日本語 · ภาษาไทย · 한국어 · Bahasa Malaysia

moon made me — Privacy Policy

Effective Date: October 1, 2026
Last Updated: October 1, 2026
Version: 2.0

The short version (plain language)

moon made me is built around minimal data collection. Here's what matters most. We wrote this part in simple words so that younger users can understand it too.

What we DON'T collect

• No password (you sign in with Apple, Google, or an email magic link)
• No GPS or precise location, and no contacts, photos, calendar, or browsing history. (The Android app checks only which country your internet connection comes from, to open the right online store. We don't keep that on our servers.)
• No date of birth or age
• No advertising ID (IDFA / GAID) — we do not track you across apps
• No behavioral advertising profile
• No third-party programmatic ads in the app (some screens show product picks we choose, which may earn us a commission)

What we DO collect

• Your chosen first name or nickname
• Your guide preferences (avatar, name, tone, notification time)
• Your timezone (detected from device, stored to keep your daily reset on local midnight)
• Your email address — if your sign-in provider returns one. With email magic link, you give it to us directly. With Apple Sign In or Google Sign In, your provider passes it (or, in Apple's case, a private-relay address if you choose "Hide My Email") to Firebase Authentication. In all cases it is stored only in your authentication record and is deleted on account deletion.
• The last time you opened the app, so we can detect inactive accounts and stale data
• Which daily note (whisper) you saw on which date (so we don't repeat it within 365 days)
• Product card taps. We record them in our own database. Store links include our affiliate tag, but we do not attach your name, email address, account ID, or a reference identifying your individual click.
• The short note you write when you seal a letter in the Echo Well (up to 100 characters) — held until the arrival date you chose, then shown back to you. No other user can read it.

What we DO with it

• Show you a daily note matched to your tone
• Send a daily push notification (only if you opt in) and up to three return-reminder ("Reminders") notifications at 3, 7, and 15 days of inactivity (Reminders are service notices, not marketing; they are on by default and can be turned off in Settings → Reminders)
• Match product recommendations to the day's mood, from the online store for your region
• Hold your sealed letters until their arrival date and tell you when one arrives
• Improve the app using usage records linked to your account (see §2.2)

What we DON'T do

• Sell your data
• Share with advertising networks or data brokers
• Use your data for cross-context behavioral advertising
• Share with anyone beyond the service providers and stores listed below

If you are under 18 (or under 20 in Thailand)

• Please ask a parent or guardian before you use the app.
• Please don't write private things like health, religion, or other people's secrets in your sealed letters or feedback.
• You (or your parent) can ask us any time to show, fix, or delete your information. Just email contact@hasia.ai.
• If you think something went wrong with your information, tell a parent or guardian and email us. If we have a problem that puts your information at risk, we will tell you when the law requires it.

The detailed policy follows. In any conflict between this summary and the detailed sections, the detailed sections control.

1. Introduction

moon made me ("we", "us", "our") operates the moon made me mobile application (the "Service"). This Privacy Policy describes how we collect, use, share, and protect information when you use the Service.

Who is responsible for your information (the "controller"): Hasia Co., Ltd., 108-1, Gasan Mobius Tower, 169-23 Gasan digital 2-ro, Geumcheon-gu, Seoul, 08504, Republic of Korea. Contact and Data Protection Officer: contact@hasia.ai (see §15).

This Policy covers all versions of the App. The same feature can have a different name depending on the version of the App you use:

Taps on product cards are recorded as rows in our product_clicks table rather than as a named event.

We do not treat your use of the Service as consent. We process your information on the legal bases set out in §3.1. Where we rely on consent, we ask for it separately, and you can withdraw it at any time.

Part of this Policy applies only in certain countries — see §13 Region-specific privacy information (United States, EEA/UK, Japan, Philippines, Malaysia, Thailand, India, Switzerland, Hong Kong, Pakistan, Sri Lanka, South Africa, Nigeria, Kenya, Republic of Korea). This Policy is available in English, Japanese, Thai, Korean, and Bahasa Malaysia. If a translation conflicts with the English version, the English version prevails, except where local law requires the local-language version to prevail.

2. Information We Collect

Where it comes from: (a) you, when you type it in; (b) your device and the app, automatically, while you use the Service; and (c) your sign-in provider (Apple, Google, or Firebase magic link), which passes us an identifier and, if it returns one, your email address. We do not buy information about you from anyone, and the stores you visit through product cards do not send us your purchase or account data.

2.1 Information You Provide

During onboarding and in Settings, you may provide:

Please don't put sensitive information in free text. Feedback and sealed-letter notes are free text. Please do not include health information, religious or philosophical beliefs, other sensitive information, or other people's personal information. If you do, we store it only to give it back to you (letters) or to read it (feedback); we do not analyze it or use it for any other purpose.

2.2 Information Collected Automatically

When you use the Service:

2.3 Information We Do NOT Collect

To be explicit, we do not collect or access:

• Password, password hashes, or biometric credentials (sign-in is performed entirely by your chosen provider — Apple, Google, or Firebase email magic link)
• Precise or approximate device location from GPS, Wi-Fi, cell towers, or the device's location services. We do not ask for location permission. The only location-related information we use is the country described in §2.4 — never your city, area, or coordinates
• Contacts, calendar, photos, or media library
• Device motion, health, fitness, or biometric data
• Microphone or camera input
• Browsing history outside the App (including what you look at or buy in a store after tapping a product card)
• Advertising identifier (IDFA on iOS, GAID on Android) — we do not request App Tracking Transparency permission
• SMS, call logs, or any messaging content
• Financial account information or payment card data (the App has no in-app payments as of this version)
• Date of birth or zodiac sign — earlier versions asked for these during onboarding; we no longer collect them, and all values collected earlier have been permanently deleted, with no backup copy retained

2.4 Country lookup and store links (how store links work)

Which store you see. We choose the store by region, not by language (see Terms §6.1).

