardless of Local Mode, which governs diary content and AI processing, not anonymous usage counts.
• Apple Ads install attribution. Once, after you accept these terms, the Application asks Apple's AdServices framework whether this installation followed an Apple Search Ads advertisement and passes Apple's answer through the Operator's proxy. Apple returns only identifiers — the advertising campaign, ad group and keyword identifiers, the type of conversion (download or re-download) and the country or region of the App Store — or the fact that there was no advertisement. No advertising identifier (IDFA) is used and no tracking permission is requested. These identifiers, together with the country and the corresponding campaign and keyword names, are attached to the anonymous statistics identifier described above and stored on the Operator's proxy under the technical identifier, so that the Operator can see which advertising brings people who keep using the Application. They are never linked to your entries.
• Support messages (optional). If you write to us from the Application (Settings → Write to us), your message, the e-mail address you enter so that we can reply, and an optionally attached photo are sent through the Operator's proxy to the Operator's mailbox. To help us answer without a back-and-forth, technical details are attached: Application version and build, device model, iOS version, screen size, language and time zone, subscription status (free, trial, or plan), the number of entries, the iCloud sync and Apple Health connection state, and the two-letter country code derived from the request's IP address. The random technical identifier described above is deliberately NOT included, so a support message cannot be linked to the usage counters. A copy of the message, including an attached photo, is kept on the proxy's storage for up to 90 days so that a delivery failure does not lose it, and is deleted automatically thereafter. No diary content is included unless you write it into the message yourself.

4. Legal Bases for Processing (GDPR)

• Explicit consent — Art. 9(2)(a) and Art. 6(1)(a). For processing diary entries, mood ratings, and related special-category data, for transmitting data (without user or account identifiers) to the AI provider, and, when voice input is used, for transmitting the audio recording to the speech-recognition provider. You give consent explicitly and can withdraw it at any time.
• Legitimate interest — Art. 6(1)(f). For the technical usage counters (fair-use enforcement and service-cost accounting) and for the anonymous app-usage statistics described in Section 3: the Operator's legitimate interest is understanding how much the Application is used and keeping its paid AI features economically sustainable. These events carry no diary content and no account data. You have the right to object to this processing at any time by contacting us (Section 2; see also Section 10).

These features are optional and under your control: you can switch the Application to Local Mode in Settings at any time — new entries are then processed entirely on your device and never transmitted for AI analysis — as well as disable access to Apple Health and not use voice input. If you do not use these features, the corresponding processing and data transmission do not take place.

5. How We Use Data

• To provide the Application's features and to generate the AI analysis.
• For support, responding to inquiries, and troubleshooting.
• To ensure the security and improve the operation of the Application.

We do not use your data for advertising, do not sell it, and do not transfer it for third-party marketing. Data transmitted for the AI analysis and speech recognition is not used by the providers to train models by default.

6. To Whom We Transfer Data (Processors)

We engage a limited number of processors acting on our behalf when you use the relevant features:

• Anthropic, PBC (USA) — processing the entry text as written (transmitted without user or account identifiers), rating, and attached metrics to generate the AI analysis. Policy: https://www.anthropic.com/legal/privacy.
• OpenAI Ireland Ltd. (Ireland; processing may also take place in the USA) — converting the voice-input audio recording to text. Policy: https://openai.com/policies/.
• Apple (iCloud, App Store) — storing your data in your iCloud and processing payments. Policy: https://www.apple.com/legal/privacy/.
• Vercel Inc. (USA) — hosts the Operator's proxy, which relays requests for the AI analysis and voice transcription in transit to the respective providers (Anthropic, OpenAI). The content of your entries and recordings is not stored on the proxy; only the numeric usage counters described in Section 3 are stored. Policy: https://vercel.com/legal/privacy-policy.
• Upstash, Inc. (USA) — stores the numeric usage counters described in Section 3 (request counts, token counts, cost totals, voice-input duration, and the request's country code) on behalf of the Operator; no entry content. Policy: https://upstash.com/legal/privacy.
• Resend, Inc. (USA) — delivers the support messages described in Section 3 (message, your e-mail address, the attached photo, and the technical details) to the Operator's mailbox as e-mail. Policy: https://resend.com/legal/privacy-policy.
• Google Ireland Ltd. (Ireland; processing may also take place in the USA) — receives the anonymous app-usage events described in Section 3 (Google Analytics / Firebase Analytics); no entry content, ratings, or health data. Policy: https://policies.google.com/privacy.

7. International Data Transfers

When you use the AI and voice-input features, data (text, ratings, attached metrics, and the voice-input audio recording) may be processed outside the European Economic Area (in particular, in the USA). In such cases, the transfer is safeguarded by appropriate mechanisms — Standard Contractual Clauses approved by the European Commission (SCC), as part of the contracts with the providers.

8. Retention Periods

• Entries and ratings are on your device and in your iCloud and are retained until you delete them. Deleting entries and the Application is under your control.
• Data transmitted for the AI analysis and the voice-input audio recording are, under the providers' current policies, as a general rule deleted from their servers within 30 days, unless longer retention is required by law.
• Technical usage metrics (Section 3) are stored as daily and monthly aggregate counters and are retained for as long as necessary for fair-use enforcement and service-cost accounting.
• Support messages (Section 3) are retained in the Operator's mailbox for as long as needed to handle the request; the copy on the proxy's storage, including the photo, is deleted automatically after 90 days.

9. Security

Data is encrypted in storage on the device and in transit. Storage in iCloud is provided by Apple's infrastructure. Entries are not stored on the Operator's servers, and the Operator cannot access the copies on your device and in iCloud; when you use the AI or voice features, the relevant content passes through the Operator's proxy only in transit, and no content is stored on the proxy (only the numeric usage counters described in Section 3). We take reasonable protective measures; however, no method of transmission or storage on the internet is absolutely secure.

10. Your Rights

Because entries are stored with you (on your device and in iCloud) rather than on the Operator's servers, you exercise access, rectification, deletion, and portability directly in the Application — you view, edit, delete, and export entries, and you can delete them together with the Application and the iCloud copy.

With respect to the processing carried out by the Operator (the AI analysis and speech recognition on the basis of your explicit consent), you have the following rights under the GDPR:

• access to the data;
• rectification or erasure;
• restriction of, or objection to, processing;
• portability;
• withdrawal of consent at any time — in the Application's settings and, for features with system permissions (microphone, Apple Health), also in your device settings. After withdrawal, the corresponding features become unavailable, the lawfulness of processing already carried out is not affected, and data already transmitted to the providers is, as a general rule, deleted by them within 30 days.

11. Residents of the USA and Other Countries

Because the Application is available worldwide, you may have additional rights depending on your jurisdiction. We do not sell or share your personal data within the meaning of US privacy laws (including California's CCPA/CPRA). Residents of certain US states have the right to request a copy, deletion, or correction of their data and not to be discriminated against for exercising these rights. Because entries are stored with you on your device, you exercise most of them yourself in the Application.

12. Children

The Application is intended for persons aged 16 and older and is not directed to children under 16. If you are under 16, you must not use the Application unless this is permitted by applicable law and authorized by your parent or legal guardian.

13. Changes to the Policy

We may update this Policy. You will be notified of material changes through the Application. The Operator determines, at its reasonable discretion, which changes are material. Continued use after the changes take effect means acceptance of the updated Policy.

14. How to Contact Us

For privacy matters and exercising your rights: hello@moonapp.lv.