moon made me — Privacy Policy

Effective Date: September 3, 2026
Last Updated: September 3, 2026
Version: 1.2

The short version (plain language)

moon made me is built around minimal data collection. Here's what matters most:

What we DON'T collect

• No password (you sign in with Apple, Google, or an email magic link)
• No location, contacts, photos, calendar, or browsing history
• No advertising ID (IDFA / GAID) — we do not track you across apps
• No behavioral advertising profile
• No third-party programmatic ads in the app

What we DO collect

• Your chosen first name or nickname
• Your guide preferences (avatar, name, tone, notification time)
• Your timezone (detected from device, stored to keep your daily reset on local midnight)
• Your email address — if your sign-in provider returns one. With email magic link, you give it to us directly. With Apple Sign In or Google Sign In, your provider passes it (or, in Apple's case, a private-relay address if you choose "Hide My Email") to Firebase Authentication. In all cases it is stored only in your authentication record and is deleted on account deletion.
• The last time you opened the app, so we can detect inactive accounts and stale data
• Which whisper you saw on which date (so we don't repeat it within 365 days)
• Product card taps (for affiliate tracking — no personal identifier shared with Amazon)
• The short note you write when you seal a letter in the Echo Well (up to 100 characters) — held until the arrival date you chose, then shown back to you. Only you can read it.

What we DO with it

• Show you a daily whisper matched to your tone
• Send a daily push notification (only if you opt in) and up to three return-reminder ("Reminders") notifications at 3, 7, and 15 days of inactivity (Reminders are on by default and can be turned off in Settings → Reminders)
• Match product recommendations to the day's vibe
• Hold your sealed letters until their arrival date and tell you when one arrives
• Improve the app via anonymized analytics

What we DON'T do

• Sell your data
• Share with advertising networks or data brokers
• Use your data for cross-context behavioral advertising
• Share with anyone beyond the essential service providers listed below

The detailed policy follows. In any conflict between this summary and the detailed sections, the detailed sections control.

1. Introduction

moon made me ("we", "us", "our") operates the moon made me mobile application (the "Service"). This Privacy Policy describes how we collect, use, share, and protect information when you use the Service.

By using the Service, you agree to the practices described here. If you do not agree, please do not use the Service.

2. Information We Collect

2.1 Information You Provide

During onboarding and in Settings, you may provide:

2.2 Information Collected Automatically

When you use the Service:

2.3 Information We Do NOT Collect

To be explicit, we do not collect or access:

• Password, password hashes, or biometric credentials (sign-in is performed entirely by your chosen provider — Apple, Google, or Firebase email magic link)
• Precise or coarse device location
• Contacts, calendar, photos, or media library
• Device motion, health, fitness, or biometric data
• Microphone or camera input
• Browsing history outside the App
• Advertising identifier (IDFA on iOS, GAID on Android) — we do not request App Tracking Transparency permission
• SMS, call logs, or any messaging content
• Financial account information or payment card data (the App has no in-app payments as of this version)

3. How We Use Information

We use your information to:

• Deliver daily content: select a whisper aligned with your chosen guide and tone preference, ensuring no repetition within a rolling 365-day window
• Send notifications: if you opt in to push, schedule local push notifications at your chosen time. By default we additionally schedule up to three return-reminder ("Reminders") notifications at days 3, 7, and 15 of inactivity to invite you back; you can disable Reminders independently in Settings → Reminders without turning off your daily push.
• Match products: align Amazon product recommendations with the day's vibe based on internal keyword tags
• Operate your account: sign-in, preference updates, and deletion
• Deliver sealed letters: hold the note you wrote in the Echo Well until the arrival date you chose, send a notification when it arrives, and show it back to you
• Improve the Service: in-app analytics events (stored in Supabase with your Firebase UID, see §4) to understand feature usage, onboarding completion, and content-sharing patterns
• Understand product and content effectiveness: product impression, click, and return-timing events help us evaluate which products resonate with each vibe and improve curation
• Send teaser/launch updates and product announcements to email addresses that opted in via the website signup form
• Read user feedback: when you submit a message via Settings → Feedback, we store it linked to your account ID solely so we can read it, prioritize improvements, and (where possible) respond.
• Respond to you: handle support requests, data access/deletion requests, and legal inquiries

4. How We Share Information

We share information only with the following service providers, for the specified purposes and in the minimum amount necessary.

We do NOT:

• Sell your personal information to anyone
• Share your personal information with advertising networks or data brokers
• Use your personal information for cross-context behavioral advertising
• Allow any third party to use your personal information to track you across other apps, services, or websites

4.1 Legal disclosures

We may disclose information if required by law, valid legal process (subpoena, court order), or to protect the safety and rights of users or the public. We will challenge overbroad or improper requests where feasible.

4.2 Business transfers

If moon made me is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you and post a notice in the App if your information becomes subject to a materially different privacy policy.