• iOS: the app reads your device's region setting (Settings → General → Language & Region). Nothing is sent to us for this.
• Android: Android does not have a separate region setting, so the app asks moonmademe.com/geo. Our Cloudflare Worker reads the country code that Cloudflare derives from your IP address for that request and sends it back. We do not store the result, or your IP address for this purpose, on our servers (the response is marked not to be cached). The app keeps the country on your device for 24 hours. If the lookup fails, the app falls back to the country in your device's language setting. The country is used only to choose the store; it is not used for advertising or to build a profile.

Because each product in our catalog belongs to one store, your product click records show which store you were sent to.

What the link carries. When you tap a product card, the app records the click in our database and opens our redirect at moonmademe.com/r/{product_id}. The redirect adds only our own affiliate identifiers (for example our Amazon tag) and sends you to the store or affiliate network. We do not send any identifier of you or of your individual click — no name, email address, account ID, or per-click reference. Sales reports we receive from affiliate programs therefore show totals by product and date, not by user. We do not receive your purchase details, order contents, or store account information.

Separately from anything we send, when your device opens a store link the affiliate network and the store receive what any website receives — for example your IP address and browser/user-agent information at their redirect pages — and may set their own cookies. If you are signed in to a store, the store may connect your visit to your store account under its own privacy policy. See §4 and §10.

2.5 What you must provide, and what is optional

3. How We Use Information

We use your information to:

• Deliver daily content: select a daily note aligned with your chosen guide and tone preference, ensuring no repetition within a rolling 365-day window
• Send notifications: if you opt in to push, schedule local push notifications at your chosen time. By default we additionally schedule up to three return-reminder ("Reminders") notifications at days 3, 7, and 15 of inactivity to invite you back; you can disable Reminders independently in Settings → Reminders without turning off your daily push.
• Match products: choose product recommendations for the day's mood, from the store for your region (§2.4), based on internal keyword tags
• Pay and measure affiliate commissions: read the programs' sales reports, which show totals by product and date
• Operate your account: sign-in, preference updates, and deletion
• Deliver sealed letters: hold the note you wrote in the Echo Well until the arrival date you chose, send a notification when it arrives, and show it back to you
• Improve the Service: in-app analytics events (stored in Supabase with your Firebase UID, see §4) to understand feature usage, onboarding completion, and content-sharing patterns
• Understand product and content effectiveness: product impression, click, and return-timing events help us evaluate which products resonate with each mood and improve curation
• Read user feedback: when you submit a message via Settings → Feedback, we store it linked to your account ID solely so we can read it, prioritize improvements, and (where possible) respond.
• Respond to you: handle support requests, data access/deletion requests, and legal inquiries
• Keep the Service secure and meet legal duties: prevent abuse, investigate incidents, and comply with law

Automated choices and profiling. The app automatically chooses which daily note and which products to show, based on your tone, the day's mood, and your region. This does not produce legal effects or similarly significant effects for you, and we do not build a profile of you for advertising.

If we want to use your information for a new purpose that is not reasonably related to the purposes above, we will tell you first and, where the law requires, ask for your consent.

3.1 Legal bases for processing

Where the law of your country requires a legal basis (for example the GDPR/UK GDPR, the Philippine Data Privacy Act, the Malaysian PDPA, or the Thai PDPA), we rely on the following. We do not make consent a condition of using the Service for anything that is not necessary to provide it.

Malaysia's PDPA uses a different, consent-centred structure; see §13.5. For the Republic of Korea, see §13.11.

4. How We Share Information

We share information only with the following service providers and partners, for the specified purposes and in the minimum amount necessary. Service providers process data for us under each provider's terms of service and standard data processing terms, which limit their use of it to providing services to us and require them to protect it. Independent companies (sign-in providers, affiliate programs, and stores) handle information under their own privacy policies.

We do NOT:

• Sell your personal information for money or anything else of value. (Affiliate programs pay us commissions for sales, not for your information.)
• Share your personal information with advertising networks or data brokers
• Use your personal information for cross-context behavioral advertising
• Allow any third party to use information we send them to track you across other apps, services, or websites

When you leave the app for a store. Tapping a product card takes you to an affiliate network and a store. Those companies collect information on their own sites (for example cookies, IP address, and pages you view) under their own privacy policies, and may collect it over time and across websites. We don't control that collection and don't receive what they collect, other than sales reports that show totals by product and date.

4.1 Legal disclosures

We may disclose information if required by law, valid legal process (subpoena, court order), or to protect the safety and rights of users or the public. We will challenge overbroad or improper requests where feasible.

4.2 Business transfers

If moon made me is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you and post a notice in the App if your information becomes subject to a materially different privacy policy.

