Your space. Your information.

01

Who is responsible

Moonfig is an app by Innerside Inc., a Québec company. This policy covers the Moonfig app, our website, early-access activities and support. References to Innerside Inc. identify the company behind Moonfig, not a different app.

The founder of Innerside Inc. is responsible for protecting personal information. Contact privacy@moonfig.app, or write to the postal address below, for privacy questions, requests or complaints.

02

Your account and purchases

Creating an account provides an email address, sign-in information and, if you provide it, your first name. Supabase handles authentication and stores account information. Passwords are handled by the authentication service; they are not stored as readable passwords by us. If a third-party sign-in option is offered and you choose it, that provider shares the information disclosed in its permission screen, such as your name and email.

We use your account identifier, subscription status, purchase dates and early-access entitlement to provide the access you have chosen. RevenueCat manages subscription entitlements. Your app store processes payments under its own terms and privacy policy; we do not receive your complete payment-card information.

03

Your writing, the Guide and its memory

Your journal entries, conversations and saved Keep items are stored on your device. They are not routinely uploaded as full journal or chat histories to our database. Local storage does not mean that the Guide works without sending information: generating a reflection or reply requires the AI processing described below.

When you ask the Guide to respond, your text and relevant context are sent through our server to an AI provider. Context can include a mood check-in, recent conversation, a few excerpts of recent reflections, first name, program and practice information, and saved summaries as your plan allows. This can reveal sensitive information about your well-being. Share only what you want the service to process, and avoid identifying other people unnecessarily.

The Guide can create short daily summaries, with mood and practice context, that are stored in our database to support continuity. Summaries are intended to describe themes rather than repeat identifying details, but this safeguard is imperfect. We treat these summaries as sensitive. A plan’s memory limit controls what the Guide draws on; it does not by itself delete older summaries.

Our AI services include Anthropic and OpenAI, with a fallback provider when needed. Their commercial/API services do not use submitted content for general model training by default. Provider safety monitoring, logs and applicable legal requirements may involve temporary retention. There is no promise of zero retention or immediate deletion at every provider. The Guide’s responses are automated, can be wrong, and are not reviewed by a person before you receive them.

04

Voice, backup and reminders

• Voice input asks for microphone permission. A recording is sent for transcription and the resulting text is used like typed text. We do not keep a voice recording as part of your journal on our servers; provider processing and logs may still apply.
• Cloud backup is optional. It can store program/session progress, pattern-question information and notes in our database. It does not back up the full journal or chats. Turning it off requests removal of that backup. Your device’s own operating-system backup settings may also apply to local app data.
• Reminders require notification permission and are scheduled locally on your device. They do not include your journal writing. You can change microphone and notification permissions in your device settings.

05

Reports, support and early access

When you report AI content, we receive the reported response or excerpt, the reason, any note you submit and technical context such as app version. An AI response can repeat personal information from your conversation, so a report may contain sensitive information. We review it to address the issue. Support messages, voluntary feedback, invitation records and any research answers you choose to submit are used to provide support or run the activity described to you.

Joining Moonfig’s early-access forms sends your email, selected phone platform, consent wording, page/form context and any campaign tags in the link to our signup service. Supabase stores the request. Loops handles welcome and early-access emails. Signing up after a completed quiz automatically saves your answers and result for restoration in the app. Signing up without taking the quiz has no quiz result to save. Without signup, no result is saved for app restoration. This sends your chosen program, five pattern answers and any selected words, past attempts or personal words you provided to a separate Supabase record linked to your email. Age, gender, initials and campaign tags are excluded from that record. For these app-restoration forms, quiz data is not sent to Loops or included in analytics events. Unclaimed results expire after 30 days. To restore a result, sign in to the app with the same email and verify email ownership when asked; an existing app plan is preserved. Claimed records are linked to your account and removed when it is deleted. A temporary random token held only in page memory allows retries without exposing saved answers or replacing another session’s record. Submitting the form joins the email list immediately; no email confirmation click is required. Unsubscribe through the email link or contact support. Service messages about an account, purchase or support request are separate.

06

Optional quiz results email

If you choose email after the age question, we save your email and consent in Supabase for your result and early-access invitation. When you finish, the five scored answers and chosen topic are sent to our server to calculate your summary. Loops receives your email and generated summary to deliver the result; it does not receive your raw answers, age, gender or personal writing. This email flow does not save answers for app restoration. An encrypted token stays in page memory for up to two hours to allow delivery and retries. Leaving the quiz unfinished does not send a result. We keep your consented email for the launch invitation and free-month code when the app is available, even if you do not finish. You can continue without email and still see your result. Replies go to Moonfig support at support@moonfig.app; replying Android or iPhone is optional. You can ask to stop early-access invitations by replying or using the email’s contact link.