5. Data Retention

We retain information only as long as necessary for the purposes described. Specifically:

• Profile data (name, preferences): kept while your account is active. Deleted within 30 days of account-deletion request, except where retention is required by law.
• Whisper interaction history: automatically deleted after 365 days (rolling window).
• Product interaction events (product_clicked, product_click_return): automatically deleted after 180 days. Aggregated anonymized counts (e.g., "X taps on product Y on date Z" with no user identifier) may be retained longer for business analytics.
• In-app behavior events (onboarding_step, share_tapped, app_open, vibe_grid_impression, talisman_drawn, whisper_viewed): automatically deleted after 365 days.
• Daily activity aggregate (daily_active_users table): one row per (Firebase UID, date) that we use to compute Daily / Weekly / Monthly Active User counts after raw events are deleted. This row includes your Firebase UID and is not anonymized. Retained while your account is active; deleted when your account is deleted via database cascade. The same applies to your daily talisman draw history (one row per user/date/vibe).
• Feedback messages: retained for 24 months from submission, then automatically deleted, unless required for an open support thread.
• Sealed letters (your note, the whisper snapshot, and your guide's name at the time of sealing): retained while your account is active. There is no automatic expiry — a letter you schedule a year out must survive that year, and letters you have already opened stay readable in the Echo Well because that is the point of the feature. Deleted when your account is deleted.
• Push notification tokens: deleted when notifications are disabled or the account is deleted.
• Authentication identifiers: deleted when the account is deleted.
• Operational logs (debugging, security): maximum 90 days.
• Crash reports and breadcrumb logs (Firebase Crashlytics): retained for 90 days per Google's default policy.
• Marketing email subscriptions (Loops): email addresses retained while your subscription is active. Upon unsubscribe, your email is removed from the active sending list and moved to a suppression list per CAN-SPAM compliance to prevent unintended re-mailing; addresses on the suppression list are deleted upon explicit erasure request to contact@hasia.ai.

6. Your Rights

6.1 Rights available to all users

At any time you may:

• View and edit your name, guide, tone, and notification time in the Settings screen.
• Disable notifications via your device's system settings or the in-app Settings screen
• Disable return-reminder notifications independently of the daily push, in Settings → Reminders
• Sign out and stop using the Service
• Request account deletion via the Settings screen or by contacting us

Account deletion removes your personal data within 30 days, subject to the retention exceptions above.

6.2 California residents (CCPA / CPRA)

If you are a resident of California, you have the right to:

• Know what categories of personal information we collect and why (see Section 2)
• Access a copy of the specific personal information we have about you
• Delete your personal information, subject to legal retention exceptions
• Correct inaccurate personal information
• Opt out of the sale or sharing of personal information for cross-context behavioral advertising — we do not sell or share your information for these purposes; this right is honored by default
• Limit the use of sensitive personal information — we do not collect sensitive personal information as defined by CCPA/CPRA
• Non-discrimination — we will not deny service, charge a different price, or provide a different quality of service because you exercised these rights

To exercise these rights, email us at contact@hasia.ai with the subject line "Privacy Request". We will verify your identity via the email address associated with your Apple/Google sign-in before acting.

6.3 EEA / UK residents (GDPR / UK-GDPR)

If you are in the European Economic Area or the United Kingdom, you have additional rights including access, rectification, erasure, restriction of processing, data portability, and objection. Contact us at contact@hasia.ai to exercise these rights.

Legal basis for processing:

• Performance of a contract — to provide the Service you requested (profile, whisper delivery, notifications)
• Legitimate interest — service improvement, security, fraud prevention
• Consent — for push notifications (withdrawable anytime via device or app settings)

6.4 Other jurisdictions

Residents of other jurisdictions with applicable privacy laws (e.g., Virginia, Colorado, Connecticut, Utah in the US; LGPD in Brazil) have similar rights. Contact us for assistance.

7. Children (COPPA)

moon made me is not directed at children under 13 years old. We do not knowingly collect personal information from children under 13.

If you are a parent or guardian and believe your child under 13 has provided personal information to us, please contact us at contact@hasia.ai. We will delete the information within a reasonable timeframe and terminate the account.

App Store age rating restricts download to age-appropriate users. If we later discover an existing user is under 13, we will terminate the account and delete associated data.

8. Security

We take reasonable technical and organizational measures to protect your information, including:

• Encrypted transport (HTTPS / TLS 1.2+) between the App and our servers
• Row-level security at the database layer: one user cannot access another user's data
• OAuth-based authentication — we never see your Apple/Google password
• Principle of least privilege for operational staff access
• Automated deletion of time-limited data (see Section 5)
• Dependency and vulnerability monitoring on server infrastructure

No system is perfectly secure. If we discover a security incident affecting your personal information, we will notify you as required by applicable law.

9. International Data Transfer

Our servers are located in the United States (AWS US East via Supabase). If you use the Service from outside the US, your information will be transferred to, stored, and processed in the US. Data protection laws in the US may differ from those in your country.

By using the Service, you consent to this transfer. For EEA/UK residents, this transfer relies on standard contractual clauses or other transfer mechanisms as permitted by applicable law.