5. Data Retention

We retain information only as long as necessary for the purposes described. Specifically:

• Profile data (name, preferences): kept while your account is active. Deleted within 30 days of account-deletion request, except where retention is required by law.
• Daily note interaction history: automatically deleted after 365 days (rolling window).
• Product click records (the separate product_clicks table): automatically deleted after 180 days. Aggregated anonymized counts (e.g., "X taps on product Y on date Z" with no user identifier) may be retained longer for business analytics.
• In-app behavior events (onboarding_step, share_tapped, app_open, vibe_grid_impression, talisman_drawn, whisper_viewed, product_click_return): automatically deleted after 365 days.
• Daily activity aggregate (daily_active_users table): one row per (Firebase UID, date) that we use to compute Daily / Weekly / Monthly Active User counts after raw events are deleted. This row includes your Firebase UID and is not anonymized. Retained while your account is active; deleted when your account is deleted via database cascade. The same applies to your daily product pick history (one row per user/date/mood).
• Feedback messages: retained for 24 months from submission, then automatically deleted, unless required for an open support thread.
• Sealed letters (your note, the daily-note snapshot, and your guide's name at the time of sealing): retained while your account is active. There is no automatic expiry — a letter you schedule a year out must survive that year, and letters you have already opened stay readable in the Echo Well because that is the point of the feature. Deleted when your account is deleted.
• Country for store selection (Android): not stored on our servers; cached on your device for 24 hours.
• Push notification tokens: deleted when you turn notifications off in the App or delete your account. If you turn notifications off only in your device settings, the token is deleted at the App's next sync.
• Authentication identifiers: deleted when the account is deleted.
• Operational logs (debugging, security): maximum 90 days.
• Crash reports and breadcrumb logs (Firebase Crashlytics): retained for 90 days per Google's default policy.
• Breach and request records: where the law requires us to keep records of security incidents or privacy requests, we keep them as the law requires.

6. Your Rights

6.1 Things you can do yourself, at any time

• View and edit your name, guide, tone, and notification time in the Settings screen.
• Disable notifications via your device's system settings or the in-app Settings screen
• Disable return-reminder notifications independently of the daily push, in Settings → Reminders
• Sign out and stop using the Service
• Delete your account in the Settings screen (steps at moonmademe.com/delete-account), or by contacting us

Account deletion removes your personal data within 30 days, subject to the retention exceptions above.

6.2 Rights you can ask us to act on

Depending on the law where you live, you may have the right to:

• Be informed about how we use your information (this Policy)
• Access your information and get a copy of it
• Correct inaccurate or incomplete information
• Delete your information, or have it blocked
• Data portability — receive your information in a commonly used electronic format, or ask us to send it to another organization where technically feasible
• Object to, or ask us to restrict, certain processing — for example processing based on legitimate interests
• Withdraw consent where we rely on consent (for example push notifications). Withdrawing does not affect processing that happened before
• Complain to your data protection regulator (see §13 for each country's regulator)

We offer these rights to all users, whether or not a particular law requires it of us, to the extent they are technically and legally possible.

How to ask: email contact@hasia.ai with the subject line "Privacy Request". We will verify your identity using the email address associated with your sign-in before acting. There is no fee. We aim to respond within 30 days, and sooner where the law of your country requires (for example within two weeks as our target in Japan, and within 10 days in the Republic of Korea). If we need more time where the law allows, or if we cannot fulfil a request, we will tell you why. A parent or guardian may make a request for a minor.

7. Children

moon made me is not directed at children under 13 years old. We do not knowingly collect personal information from children under 13. In the EEA the minimum age is the local age of digital consent — 16 in Germany, the Netherlands, Ireland and Luxembourg, 14 in Austria and Cyprus, and 13 in the other EEA countries where the Service is available. In the UK and Switzerland the minimum age is 13. In the Republic of Korea the minimum age is 14 (§13.11). In India, South Africa, Nigeria and Kenya you must be 18 or older, and we do not knowingly process the personal data of anyone under 18 in those countries (§13.7, §13.10). Where a minimum age above 13 applies, the App asks you to confirm your age on its first screen.

Users who are minors in their country — under 18 in Japan, the Philippines, and Malaysia, and under 20 in Thailand — should use the Service with the consent of a parent or guardian (see Terms §2.2). Where we rely on consent for a minor's information, that consent must be given or authorized by the parent or guardian where the law requires it. The "If you are under 18" part of the short version at the top of this Policy is our plain-language summary for younger users.

If you are a parent or guardian and believe your child under 13 has provided personal information to us, please contact us at contact@hasia.ai. We will delete the information within a reasonable timeframe and terminate the account.

The App carries an age rating in each app store and, where a minimum age above 13 applies, asks you to confirm your age on its first screen; we do not otherwise verify age. If we later discover an existing user is under the minimum age, we will terminate the account and delete associated data. For the U.S. Children's Online Privacy Protection Act (COPPA), see §13.1.4.