07

Website and app analytics

From 13 October 2026, cookieless website measurement starts when a page loads, unless you have opted out. PostHog receives page views and numbered quiz-step events, with browser/device type, stripped page paths and network information used for audience measurement. We use no person profiles, persistent analytics visitor ID or automatic click capture. Emails, text entries, quiz answers, topics and results are excluded from analytics event properties. Only reviewed public advertising source, campaign and creative labels are retained; other URL query strings and advertising click IDs are removed. Masked session replay also starts automatically on our homepage and quiz landing pages as part of the same analytics setting; quiz choices, results and signup screens are visible, while email, passwords and free text are masked. Optional Meta signup measurement is described separately below. Turn measurement off at any time using Privacy inside the quiz or Cookie preferences in the footer.

The app has a separate analytics configuration. When configured, PostHog receives product events and scrubbed technical errors; signed-in events can be linked to an account identifier, plan and program. The current app does not have the website’s analytics consent control. Reflection text, chat text and free-form feedback are excluded from its typed analytics events, and session replay is disabled. Contact privacy@moonfig.app for questions or requests concerning app analytics.

08

Providers and processing locations

We do not sell your personal information or use your private writing for advertising. Information is shared as needed to provide the service, respond to your requests, protect the service or meet applicable legal obligations. Providers can process information outside Québec and Canada, where different laws and lawful access by authorities may apply. The current database deployment is in the United States; a move to Montréal is planned, not presented here as completed.

09

Retention and deletion

Account records, summaries and enabled cloud backups remain while your account exists, unless you request applicable deletion sooner. Removing the account deletes its associated records in our database. Reports and early-access records linked to the account are included. Retention by separate providers, backups, support correspondence and required purchase/consent records can differ. A deletion request is also the route to ask us to remove provider records or other identifiable information that is not removed by the in-app flow.

Other records are retained for the purpose for which they were collected, to handle your requests, or to meet legal obligations. Marketing suppression and consent records may be kept so we can respect your choice and document compliance. Provider backup/security retention follows the provider’s terms and applicable law. We do not currently promise automatic deletion after a fixed number of months of inactivity, or a universal 90-day deletion deadline for provider copies.

Deleting through the app also clears app-managed local data on that device. A request by email cannot remotely erase data on your other devices or their operating-system backups. See the account deletion page for the steps and subscription reminder.

10

Your choices and rights

• Request access to your personal information, a copy, correction of inaccurate information, withdrawal of consent or deletion by writing to privacy@moonfig.app. Where applicable, you can ask for computerized information in a structured, commonly used format. We verify identity proportionately and respond within the deadlines required by applicable law; we explain any lawful limit on a request.
• Export local data or delete your account in Settings → Your data. Turn off cloud backup, change device permissions, unsubscribe from marketing, or change website analytics preferences separately. Withdrawing consent can stop a feature that needs that processing; it does not undo processing already completed.
• Moonfig is for adults 18 and older. We do not knowingly offer accounts to children. Contact us if you believe a child’s information has been provided. If a privacy concern is unresolved, you may contact the Commission d’accès à l’information du Québec or another competent privacy authority.

11

Security and policy changes

Access controls, authentication, encrypted network connections and provider security measures help protect information. No system is perfectly secure. Protect your device and password, and report suspected account access to support@moonfig.app. We assess confidentiality incidents and notify affected people and authorities when required by law.

This policy is distinct from agreeing to the Terms of Use. We explain relevant data processing when you use the service and request permissions or consent where required. Material changes will be described before they apply, with renewed consent where required. This review copy is dated 7 October 2026; its effective publication date will be recorded when it is published.

12

Optional Meta signup measurement

The signup form offers a separate, unchecked choice to help measure our ads. Only if you choose it and your signup succeeds do we load Meta’s advertising software and send one Lead event during this page visit. The event does not include your email, quiz answers, chosen topic, result or private writing. Meta still receives the page address, public campaign parameters and browser/network information, and may use advertising cookies and an ad click identifier to match the signup to an ad. Processing may take place outside Canada, including the United States, under Meta’s Privacy Policy. We do not enable automatic page-view events, automatic event detection, advanced matching or server-side Conversions API. A saved analytics opt-out or Global Privacy Control prevents this measurement. The choice is not remembered for a later page visit and does not affect signup or access to results. Turning off analytics stops further measurement in this page; it cannot recall information already sent or remove Meta cookies. Use your browser’s cookie controls to remove those cookies and Meta’s privacy controls for its use of information. Accepted signups can include an email already on our list; this event is not a purchase or a count of new customers.