Last updated: October 2026

The short version

Moodis is local-first. The desktop app works fully offline, and your boards and images live in files on your own machine. Nothing is uploaded anywhere unless you create an account and switch cloud sync on.

If you do turn cloud sync on, your boards and images are stored on our infrastructure so they can reach your other devices and the people you share with. The rest of this page sets out exactly what that means, what we keep, who processes it on our behalf, and how to export or delete all of it.

Who this policy covers

This policy applies to three things:

The Moodis desktop app for Windows and Linux.
The Moodis web app at web.moodis.app, including its installable (PWA) form.
This website, moodis.app.

The data controller for the personal data described here is Roll Three One (Business ID 3217727-3), Martinlaaksontie 42 B7, 01620 Vantaa, Finland. You can reach us at support@moodis.app about anything on this page.

The desktop app, without an account

You can download, install and use Moodis without giving us anything. There is no sign-up, no licence check, and no usage tracking or telemetry in the app: the analytics interface it is built against is wired to a no-op in release builds.

Your boards, images, and settings are written to your operating system's application-data folder as ordinary files. We never see them. Deleting that folder deletes your data, completely and immediately.

One thing does leave your machine even when you are signed out, and you should know about it. The app's typefaces are bundled with it, so starting it fetches no fonts.

Update checks. On launch the app fetches the release manifest from www.moodis.app. It downloads the whole manifest and compares versions on your machine, so the request itself carries only your IP address and a generic updater user-agent, not your app version, operating system, or any account, board or image data. Release files are served through Vercel and Bunny CDN, which log the request in the ordinary course of running a CDN.

Accounts and cloud sync

Cloud sync, sharing and team features are part of the paid Moodis plans, which begin with a free trial, and they are opt-in. They begin when you create an account and sign in; until then none of this section applies to you. A small number of our staff can access account and subscription records through an internal admin tool when support or abuse handling requires it.

What we store when you have an account

Account details. Your email address, an optional display name, and your password. Passwords are hashed by our authentication provider; we never hold the plaintext. We also store a one-way hash of your email address, which is how someone who shares a board with you by email reaches your account without us exposing the address itself.
Board content. Board names and settings, saved viewport position, and every element on the canvas, including the text of your notes, to-dos and links. We treat this as your content, not ours.
Images. The image files themselves, plus their filename, byte size, pixel dimensions and content type. Images are encrypted at rest and stored in the European Union.
Sync bookkeeping. A device identifier, the device name and platform you sync from, and when that device last synced, so changes can be merged across your devices.
Subscription state. Your plan status and renewal date, the customer and subscription identifiers issued by our payment provider, and how much of your storage allowance you have used.

Sharing and collaboration

Sharing is always something you start. When you use it, we store what is needed to make the share work and to let you revoke it:

Direct shares. Which board you shared, with which account, and whether they may view or edit.
Share links. A random token that forms the URL, plus the options you set: view or edit access, an optional password (stored hashed), an optional expiry date, an optional cap on uses, and a count of how many times the link has been opened. Anyone holding the link can open the board within those limits, so treat a share link as public unless you have set a password. Deleting the link revokes access.
Teams. The team name and description, who its members are, and each member's role. An invitation is bound to the email address you send it to and can only be accepted by that address.
Live collaboration. While several people have the same board open, your display name and cursor position are relayed to everyone else viewing it, for the duration of the session. That includes anyone holding a share link, who need not have an account.

External images

A board that was shared with you, or synced from elsewhere, can contain images pointing at any server on the internet. Loading one would tell that server your IP address and the moment you opened the board, so Moodis leaves those images unloaded. You can turn them on in Settings; the setting is off until you do. Your own images are never affected.

Payments

Subscriptions are sold and processed by Lemon Squeezy, which acts as the merchant of record. Checkout happens on their pages, and your card details go to them, never to us. We never see or store a card number. What comes back to us is your subscription status, renewal date, and the customer and subscription identifiers we use to keep your account on the right plan. So that your purchase lands on the right account, we pass your email address and account identifier to Lemon Squeezy when checkout opens.