8. Security

We take reasonable technical and organizational measures to protect your information, including:

• Encrypted transport (HTTPS / TLS 1.2+) between the App and our servers
• Encryption at rest for stored data (our database provider, Supabase, encrypts all stored data and backups with AES-256)
• Row-level security at the database layer: one user cannot access another user's data
• OAuth-based authentication — we never see your Apple/Google password
• Principle of least privilege for operational staff access, and limiting who handles personal data
• Automated deletion of time-limited data (see Section 5)
• Dependency and vulnerability monitoring on server infrastructure
• An incident response process for reporting and handling data breaches

No system is perfectly secure. If a security incident affects your personal information, we will notify the relevant regulator and you as required by applicable law, including:

• Philippines: the National Privacy Commission and affected data subjects within 72 hours of knowledge of a breach that must be notified, and both the child and the parent/guardian where a child is affected
• Malaysia: the Personal Data Protection Commissioner within 72 hours, and affected data subjects within 7 days after that, where the breach causes or is likely to cause significant harm
• Thailand: the Personal Data Protection Committee (PDPC) within 72 hours where feasible (unless the breach is unlikely to create a risk), and affected data subjects without delay where there is a high risk
• Japan: the Personal Information Protection Commission (preliminary report promptly and a final report within the statutory period) and the affected individuals
• Republic of Korea: affected data subjects within 72 hours of becoming aware of a leak, and the Personal Information Protection Commission or the Korea Internet & Security Agency (KISA) within 72 hours where PIPA requires a report
• EEA / UK: the competent supervisory authority and, where there is a high risk, the affected individuals, as required by the GDPR / UK GDPR
• United States: affected individuals and authorities as required by applicable state breach-notification laws

9. International Data Transfer

We are based in the Republic of Korea, and our main servers are in the United States (AWS US East, N. Virginia, via Supabase). Wherever you use the Service, your information will be transferred to, stored, and processed outside your country. Data protection laws in those countries may differ from those in your country.

Where your information goes:

How we protect transferred information. We do not rely on "by using the Service you consent to the transfer." Instead:

• Service providers (Google/Firebase, Supabase, Resend, Cloudflare, Expo) receive transferred information under each provider's data processing terms, including standard contractual clauses where applicable. These terms limit use to providing services to us and require appropriate security.
• Affiliate programs and stores (Amazon, Involve Asia, Lazada, Shopee) receive information because you choose to follow a product link to their service; that transfer is needed to take you there and to calculate commissions, and we send them no identifier of you or of your click (§2.4).
• We apply our own safeguards to all transferred data (§8).

On request, we will give you more information about the safeguards for your country, including a copy or summary of the relevant clauses where the law requires.

Country notes:

• Japan: see §13.3.2 (transfer to third parties in a foreign country under the APPI).
• Philippines: under the Data Privacy Act's accountability principle, we remain responsible for information we transfer to others for processing and use contractual or other reasonable means to give it a comparable level of protection.
• Malaysia: transfers outside Malaysia are made in line with section 129 of the PDPA (as amended in 2024) — to places with substantially similar law or an adequate level of protection, or under another condition the Act allows.
• Thailand: transfers outside Thailand are made in line with sections 28 and 29 of the PDPA and the PDPC's notifications — using appropriate safeguards such as standard contractual clauses where applicable, or another basis the Act allows.
• EEA / UK: see §13.2.
• India: see §13.7.
• Switzerland: see §13.8.
• Hong Kong, Pakistan and Sri Lanka: see §13.9.
• South Africa, Nigeria and Kenya: see §13.10.
• Republic of Korea: see §13.11.

10. Cookies and Similar Technologies

moon made me is a native mobile app and does not use browser cookies. We use:

• Local device storage (AsyncStorage on iOS/Android) to cache your profile, the day's daily note, your session identifier, your magic-link cooldown timestamp, (Android) your country for store selection for up to 24 hours, and, where the App asks for them on its first screen, the date and notice version of your age confirmation and your choice about usage data. In the EEA, the UK and the Republic of Korea the session identifier is stored only if you opt in to usage data; storing the other items is strictly necessary to provide the Service you asked for. None of this is shared with third parties. When an Apple Sign-In user deletes their account, the App asks Apple to confirm once more and uses the one-time code Apple returns only to revoke your Apple sign-in token (App Store guideline 5.1.1); the code is not stored. If revocation fails, the App shows you how to remove moon made me from your Apple ID settings yourself.
• Firebase Authentication ID token (issued after sign-in) stored securely on-device to keep you signed in. It is encrypted at rest by the operating system and is sent to Supabase as a Bearer token to authorize per-user database access.

We do not use web beacons, pixel tags, fingerprinting, or any cross-app tracking technologies.

Store and affiliate sites. When you tap a product card, the page opens outside the app (in your browser or the store's app). The affiliate network (such as Involve Asia) and the store (such as Amazon, Lazada, or Shopee) may set their own cookies or similar technologies there, under their own policies. We don't control them; you can manage them in your browser or the store's app settings.

11. Do Not Track

The App does not respond to Do Not Track signals, because Do Not Track is a browser-level standard that does not apply to native mobile apps. However, we do not track you across other apps or services regardless of Do Not Track status. Stores and affiliate networks you visit through product links have their own practices (§10).

12. Advertising (current state: none)

As of this Policy's effective date, moon made me does not display third-party advertising of any kind — no banners, interstitials, rewarded video, or sponsored content from ad networks. We do not use advertising SDKs and do not process advertising identifiers. Affiliate product cards are described in §2.4 and Terms §6.

If we ever introduce advertising or change our data practices, we will:

• Update this Privacy Policy with at least 30 days' advance notice in the App
• Provide opt-out mechanisms and consent flows required by applicable law (e.g., iOS App Tracking Transparency prompt, GDPR consent banner where applicable)
• Update App Store Privacy Labels and Google Play Data Safety disclosures

13. Region-specific Privacy Information

The following sections add to the rest of this Policy for people in the named regions. Where they conflict with the rest of this Policy, the region-specific section applies to people in that region.

13.1 United States

13.1.1 California (CCPA / CPRA)

We provide the following rights to California residents whether or not the CCPA applies to us.

