Privacy Policy — Moonati

Moonati (“we,” “us”) is an AI-powered personal memory vault. This policy explains what we collect, how we use it, and the choices you have. We designed Moonati to be private by default — your vault is yours.

Information we collect

Account information: your email address and name when you sign up.
Content you save: URLs, text, notes, and files you choose to add to your vault. Moonati only ingests content you intentionally save — it does not access your browsing history, likes, or private accounts.
Usage data: basic, privacy-preserving information needed to run the service, such as how many items you’ve saved this month (for plan limits).
Payment information: handled entirely by Stripe. We never see or store your card number.

How we use your information

To provide the core service — summarizing, organizing, and making your saved content searchable.
To run AI analysis on content you save (see “AI processing” below).
To send you transactional email (welcome, weekly digest if enabled) and, only with your consent, product updates.
To enforce plan limits and process subscriptions.

We do not sell your data, and we do not use your saved content to train AI models.

AI processing

When you save content, the text is sent to our AI provider (OpenAI) to generate summaries, highlights, and tasks. OpenAI processes this data to return results to us and, per their API terms, does not use API content to train their models. We send only the content needed to perform the analysis you requested.

Service providers

We share data only with the infrastructure providers required to operate Moonati:

Supabase — database, authentication, and storage.
OpenAI — AI content analysis.
Stripe — subscription billing and payments.
Resend — transactional email delivery.
Vercel — application hosting.

Data security

Your data is encrypted in transit and at rest. Every database table enforces row-level security, so you can only ever access your own vault. We follow least-privilege access internally.

Your rights and choices

Export: download your entire vault as JSON anytime from Settings.
Delete: delete individual items, all content, or your whole account from Settings. Deletion is permanent.
Email preferences: control digests and marketing in Settings → Notifications.

Cookies & analytics

We use essential cookies to keep you logged in and to operate the service. We may use privacy-preserving, aggregate analytics to understand how Moonati is used and improve it. We do not use cookies to sell your data or to build advertising profiles.

Data retention

We keep your account and vault data for as long as your account is active. When you delete an item or your account, it is permanently removed from our systems, subject to short-lived backups and any retention required by law (for example, billing records). You can export or delete your data at any time from Settings.

Your privacy rights (CCPA, GDPR & U.S. state laws)

Depending on where you live — including California (CCPA/CPRA), Texas (TDPSA), other U.S. states, and the EU/UK (GDPR) — you may have the right to:

Access / know what personal data we hold about you.
Correct inaccurate personal data.
Delete your personal data.
Port — receive a copy of your data (export as JSON from Settings).
Opt out of “sale” or “sharing” of personal data. We do not sell or share your personal data, so there is nothing to opt out of.
Non-discrimination — we won’t treat you differently for exercising these rights.

For EU/UK users, our legal bases for processing are performance of our contract with you (providing the service), your consent (for optional emails), and our legitimate interests (securing and improving Moonati). You may also lodge a complaint with your local data protection authority. To exercise any right, use the tools in Settings or email hello@moonati.ai.

International users & data transfers

Moonati is operated from the United States and our providers may process data in the U.S. and other countries. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for international transfers. By using Moonati, you understand your data may be processed in the U.S.

The Moonati browser extension

The extension reads only the URL and title of the current tab, and only when you click to save. It uses your login session to send that page to your vault. It does not track your browsing or run in the background.

Children’s privacy

Moonati is not directed to children under 13, and we do not knowingly collect their data.

Changes to this policy

We may update this policy; we’ll revise the date above and, for material changes, notify you by email.

Contact

Questions about privacy? Email us at hello@moonati.ai.