Security and abuse prevention

Requests to our servers are logged for security purposes. Those records can include your IP address, your user-agent string, the action performed, which resource it touched, a request identifier, and any additional context relevant to the event. We use them to investigate suspicious activity, enforce rate limits, and throttle repeated password attempts against protected share links. They are not used to build a profile of you or to target anything at you.

This website and the web app

moodis.app uses Plausible Analytics to count visits. Plausible is cookieless, stores no IP addresses, and does not follow you between sites or build a profile of you; what reaches us is aggregate page views, referrers, how far down a page you scrolled and how long it was in view, and a count of clicks on the download, free-trial, Solo-licence and Mac release-list buttons, with the platform or plan, the billing period where there is one, which block of which page the button sits in, and the address of the file or page the button led to. Plausible needs no consent and counts every visitor. Beyond that, and unless you accept the optional analytics described below, the site sets no cookies and embeds no advertising or social trackers. Its typefaces are served from this site, not from a font service. Unless you accept the optional analytics, it stores nothing in your browser except a note of your choice about them, which is there so we do not ask on every page. A sign-up link from here to the web app carries only a plan and, for the subscriptions, a billing period: the ones you chose on the pricing page, or Pro, monthly, on the trial buttons elsewhere. The Solo button carries the plan alone, because that licence has no billing period. Nothing about you or your device is added to it.

web.moodis.app uses Vercel Speed Insights to measure page-loading performance. It collects anonymous, aggregated metrics: Web Vitals, browser and device type, country-level location, and connection speed. It sets no cookies and does not follow you between pages or sites. When you are signed in, the web app also keeps your session token in browser storage so you are not asked to sign in on every visit, along with your theme preference, the board you last had open, short-lived links to your images for the rest of the browser session, and your account id, which it uses to clear cached images when a different account signs in. As an installable app it caches its own program files on your device so it can start offline, and it keeps the board images you have looked at there too so they load instantly next time; that image cache is cleared when you sign out or a different account signs in.

One page on this site, Where Moodis is listed, ends with a "Featured on" strip of badges from the directories that list Moodis. The strip itself is fetched from Submitator by our server when the page is served, so your browser never contacts Submitator. The badge images in it are loaded by your browser from the hosts those badges name, which are the directories' own, and each of those hosts receives your IP address and user-agent the way any image request does. This is the only place on moodis.app where an image is loaded from another company's server; every other image here is served from moodis.app itself.

Both sites are hosted on Vercel, which logs requests as part of serving them.

Optional analytics on moodis.app (HeyCatch)

This website can also run optional analytics from HeyCatch, Inc., a company in the United States. It is off until you accept it. Until then nothing from it is downloaded to your browser, stored on your device or sent anywhere. If you accept, it shows us how visitors move through the site, such as where they stop and what they click. It does not replace Plausible, which keeps counting everyone. It applies to moodis.app only, not to the desktop app or web.moodis.app.