• Know what categories of personal information we collect and why (see Section 2), the sources (Section 2), and the categories of recipients (Section 4)
• Access a copy of the specific personal information we have about you
• Delete your personal information, subject to legal retention exceptions
• Correct inaccurate personal information
• Opt out of the sale or sharing of personal information for cross-context behavioral advertising — we do not sell your information or share it for cross-context behavioral advertising. We send affiliate programs no identifier of you or of your click (§2.4).
• Limit the use of sensitive personal information — we do not collect sensitive personal information as defined by CCPA/CPRA
• Non-discrimination — we will not deny service, charge a different price, or provide a different quality of service because you exercised these rights

Categories collected in the past 12 months: identifiers (sign-in ID, email address, push token); internet or other electronic network activity (in-app events, product clicks); approximate location at country level only (Android store selection, not stored); inferences — none beyond the day's mood-to-product matching.

To exercise these rights, email us at contact@hasia.ai with the subject line "Privacy Request". We will verify your identity via the email address associated with your sign-in before acting, and respond within 45 days as the CCPA provides. You may also contact the California Attorney General or the California Privacy Protection Agency (cppa.ca.gov).

13.1.2 California Online Privacy Protection Act (CalOPPA)

• Categories of information and recipients: Sections 2 and 4.
• Reviewing and correcting your information: Section 6.
• How we notify changes: Section 14.
• Do Not Track: Section 11.
• Third-party collection over time and across sites: we do not allow third parties to collect information about your online activities through the app for tracking. When you follow a product link to a store or affiliate network, those companies may collect information about your activities over time and across websites on their own sites, under their own policies (§4, §10).

13.1.3 Other U.S. states

If you live in a U.S. state with a comprehensive privacy law, you may have rights similar to those above (access, correction, deletion, portability, and opting out of targeted advertising, sale, or profiling). We honor these requests for all U.S. residents using the process in §6.2. If we decline your request, you may ask us to reconsider by replying to our response, and you may contact your state Attorney General.

13.1.4 Children (COPPA)

The Service is intended for a general audience aged 13 and older and is not directed to children under 13. We do not knowingly collect personal information from children under 13; if we learn we have, we delete it and terminate the account (§7). We keep a written retention schedule (Section 5) and security program (Section 8).

13.1.5 Data breaches

We will notify affected residents and authorities as required by applicable state breach-notification laws (§8).

13.2 European Economic Area and United Kingdom (GDPR / UK GDPR)

If you are in the European Economic Area or the United Kingdom, you have the rights of access, rectification, erasure, restriction of processing, data portability, and objection, and the right to withdraw consent at any time. Contact us at contact@hasia.ai to exercise these rights. You also have the right to lodge a complaint with the data protection supervisory authority in your country (in the UK, the Information Commissioner's Office).

Legal basis for processing: see the table in §3.1. In summary:

• Performance of a contract — to provide the Service you requested (profile, daily note delivery, Echo Well letters)
• Legitimate interest — service improvement, security, fraud prevention, affiliate commissions, store selection, and return reminders
• Consent — for push notifications (withdrawable anytime via device or app settings)
• Consent — for usage analytics (the session identifier and in-app events in §2.2). We ask on the App's first screen; it is optional, and you can withdraw it at any time in Settings → Usage data. If you don't opt in, we don't store the session identifier on your device and don't record analytics events for you.

Minimum age: 16 in Germany, the Netherlands, Ireland and Luxembourg; 14 in Austria and Cyprus; 13 in the other EEA countries where the Service is available and in the UK (§7).

Controller: Hasia Co., Ltd. (details in §15) is the controller of your personal data.

Response time: we respond to rights requests within one month. If a request is complex, we may extend this by up to two further months, and we will tell you why within the first month.

Transfers: your data is transferred outside the EEA/UK (mainly to the United States and the Republic of Korea; §9).

• Republic of Korea: both the European Commission and the UK have recognised the Republic of Korea as providing an adequate level of data protection. Transfers to our staff in Korea rely on those adequacy decisions.
• United States and other countries: where a provider participates in the EU-U.S. Data Privacy Framework and its UK Extension, we rely on that. Otherwise we rely on the European Commission's Standard Contractual Clauses, with the UK Addendum (or the UK International Data Transfer Agreement) for UK data, or another transfer mechanism permitted by law.

13.3 Japan

A complete Japanese-language privacy policy (プライバシーポリシー), prepared under the Act on the Protection of Personal Information ("APPI"), is available at moonmademe.com/ja/privacy. The key items are summarized below. They supplement — and do not replace — the rest of this Policy.

13.3.1 Business operator

13.3.2 Transfer to third parties in a foreign country

Your data is stored and processed outside Japan.

Destination country: primarily the United States. For Cloudflare, traffic may transit equipment in other countries.

Data protection regime of that country: the United States has no comprehensive, cross-sector personal data protection law comparable to Japan's APPI or the EU's GDPR. Protection is provided through sector-specific federal laws (health, finance, children), state laws such as the California Consumer Privacy Act, and the Federal Trade Commission Act §5 prohibition on unfair or deceptive practices. See the country surveys published by Japan's Personal Information Protection Commission for details.

Basis for the transfer: not your consent, but our establishment of a system necessary to ensure the continued implementation of measures equivalent to those required of a personal information handling business operator under APPI, as provided in Article 28(1) of the APPI and Article 16 of its Enforcement Rules.