10. Cookies and Similar Technologies

moon made me is a native mobile app and does not use browser cookies. We use:

• Local device storage (AsyncStorage on iOS/Android) to cache your profile, the day's whisper, your session identifier, your magic-link cooldown timestamp, and (for Apple Sign-In users) a short-lived Apple authorizationCode that we use only to revoke your Apple refresh token when you delete your account, per App Store guideline 5.1.1. The Apple authorizationCode is cleared when your account is deleted. None of this is shared with third parties.
• Firebase Authentication ID token (issued after sign-in) stored securely on-device to keep you signed in. It is encrypted at rest by the operating system and is sent to Supabase as a Bearer token to authorize per-user database access.

We do not use web beacons, pixel tags, fingerprinting, or any cross-app tracking technologies.

11. Do Not Track

The App does not respond to Do Not Track signals, because Do Not Track is a browser-level standard that does not apply to native mobile apps. However, we do not track you across other apps or services regardless of Do Not Track status.

12. Advertising (current state: none)

As of this Policy's effective date, moon made me does not display third-party advertising of any kind — no banners, interstitials, rewarded video, or sponsored content. We do not use advertising SDKs and do not process advertising identifiers.

If we ever introduce advertising or change our data practices, we will:

• Update this Privacy Policy with at least 30 days' advance notice in the App
• Provide opt-out mechanisms and consent flows required by applicable law (e.g., iOS App Tracking Transparency prompt, GDPR consent banner where applicable)
• Update App Store Privacy Labels and Google Play Data Safety disclosures

13. Additional Information for Users in Japan

The following applies if you are in Japan. It is provided under the Act on the Protection of Personal Information ("APPI") and related Japanese law. It supplements — and does not replace — the rest of this Policy.

13.1 Business operator

13.2 Transfer to third parties in a foreign country

Your data is stored and processed outside Japan.

Destination country: primarily the United States. For Cloudflare, traffic may transit equipment in other countries.

Data protection regime of that country: the United States has no comprehensive, cross-sector personal data protection law comparable to Japan's APPI or the EU's GDPR. Protection is provided through sector-specific federal laws (health, finance, children), state laws such as the California Consumer Privacy Act, and the Federal Trade Commission Act §5 prohibition on unfair or deceptive practices. See the country surveys published by Japan's Personal Information Protection Commission for details.

Basis for the transfer: not your consent, but our establishment of a system necessary to ensure the continued implementation of measures equivalent to those required of a personal information handling business operator under APPI, as provided in Article 28(1) of the APPI and Article 16 of its Enforcement Rules.

Measures taken by those recipients: for the vendors we entrust with personal data (Firebase, Supabase, Resend, Loops, Cloudflare, Expo), we ensure the continued implementation of those equivalent measures by contract, terms of service, data processing agreement, or other appropriate and reasonable means — covering purpose limitation, restrictions on sub-processing, security measures, and return or deletion on termination. On our side we apply transport encryption, encryption at rest, row-level access control in the database, and least-privilege access (Section 8).

Apple and Google (sign-in) and Amazon (Associates Program) are not vendors we entrust with personal data; each handles personal information independently in its relationship with you. Sign-in happens directly between you and Apple or Google, and we do not provide personally identifying information to Amazon.

On request we will provide information about these measures, as required by law.

13.3 Retained personal data — your requests

Under Articles 32 to 39 of the APPI you may request:

• notification of the purpose of use
• disclosure (including by electronic record)
• correction, addition, or deletion
• suspension of use or erasure
• suspension of provision to third parties

Email contact@hasia.ai with the subject line "Privacy Request". We verify your identity using the email address associated with your sign-in. There is no fee. We aim to respond within two weeks.

13.4 Complaints

Please contact us first. You may also file with the Personal Information Protection Commission of Japan (https://www.ppc.go.jp/).

13.5 Security measures

In addition to Section 8, we note for APPI Article 23 purposes that personal data is handled in the United States; the regime of that country and the measures taken by recipients are described in 13.2.

13.6 External transmission of information

In the spirit of Article 27-12 of the Telecommunications Business Act, the information this app transmits from your device is:

We do not transmit information externally for advertising or behavioural targeting.

13.7 Age

Users must be 13 or older. If you are under 18, please use the Service with the consent of a person with parental authority.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will:

• Update the "Last Updated" date at the top
• Post a notice in the App for material changes
• For very material changes (e.g., new categories of data collection, new sharing partners, introduction of advertising), provide at least 30 days' advance notice

Continued use of the Service after an update constitutes acceptance of the revised Policy. If you do not agree to the revised Policy, you must stop using the Service and may request account deletion.

15. Contact Us

Questions, concerns, or requests regarding this Privacy Policy or your personal information:

moon made me
Operated by: Hasia Co., Ltd.
Email: contact@hasia.ai

For data access, correction, or deletion requests, include "Privacy Request" in the subject line. We will verify your identity using your Apple/Google sign-in email before acting on the request.