Why we are allowed to. Your consent, given by pressing Accept analytics in the bar at the bottom of the page. In the terms of the GDPR that is Article 6(1)(a), and under the ePrivacy rules on storing and reading information on your device it is consent as well. The site works the same whichever you choose.
Saying no, or changing your mind. Press Decline and nothing is loaded. If your browser sends Do Not Track or Global Privacy Control, we treat that as a decline and do not show the bar. You can change your mind at any time with Analytics settings in the footer of every page: Withdraw turns the analytics off and deletes what they stored on your device. Withdrawing is as easy as accepting. We keep your choice for 12 months and then ask again.
What is stored on your device, only after you accept.
- One cookie, whose name starts ph_ and ends _posthog. The analytics code's default is 365 days; we set it to 90, and the clock restarts when you visit. It is set for the whole of moodis.app, which means web.moodis.app can see it too; the web app does not read it.
- Entries in your browser's local storage whose names start ph_, __ph_ or heycatch_: a copy of the cookie's contents, a record of your choice as the analytics code keeps it, and a running count of the events in the current session.
- Entries in session storage, which your browser drops when the tab closes, whose names start ph_: the page you arrived from, a tab identifier and a flag marking which tab is the main one.
- What those hold: a random ID for your device, a random session ID (a session ends after 30 minutes without activity, or after 24 hours), the page you first arrived on and the site that sent you, and technical details of the analytics code. No user ID: we never identify visitors, so none of it is tied to a name, an email address or an account.
- Separately, and whatever you choose, the site keeps one item of its own, in local storage under moodis.consent.v1: your choice and the date you made it, so we do not ask again on the next page. Withdrawing leaves that one in place, marked as declined.
What it collects, only after you accept. Page views and the moment you leave a page; clicks, including repeated rapid clicks on the same spot; and moves between pages. For each, the full address of the page, with anything after a question mark, and the page title; your browser's user-agent string (which names its type, version and operating system), your device type, language and time zone, and your screen and window size; the site that sent you; and your IP address (see below). For a click it records which element was clicked, meaning its tag, class names and attributes such as a link's address. It does not record the text of a button or link, which we have set to be masked, and it does not record anything you type into a form. There is no session replay. It does not start at all on the page that opens from a confirmation email, because that address carries a personal link, and that page does not pass its address on to the next one.
Your IP address. It reaches HeyCatch's edge server, which HeyCatch says does not log or keep it; its list of sub-processors also includes hosting and logging providers that may see it. It is passed on to PostHog in the United States, which works out your country, region and city from it. PostHog may keep the IP address with the stored event. We have asked HeyCatch whether it is discarded after that lookup and have not had an answer, so please do not assume that it is.
Who processes it, and where. HeyCatch is our processor, under its data processing agreement, and its sub-processors are listed on its site. HeyCatch says its analytics runs on PostHog Cloud in the United States, and that processing and storage are in the United States, apart from StreamLake (see below), whose operator and location are not known to us; HeyCatch's sub-processor list describes the model hosts as in various locations. Because HeyCatch is in the United States, the transfer to HeyCatch relies on the European Commission's Standard Contractual Clauses (Module Two) and the UK addendum, which are built into that agreement. HeyCatch is not certified under the EU-US Data Privacy Framework. The agreement says its sub-processors are bound by equivalent terms; its list names no transfer mechanism for any of them.
AI summaries of sessions. HeyCatch has a feature that summarises each session. HeyCatch says that for this it sends the paths of the pages visited (no domain, no question-mark part, no title), the type of each action and how many times it was repeated, and no IP address and no user agent. Button text is masked, so, HeyCatch says, none is sent. HeyCatch says this goes through OpenRouter in the United States to a model called GLM 5.2, made by Z.ai, which runs on CoreWeave, DeepInfra and StreamLake; that the data is not used to train models; and that two of those three hosts do not keep prompts. HeyCatch says StreamLake keeps logs under its own policy. StreamLake's operator and location are not known to us, and HeyCatch has not told us how long those logs are kept. HeyCatch also told us that it cannot switch this processing off, or change its routing, for a single customer, so we cannot exclude this website's data from it. The choice you have is the one above: do not accept the analytics.
How long it is kept. HeyCatch's agreement says it keeps it for as long as our HeyCatch subscription is active and for 2 months after it ends, and then deletes it or anonymises it so that it cannot be linked to you again. The exception is whatever StreamLake keeps in its logs, for the reason given above.
Deleting your analytics data. We do not know who you are, so the only way to find your data is the analytics ID your browser holds. While analytics are on, Analytics settings in the footer shows it with a Copy button. Email support@moodis.app with that ID and we will ask HeyCatch to delete everything held under it; HeyCatch deletes by the analytics ID and cannot find an anonymous visitor any other way. Copy the ID before you withdraw, because withdrawing removes it from your browser and without it nobody can find your data. The other rights listed below apply to this data in the same way, and need the same ID.

Our mailing lists

We run two, and joining either is entirely optional. Neither is connected to your Moodis account, and neither is ever sold, shared or used to build a profile.

The macOS notification list

The download page and the macOS page both offer to email you once Moodis for macOS is available. It is one list, whichever form you use.