Measures taken by those recipients: for the vendors we entrust with personal data (Firebase, Supabase, Resend, Cloudflare, Expo), we ensure the continued implementation of those equivalent measures by contract, terms of service, data processing agreement, or other appropriate and reasonable means — covering purpose limitation, restrictions on sub-processing, security measures, and return or deletion on termination. On our side we apply transport encryption, encryption at rest, row-level access control in the database, and least-privilege access (Section 8).

Apple and Google (sign-in) and Amazon (Associates Program) are not vendors we entrust with personal data; each handles personal information independently in its relationship with you. Sign-in happens directly between you and Apple or Google. We send Amazon no identifier of you or of your click (§2.4).

On request we will provide information about these measures, as required by law.

13.3.3 Retained personal data — your requests

Under Articles 32 to 39 of the APPI you may request:

• notification of the purpose of use
• disclosure (including by electronic record)
• correction, addition, or deletion
• suspension of use or erasure
• suspension of provision to third parties

Email contact@hasia.ai with the subject line "Privacy Request". We verify your identity using the email address associated with your sign-in. There is no fee. We aim to respond within two weeks.

13.3.4 Complaints

Please contact us first. You may also file with the Personal Information Protection Commission of Japan (PPC, https://www.ppc.go.jp/).

13.3.5 Security measures

In addition to Section 8, we note for APPI Article 23 purposes that personal data is handled in the United States; the regime of that country and the measures taken by recipients are described in 13.3.2. The Japanese policy §8 lists our organizational, human, physical, and technical measures.

13.3.6 External transmission of information

In the spirit of Article 27-12 of the Telecommunications Business Act, the information this app transmits from your device is:

We do not transmit information externally for advertising or behavioural targeting.

13.3.7 Age

Users must be 13 or older. If you are under 18, please use the Service with the consent of a person with parental authority.

13.3.8 Data breaches

If a leak or similar incident occurs that must be reported, we will report it to the Personal Information Protection Commission and notify you, as required by the APPI (§8).

13.4 Philippines (Data Privacy Act of 2012)

This section applies to data subjects in the Philippines under the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and issuances of the National Privacy Commission (NPC).

• Personal information controller: Hasia Co., Ltd. (details in §15).
• Data Protection Officer: contact@hasia.ai (subject line "Privacy Request").
• What we collect, why, how, how long, and who receives it: Sections 2–5 and 9.
• Legal bases: §3.1. We do not rely on implied consent; where we rely on consent, we ask for it specifically.
• Automated processing: see "Automated choices and profiling" in §3.
• Your rights as a data subject: to be informed; to access; to object; to erasure or blocking; to rectification; to data portability; to be indemnified for damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data; and to file a complaint. Your lawful heirs and assigns may exercise these rights after your death or incapacity, as the law provides.
• Complaints: please contact us first. You may also file a complaint with the National Privacy Commission (https://privacy.gov.ph/).
• Minors: users under 18 should use the Service with a parent's or guardian's consent (§7). The "If you are under 18" part of the short version is our child-friendly summary; we will notify both a child and the child's parent or guardian of a breach affecting the child.
• Sensitive personal information: we do not ask for your age, date of birth, health, religious, or other sensitive personal information. Please don't include it in free text (§2.1).
• Breach notification: NPC and affected data subjects within 72 hours where required (§8).
• Transfers: accountability-based protection (§9).

13.5 Malaysia (Personal Data Protection Act 2010)

This section applies where the Personal Data Protection Act 2010, as amended by the Personal Data Protection (Amendment) Act 2024 ("PDPA"), applies to our processing of your personal data.

A Bahasa Malaysia version of this Privacy Policy is available on our website at https://moonmademe.com/ms/privacy/. The language rule in §1 applies.

• Data controller: Hasia Co., Ltd. (details in §15).
• Data Protection Officer / contact for enquiries and complaints: Data Protection Officer, Hasia Co., Ltd., by email at contact@hasia.ai (subject line "Privacy Request").
• Description of the data and purposes: Sections 2 and 3.
• Source of the data: Section 2 (from you, your device, and your sign-in provider).
• Classes of third parties we disclose to: Section 4.
• Your choices and the means to limit processing: Sections 6.1 and 10 (notification switches, Reminders switch, optional features, account deletion).
• Whether the data is obligatory or voluntary, and the consequences of not providing it: §2.5.
• Basis for processing: processing needed to provide the Service you signed up for relies on the PDPA's exception for performing a contract with you. Notifications are sent only if you allow them on your device, and you can turn them off at any time (§6.1).
• Your rights: to access your personal data; to correct it; to withdraw consent; to prevent processing likely to cause damage or distress; to prevent processing for direct marketing; and, where the PDPA provides it, to data portability (§6.2). We respond to access requests within 21 days.
• Complaints: please contact us first. You may also contact the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi, JPDP — https://www.pdp.gov.my/).
• Minors: users under 18 should use the Service with a parent's or guardian's consent (§7).
• Breach notification: the Commissioner within 72 hours and affected data subjects within 7 days after that, where there is significant harm (§8). We keep records of personal data breaches as the PDPA requires.
• Transfers: section 129 as amended (§9).

13.6 Thailand (Personal Data Protection Act B.E. 2562)

This section applies to data subjects in Thailand under the Personal Data Protection Act B.E. 2562 (2019) ("PDPA") and notifications of the Personal Data Protection Committee (PDPC).