What we collect. Your email address, and nothing else. We do not ask for your name, and we do not record which page or link you came from.
What you will receive. The confirmation email, and then a single announcement when the macOS build ships. That announcement carries an unsubscribe link.
How long we keep it. Until the macOS announcement has gone out, after which the list is deleted. You can leave sooner by using the unsubscribe link or by emailing us, and we will remove your address.

The Moodis newsletter

The pricing page offers to email you a discount code in exchange for joining the newsletter.

What we collect. Your email address, and nothing else.
What you will receive. The confirmation email, then one email carrying your discount code, then occasional emails about Moodis. Every newsletter carries an unsubscribe link.
The discount code. It is created only after you confirm from your inbox, and it is only ever sent to that address. It is good for one use, on the annual Pro plan, on your first payment, and it expires 30 days after we issue it. One code per address.
How long we keep it. Your address stays with Resend until you unsubscribe or ask us to remove it. The record of the code is kept while the code can still be used and for a short while after, then deleted. See the retention section below.

How joining works, for both

It takes two steps. Entering your address does not add you to anything. We send one email with a confirmation link, and only when you follow that link is your address added to the list. The link works for seven days, or until we change the wording you agreed to, whichever comes first -- after that you would be asked to sign up again under the new wording. If you never follow it, nothing was stored and nothing needs deleting. Ignoring the email is the whole opt-out.
Why we are allowed to. Your consent, given by ticking the box beside the form and then confirming from your inbox -- or, if you are signed in and tick it on your account page, by ticking it there, since we already know that address is yours. You can withdraw it at any time, and doing so is as easy as giving it.
Where the address is stored. With Resend, our email provider, in a list used for nothing but that list's own messages.
What we keep ourselves. Two records, in our own database, and neither contains your email address:
- A consent record: a one-way hash of your address, which list it was, the exact words you agreed to, and when. We keep it because data protection law asks us to be able to show that consent was given, and a hash is enough for that -- if you ask what we hold for your address, we can recompute the hash and find the record. What a hash cannot do is give us a list of addresses back, which is the point.
- A reward record, for the newsletter only: a one-way hash of your address, the discount code, and when it was issued. It exists so that one address gets one code, and so we can answer a question about a code you were sent.

Link tracking in list emails

The emails we send to these two lists have their links tracked, so that we can see which of the things we write about are worth writing about. This is the only place in Moodis where we track what you click in an email, and it is worth being precise about what it does and does not cover.

Which emails. Only the messages broadcast to these mailing lists -- the macOS launch announcement and the newsletter -- which are sent from a separate address, news@news.moodis.app. Nothing else we send is tracked: not the confirmation email, not the email carrying your discount code, not password resets or sign-in mail, not team invitations, not deletion or billing notices, and not a reply to your feedback. Those go out from moodis.app, which has tracking switched off, and we keep the two senders apart precisely so that turning tracking on for a newsletter cannot reach a link that resets your password or carries a single-use discount code.
What happens when you click. Every link in a tracked email is rewritten to point at a tracking subdomain of news.moodis.app, operated by Resend, which records the click and then redirects you to the real page. What is recorded is which link you followed and when, together with the IP address and browser user-agent that followed it, and it is recorded against the address the email was sent to. We see per-link click counts for a broadcast, and we can see which links a given subscriber followed.
We do not track opens. Open tracking -- the invisible image that reports back when a message is displayed -- is switched off for both lists. We do not know whether you read an email, only whether you followed a link in one.
Why we are allowed to. Your consent, the same consent that puts you on the list: the words beside the checkbox say that links in these emails are click-tracked, and confirming from your inbox -- or, if you are signed in, ticking it on your account page -- is what completes it. In the terms of the GDPR that is Article 6(1)(a), and under the ePrivacy rules on tracking in electronic communications it is consent as well.
How to stop it. Use the unsubscribe link in any of these emails, or write to us, and we will take your address off the list; nothing further is tracked because nothing further is sent. You can also simply not follow the links -- a tracked email that you never click records no click. Separately from any of this, and whether or not a message is tracked, Resend records for every list email whether it was sent, delivered, bounced, reported as spam or unsubscribed from. We could not run a mailing list without that, and it happens with tracking switched off.
How long it is kept. We do not copy any of it into our own database: there is no click record on our side, and nothing about clicks is attached to your Moodis account, which these lists are not connected to anyway. It lives in our Resend account under Resend's own retention for email events. We have not set a shorter period there, so we are not going to quote you one we do not enforce; ask us and we will tell you what the account holds for your address, or delete it.
What we do not do with it. We do not build a profile, we do not use it to decide what you are shown or charged, and we do not pass it to advertisers or data brokers. It tells us that a link in a newsletter was worth including, and that is all it is for.

Help & Feedback

The app has a Help & Feedback form, beside the version number, that works whether or not you are signed in. It sends one email to our support inbox. Nothing is stored in a database and nothing is sent to you.

What we receive. The category you picked, what you wrote, and, for a bug, the steps and what you expected. That is all, unless you add the two optional things below.
Your email address is optional. Leave it blank and the report is anonymous; we simply will not be able to reply. If you do enter one, a switch beside it asks whether we may contact you about it. Turn that off and the address is not sent at all: the app leaves it out of the request, so it never reaches us rather than reaching us and being ignored.
System info is off by default. Turn it on and you can see the exact payload first: app version, desktop or web, operating system and architecture, the browser or WebView identifier, your language, whether sync is on, which plan you are on, and rough counts of boards and images. Your plan can reach us two ways, and the preview tells you which: the app may send it as one of the fields listed above, in which case you will see it there; and on the web, where you are signed in, our server can instead confirm it from your session, which the preview cannot show and the form says so beside the switch. Leave the switch off and none of it is sent, your plan included, by either route. Never your board names, never file paths, never the contents of any image, and never your account identifier.
Where it goes. The message is delivered by Resend, our email provider, to our support inbox, and it is kept there, with your reply address if you gave one, as ordinary support correspondence. It is not added to any mailing list and it is not used for marketing.
Why we are allowed to. Our legitimate interest in fixing problems people report, and, for the address and the system info (each of which you choose separately), your consent.

Who processes data on our behalf

We keep this list short on purpose. Each provider only receives what its job requires:

Supabase. Accounts and authentication, the database holding your boards and their metadata, and realtime collaboration. See the Supabase Privacy Policy.
Wasabi. Object storage for your images, both full-resolution and thumbnails, and for application downloads. Your images are held in Wasabi's eu-central-1 region, inside the EU.
Bunny CDN. Content delivery for application downloads and update manifests. It does not deliver your board images.
Vercel. Hosting for this website and the web app.
Submitator. The list of directory badges shown at the bottom of our listings page. Our server fetches that list; your browser does not request it, and Submitator receives nothing about you. The badge images in it are loaded by your browser from the directories' own hosts, which see your IP address and user-agent.
Plausible Analytics. Cookieless visit statistics for this website. Each request carries your IP address and user-agent; Plausible hashes them with a salt that rotates daily to count unique visitors, and never stores the raw values. Because the salt rotates and the hash covers our domain, the result links neither across days nor to other sites. Your data is processed and stored in Germany, inside the EU.
HeyCatch, Inc. Optional analytics for this website, and only if you accept them. It receives what is described under optional analytics above, including your IP address and the full address of each page you view. It uses PostHog Cloud (United States) to store it, and, it says, OpenRouter (United States) and the model hosts named above for the session summaries. HeyCatch says processing is in the United States, apart from StreamLake, whose operator and location are not known to us. See its data processing agreement and its list of sub-processors.
Lemon Squeezy. Subscription payments and billing, and the creation of newsletter discount codes. A code is created from a randomly generated string and the plan it applies to; your email address is not sent to Lemon Squeezy to create it. See the Lemon Squeezy Privacy Policy.
Resend. Sending transactional email, such as a team invitation or a discount code. It receives the recipient's address, the team name, and the inviter's name. Resend also stores the email addresses on the two mailing lists described above; those are the cases where an address is kept there rather than only passed through. For the broadcasts to those lists, and for nothing else we send, Resend also operates the link tracking described above: it rewrites the links, records the click with the IP address and user-agent that made it, and redirects you onward.
Sentry. Error monitoring for our server-side functions, which records your account identifier alongside a diagnostic report when something fails.