• Data controller: Hasia Co., Ltd. (details in §15).
• Data Protection Officer / contact: contact@hasia.ai (subject line "Privacy Request").
• Purposes and legal bases: Section 3 and §3.1. Our core features (account, daily notes, Echo Well) are provided on the basis of our contract with you. Where we rely on consent (push notifications), consent is asked for separately, is not a condition of using the Service, and can be withdrawn as easily as it was given.
• Whether you must provide the data, and the consequences: §2.5.
• Data collected and retention periods: Sections 2 and 5.
• Recipients: Section 4; international transfers: Section 9.
• Your rights: to access and obtain a copy of your data (we respond within 30 days); to data portability; to object; to erasure; to restriction of processing; to rectification; and to withdraw consent. You may object to direct marketing at any time.
• Complaints: please contact us first. You may also file a complaint with the Personal Data Protection Committee (Office of the PDPC — https://www.pdpc.or.th/).
• Minors: under the Civil and Commercial Code you are a minor until age 20. Where we rely on consent and the law requires it, a minor's consent must be given with, or (for children aged 10 or under) by, the parent or guardian with parental power (§7).
• Breach notification: the PDPC within 72 hours where feasible, and affected data subjects where there is a high risk (§8).
• Transfers: sections 28 and 29 and PDPC notifications (§9).
• Thai-language version: a Thai-language version of this Policy is available in the App and on our website. The language rule in §1 applies.

13.7 India (Digital Personal Data Protection Act, 2023)

This section applies to Data Principals in India under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025.

• Data Fiduciary: Hasia Co., Ltd. (details in §15).
• Who can use the Service: you must be 18 or older. Under the DPDP Act, anyone under 18 is a child, and we do not process children's personal data in India. When you open the App in India, the first screen asks you to confirm that you are 18 or older and to agree to the privacy notice before you can begin. If we learn that a user in India is under 18, we will delete the account and its data.
• Notice and consent: the privacy notice on the first screen lists the personal data we collect, why we collect it, and how to withdraw consent and exercise your rights. It links to this Policy, which describes the data in Section 2, the purposes in Section 3, and the providers we use in Sections 4 and 9. We keep a record that you gave consent (the date and the notice version), first on your device and, once you sign in, with your account.
• Withdrawing consent: you can withdraw consent at any time, as easily as you gave it, by deleting your account in Settings (or by emailing us). Withdrawal does not affect processing that happened before it. After withdrawal we stop processing and delete your data as described in Section 5, except where the law requires us to keep it.
• Your rights: you can ask for a summary of the personal data we hold about you and the processing we carry out; ask us to correct, complete, update or erase it; and nominate another person to exercise your rights if you die or become incapable. Email contact@hasia.ai with the subject line "Privacy Request".
• Grievances: contact us first at contact@hasia.ai with the subject line "Grievance". We respond to grievances and to requests to erase data within 90 days. If you are not satisfied, you can complain to the Data Protection Board of India.
• Personal data breaches: if a breach affects you, we will tell you without delay, and we will report it to the Data Protection Board of India as the Rules require (within 72 hours of becoming aware of it, with a detailed report).
• Transfers: your data is processed outside India (mainly in the United States and the Republic of Korea; §9), in line with the DPDP Act.
• Language: this Policy is available in English. If you need the privacy notice in another language listed in the Eighth Schedule to the Constitution of India, email us and we will help.

13.8 Switzerland (Federal Act on Data Protection)

If you are in Switzerland, the revised Federal Act on Data Protection (FADP) applies.

• Controller: Hasia Co., Ltd. (details in §15).
• Your rights: you can ask for access to your personal data, correction, deletion, and data portability, and object to processing. Email contact@hasia.ai; we respond within 30 days.
• Transfers: your data is processed mainly in the United States and the Republic of Korea (§9). For the United States, where a provider is certified under the Swiss-U.S. Data Privacy Framework we rely on that; otherwise we rely on standard contractual clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC), adapted for Swiss law, or another mechanism the FADP allows.
• Complaints: you can contact the FDPIC.
• Minimum age: 13 (§7).

13.9 Hong Kong, Pakistan and Sri Lanka

• Hong Kong: we handle your personal data in line with the Personal Data (Privacy) Ordinance (Cap. 486) and its Data Protection Principles. You can ask for access to and correction of your personal data by emailing contact@hasia.ai; we respond within 40 days. Your data is transferred outside Hong Kong (§9). You can complain to the Office of the Privacy Commissioner for Personal Data.
• Sri Lanka: we handle your personal data in line with the Personal Data Protection Act, No. 9 of 2022, as its provisions come into force. You can ask for access, correction, erasure, or a review of decisions about your data by emailing contact@hasia.ai.
• Pakistan: you can ask for access to, correction of, or deletion of your personal data at any time by emailing contact@hasia.ai.