We do not sell your data, and we do not share it with advertisers or data brokers. Your images are stored inside the EU. Some of the providers above are established outside the European Economic Area, so other data covered by this policy (account records, billing, diagnostics, the addresses on our mailing lists, and the record of a link you clicked in a list email, including the IP address and user-agent that clicked it) may be processed in other countries, including the United States. Where that happens, the transfer is covered by the European Commission's Standard Contractual Clauses in that provider's data processing terms, or by the EU-US Data Privacy Framework where the provider is certified under it. HeyCatch is not certified under the Framework, so its transfers to it rest on the Standard Contractual Clauses and the UK addendum; for HeyCatch's own sub-processors, its agreement says equivalent terms apply and we have not seen them. Write to support@moodis.app for a copy of the safeguard that applies to a particular provider.

Why we are allowed to hold it

To provide what you asked for. Account data, board content and sync records exist because you asked us to sync, share or collaborate.
To meet our obligations. Payment and subscription records are kept because tax and accounting rules require it.
Our legitimate interest in a working service. Security logs and rate limiting keep the service available and accounts safe, and the cookieless visit statistics described above tell us which pages are worth keeping without identifying anyone.
Your consent. Optional behaviour, such as loading external images, happens only after you turn it on, and you can turn it off again at any time. Both mailing lists are the same: you tick the box, you confirm from your inbox, and you can leave whenever you like. The newsletter's discount code, and the record that you were issued one, rest on that same consent, and so does the link tracking in the emails those lists receive -- which is why the words beside the checkbox say that it happens. The optional analytics on this website are the same: nothing is loaded until you press Accept, and you can withdraw from the footer of any page.

What you have to give us

Nothing, to use the desktop app: it needs no account. No law requires you to give us any personal data. An account needs an email address, because that is how you sign in and how we reach you about it; without one we cannot create the account, and you can keep using the app locally. Buying a subscription or a licence needs billing details, which you give to Lemon Squeezy; without them the purchase cannot go through. Joining a mailing list needs an email address and is always optional. Everything else, such as a display name, a reply address on a feedback message, or system information attached to one, is up to you. The optional analytics on this website are the same: you can decline them and lose nothing.

Decisions made about you

We make no decision about you by automated means alone, including profiling, that has legal or similarly significant effects on you. Rate limits run automatically, but they only slow down or refuse a request. Suspending an account or taking down a published board is done by a person. An account that lapses is deleted on the timeline under how long we keep things; that is one fixed rule applied to every account alike, not an assessment of you.

Your rights

Export and account deletion are built into your account settings, on the web app's account page and in the desktop app. You can also email us and we will action the same requests for you.

Get a copy. Request an export of your account data and boards from your account settings. The file downloads straight to your device; we do not keep a copy or put it behind a link. Exports are limited to one per 24 hours.
Take it elsewhere. The export is a JSON file, a structured and machine-readable format, so you can move your data to another service. That is your right to data portability.
Correct it. Change your display name and the email address on your account from the web app's account page. A new email address takes effect once you confirm it from the link we send.
Delete it. Requesting account deletion starts a 30-day cool-off period, during which you can cancel and keep everything. After it ends your data is taken out of service, and it is permanently erased within 90 days of the original request. The same timeline runs automatically for accounts that lapse: see how long we keep things, below.
Analytics data from this website. We can only act on it if you give us the analytics ID that Analytics settings shows you; see optional analytics above. That includes deletion.
Object or restrict. Ask us to stop or limit a particular use of your data.
Complain. Write to us at support@moodis.app. If you are in the EEA or the UK you can also complain to your local data protection authority.

We respond to any of these requests within 30 days.

None of this applies to the free desktop app used without an account, because we hold nothing to export or delete. The files are already yours.