13.10 South Africa, Nigeria and Kenya

• Who can use the Service: you must be 18 or older. Under the Protection of Personal Information Act 2013 (POPIA, South Africa), the Nigeria Data Protection Act 2023 (NDPA) and the Data Protection Act 2019 (Kenya), anyone under 18 is a child, and we do not process children's personal information in these countries. When you open the App, the first screen asks you to confirm that you are 18 or older and to agree to the privacy notice before you can begin. If we learn that a user in these countries is under 18, we will delete the account and its data.
• Notice and consent: the privacy notice on the first screen lists the personal information we collect, why we collect it, and how to withdraw consent and exercise your rights. We keep a record of your confirmation (the date and the notice version), first on your device and, once you sign in, with your account.
• Your rights: you can ask for access to, correction of, or deletion of your personal information, object to processing, and withdraw consent (by deleting your account in Settings, or by emailing us). Email contact@hasia.ai; we respond within 30 days.
• Complaints: South Africa — the Information Regulator; Nigeria — the Nigeria Data Protection Commission; Kenya — the Office of the Data Protection Commissioner.
• Transfers: your information is processed outside your country, mainly in the United States and the Republic of Korea (§9), under the providers' data processing terms and our own safeguards (§8), as POPIA section 72, NDPA Part VIII and the Kenyan Act section 48 allow.
• Breaches: if a breach affects you, we will notify you and the regulator as the law requires (in Nigeria, the Commission within 72 hours).

13.11 Republic of Korea (Personal Information Protection Act)

This section applies to data subjects in the Republic of Korea under the Personal Information Protection Act ("PIPA") and its Enforcement Decree. A complete Korean-language privacy policy (개인정보 처리방침), including every item PIPA requires a privacy policy to disclose, is available in the App and at moonmademe.com/ko/privacy. The key items are summarized below. They supplement — and do not replace — the rest of this Policy.

• Personal information controller: Hasia Co., Ltd. (주식회사 하시아), represented by Hyeman Lee; business registration number 324-81-03751 (details in §15).
• Who can use the Service: you must be 14 or older. PIPA (Article 22-2) requires the consent of a legal representative to process the personal information of a child under 14; we do not offer that option. When you open the App in Korea, the first screen asks you to confirm that you are 14 or older before you can begin. If we learn that a user in Korea is under 14, we will delete the account and its data.
• Product links: we do not show product cards in Korea, so no product click, product pick, or store information is collected, and no affiliate program or store (Amazon, Involve Asia, Lazada, Shopee) receives information about users in Korea through the App.
• Usage analytics is optional: on the first screen we ask whether you agree to usage analytics (the session identifier and the in-app events in §2.2). This is optional consent; if you don't agree, you can still use every feature. You can change your choice at any time in Settings → Usage data. If you don't agree, the App sends no analytics events and stores no session identifier. Crash reports (Firebase Crashlytics, §4) are still sent, because we need them to keep the Service working and secure.
• Legal bases: we process the information needed to provide the Service because it is necessary to perform our contract with you (PIPA Article 15(1)(4)), and this includes crash reports and security logs that keep the Service working and safe; push notifications and usage analytics rely on your consent (Article 15(1)(1)); and we keep records where the law requires (Article 15(1)(2)).
• Chief Privacy Officer: Hyeman Lee (이혜만), CEO — contact@hasia.ai.
• Your rights: you (or your legal representative, or a person you authorize) can ask to access, correct, or delete your personal information, ask us to suspend processing, and withdraw consent. Email contact@hasia.ai with the subject line "Privacy Request". We respond within 10 days; if we cannot act on a request, we will tell you why and how you can challenge that decision.
• Complaints and remedies: please contact us first. You may also contact the Personal Information Dispute Mediation Committee (www.kopico.go.kr, 1833-6972), the Personal Information Infringement Report Center run by KISA (privacy.kisa.or.kr, 118), the Supreme Prosecutors' Office (www.spo.go.kr, 1301), or the Korean National Police Agency (ecrm.police.go.kr, 182).
• Overseas transfer: your information is transferred to and stored outside Korea — mainly in the United States (Supabase on AWS US East; Google/Firebase; Resend; Expo) and through Cloudflare's global network — to perform our contract with you (PIPA Article 28-8(1)(3)). The Korean-language policy, §13.11, contains the full table PIPA Article 28-8(2) requires (recipient and contact, country, when and how the data is transferred, items, purpose, retention period, and how to refuse and what happens if you do).
• Retention and destruction: retention periods are in Section 5. When information is no longer needed, we destroy it without delay: electronic files are deleted so that they cannot be recovered.
• Breaches: see §8.

14. Changes to This Policy

We may update this Privacy Policy from time to time, in accordance with applicable law. When we do, we will tell you what is changing and when it takes effect, before it takes effect, in the App or by another appropriate method. In particular, we will:

• Update the "Last Updated" date at the top
• Post a notice in the App for material changes
• For very material changes (e.g., new categories of data collection, new sharing partners, introduction of advertising), provide at least 30 days' advance notice

Where a change needs your consent under applicable law (for example a new purpose unrelated to the original ones, or new consent-based processing), we will ask for it and will not treat continued use as consent. For other changes, the revised Policy applies from its effective date; if you do not agree, you may stop using the Service and request account deletion.

15. Contact Us

Questions, concerns, or requests regarding this Privacy Policy or your personal information:

moon made me
Operated by: Hasia Co., Ltd.
Address: 108-1, Gasan Mobius Tower, 169-23 Gasan digital 2-ro, Geumcheon-gu, Seoul, 08504, Republic of Korea
Email: contact@hasia.ai

Data Protection Officer (Philippines, Malaysia, Thailand): contact@hasia.ai

Chief Privacy Officer (Republic of Korea): Hyeman Lee (이혜만), CEO — contact@hasia.ai

For data access, correction, deletion, portability, or objection requests, include "Privacy Request" in the subject line. We will verify your identity using your sign-in email before acting on the request.