How long we keep things

Account and board data. Until you delete the content or close your account, subject to the deletion timeline above.
Images you remove from a board. Removing an image from a board does not delete it at once. At least a month after the last element referring to it was removed, its record is deleted and we delete the stored file. It counts toward your storage allowance until its record goes, on every plan that syncs, so removing an image does not free the space straight away. If a dated copy holds it, it is kept for as long as that copy lasts, as described below.
Version history, on Pro and Team and during a trial. The dated copies we keep of a cloud-synced board (see our Terms) hold that board as it was when each copy was taken, for 30 days on Pro and 365 days on Team. So content you remove from a board, images included, can remain in a copy until its window runs out. An image held by a copy is kept, and keeps counting toward your storage allowance, for as long as that copy lasts, which can be well past the month described above. Restoring a version makes a second copy of its images, and that copy counts toward storage. A board left in the trash is permanently deleted after 30 days, which deletes its copies too, and deleting your account deletes them with the rest of your cloud data on the timeline above.
Accounts that lapse. We do not keep cloud data forever just because you stopped using it. 90 days after a subscription or trial ends without being renewed, the account is automatically scheduled for deletion, and it then follows the same timeline as a deletion you request yourself: taken out of service after 30 days, permanently erased 90 days after scheduling. Your local files are untouched by this. It applies only to what is stored in the cloud.
Security and audit records. Kept for security and abuse investigation. These are not yet on an automatic expiry schedule; we are adding one that will delete them after 12 months, and until it is running we are not promising a shorter period than we actually enforce.
Visit statistics. The aggregate counts Plausible holds for this website have no fixed expiry. They carry no identifier that could be traced back to you, and the daily salt used to count unique visitors is deleted every 24 hours, so a day's figures cannot be re-linked to a visitor afterwards.
Optional analytics (HeyCatch). According to HeyCatch's agreement, for as long as our HeyCatch subscription is active and for 2 months after, then deleted or anonymised (except StreamLake's logs), as described under optional analytics above. In your browser: the cookie lasts 90 days from your last visit, session storage goes when the tab closes, and the rest stays until you withdraw or clear your browser's data.
Your analytics choice. Kept in your browser for 12 months, and then we ask again. We do not receive it.
The macOS notification list. Until the launch announcement has been sent, after which the list is deleted. Addresses that were entered but never confirmed were never stored at all.
The Moodis newsletter. Your address stays on the list until you unsubscribe or ask us to remove it. As with the macOS list, an address that was entered but never confirmed was never stored.
Link clicks in list emails. Held in our Resend account, under Resend's retention for email events, and nowhere else -- we keep no copy. We have not set a shorter period there, and would rather say so than name one we do not enforce. Ask us and we will tell you what it holds for your address, or delete it.
Consent records. The hashed address, the list, the wording you agreed to and the date. Kept for as long as we run the list and for three years after, because that is how long we could be asked to show that consent was given. This one is not yet on an automatic schedule, and the reason is the period itself: the three years start when we retire a list, which is a decision we make rather than a date stored beside your record, so there is nothing for a job to count from. We do it on request and by hand, and we would rather say so than claim a schedule we do not keep.
Newsletter discount codes. The hashed address, the code and its issue date. A scheduled job in our database runs every day and deletes these 30 days after the code expires, which is 60 days after it was issued. One consequence worth stating plainly: this record is what stops one address being sent a second code, so once it is deleted that address could be offered the discount again. We would rather that than keep a record of you indefinitely in order to hold it against you.
Feedback emails. Kept in our support inbox as long as the correspondence is useful, along with the reply address if you gave one. Ask us and we will delete the thread.
Payment records. As long as tax and accounting law requires.
After an account is erased. We keep a minimal record that the deletion happened, including the email address it applied to, so we can show the request was honoured. Security-log entries are unlinked from your account but the entries themselves remain, subject to the point above.

Children

Moodis is not directed at children under 13, and we do not knowingly create accounts for them. If you believe a child has given us personal data, contact us and we will remove it.

Changes to this policy

When what we do with data changes, this page changes with it and the date at the top is updated. If a change materially affects you, we will tell you in the app or by email rather than relying on you to re-read this page.

Contact

For questions, requests, or something on this page that does not match what you see in the product, write to support@moodis.app.

Privacy Policy