Draft text: the publisher is not yet identified. This document is not in force.
Moai privacy policy
The French version is the reference text.
In short
- Moai is a private space: what you post in a circle is visible only to the members of that circle.
- No advertising, no selling or passing on of your data, no advertising trackers, no profiling.
- Your data is hosted in the European Union.
- Your photos are never analysed: no face recognition, no training of an artificial intelligence model.
- Artificial intelligence features run on your device; nothing is sent to an AI service.
- You can export your data and delete your account at any time, in the app or on the deletion page.
The details follow.
1. Who is responsible for your data
The data controller is [à compléter : editeur_nom], [à compléter : editeur_forme_juridique], [à compléter : editeur_adresse]. For any question about your data or to exercise your rights: moreaust+moai@gmail.com.
What the members of a circle share with each other belongs to their private and family life. Each member remains responsible for what they post there, in particular photos of other people.
2. The data Moai processes
Moai only collects what is needed to make the app work.
| Data | What it is for | Legal basis | Retention |
|---|---|---|---|
| Email address | Signing you in (link sent by email, or your Google account), writing to you about your account | Performance of the contract | Until the account is deleted |
| If you choose "Continue with Google": the identifier of your Google account, and the name and profile picture Google sends us with your address | Recognising your account each time you sign in. The name and picture are neither displayed nor used: your Moai profile is the one you fill in | Performance of the contract | Until the account is deleted |
| First name, profile photo or emoji, language, time zone | Presenting you to the members of your circles, showing dates at the right time | Performance of the contract | Until the account is deleted |
| Day and month of your birthday (optional, never the year) | Reminding your circles a week before | Your consent, given by filling it in | Until you remove it |
| Email address of a person invited by email who has no account yet, with the circle and the person inviting them | Making the guest join the circle when they sign in with that address | Legitimate interest (inviting a relative at a member's request) | Fifteen days at most, or until they join the circle, the invitation is cancelled or the person who invited them deletes their account |
| Membership of your circles and role | Knowing what you can see and do | Performance of the contract | Until you leave the circle |
| Invitation of someone close to you into a circle: the circle, the person invited, the person inviting, the date and, where applicable, the refusal. Only people you already share a circle with can invite you; you only join a circle if you accept | Offering you to join another circle, and honouring your refusal | Performance of the contract | Fifteen days at most; fifteen days after a refusal; erased as soon as you join the circle, it is cancelled, you no longer share a circle with the person, or either of you deletes their account |
| What you post: messages, comments, photos, recipes, events and replies, votes, places and addresses, meals (including the dishes you bring), groceries, expenses, car sharing, lodging, things to bring | The service itself | Performance of the contract | Until you delete it, delete your account, or the circle is deleted |
| Date and place a photo was taken | Sorting photos; the place is only kept if a circle admin has turned that option on | Performance of the contract | Same as the photo |
| "My lodgings" | Your personal records, visible to you only | Performance of the contract | Until you delete them or your account |
| Your recipes | They are yours and only you can edit them. A recipe is visible to you only as long as it is not linked to any circle; once linked to a circle, its members can read it, and each of them can keep it in "My recipes" or link it to another of their circles, without copying it (your name only appears there to people you share a circle with). You can remove any of these links | Performance of the contract | Until you delete it or your account; if you delete your account while leaving your content, recipes linked to a circle stay there under an anonymous profile |
| Other members' recipes you keep in "My recipes" (favourites) | Finding them in all your circles; visible to you only | Performance of the contract | Until you remove them, the recipe is deleted, or you delete your account |
| Device notification token; in the web version, the browser's notification subscription (an address specific to the device and two encryption keys) | Sending you the notifications you have allowed | Your consent (system or browser permission) | Until you sign out, or until you withdraw the permission |
| Notification preferences | Respecting your choices | Performance of the contract | Until the account is deleted |
| Acceptance of the terms and declared age, with their date | Proving your agreement | Legal obligation and legitimate interest (evidence) | Five years after the account is deleted |
| Reports you send | Moderating the service | Legal obligation and legitimate interest | Three years |
| Account deletion log (date and mode, no content) | Proving that a deletion took place | Legal obligation | Five years |
| Emails you send through the feedback form ("Beta" button, Settings) to report a bug or suggest an improvement: your email address, your message, and what the app adds to it in front of you (version, phone model, system, language, name of the screen you came from, address of the imported recipe page) | Answering you, fixing and improving the app | Legitimate interest | One year after the last exchange |
| Technical error reports (device type, version, error message, without your email or your content) | Fixing failures | Legitimate interest | 90 days |
| Technical logs and anti-abuse counters | Security of the service | Legitimate interest | One to thirty days |
Moai does not ask for your surname, your phone number, your address, your full date of birth or your contacts.
What Moai does not collect
- Your location. The app never asks for access to your device's location. On Android, it may read the place recorded in your photos to suggest those from an outing; this is computed on the device.
- Your contacts and your calendar. When you use "Pre-fill from my calendar", the calculation is done on your device and nothing from your calendar is sent.
- Your voice. Dictation is transcribed on your device; no recording is kept or sent.
- Your photo library. Only the photos you choose are sent. Camera data (model, settings, location) is removed from each photo before it is sent. Moai does not accept videos.
- Sensitive data. Moai does not ask you for any information about health, opinions, religion or orientation. Avoid writing any in your messages beyond what you would confide to people close to you.
3. Device permissions
Each permission is requested when you use the feature, and you can withdraw it in your phone's settings.
| Permission | Use |
|---|---|
| Photos | Choosing photos to share, suggesting those taken during an outing, saving an album photo |
| Camera | Scanning an invitation QR code, photographing a recipe, taking a photo |
| Notifications | Telling you about an event, a message, a poll |
| Calendar | Adding an outing to your calendar; pre-filling a poll (computed on the device) |
| Speech recognition | Dictating text, transcribed on the device |
4. Who has access to your data
The members of your circles see your profile and what you post in the circle. A circle's admins have no access to your email, your settings or your personal records.
The publisher only accesses a circle's content to handle a report, respond to a request from you, or when required by an authority.
Our providers, who act on our instructions and under contract:
| Provider | Role | Place of processing |
|---|---|---|
| Supabase Pte. Ltd. | Database, files, sign-in, server functions | European Union (Frankfurt, Germany), on Amazon Web Services infrastructure |
| Cloudflare, Inc. | Hosting of this website | European Union and United States |
| Expo (650 Industries, Inc.) | Routing notifications, app updates, hosting the web version | United States |
| Apple and Google; in the web version, the maker of your browser (Apple, Google, Mozilla or Microsoft) | Delivering notifications to your device. In the web version, the notification reaches them encrypted: they cannot read it | European Union and United States |
| Email sending provider | Sending the sign-in link and invitations | Given in the up-to-date list below |
| Sentry (Functional Software, Inc.) | Technical error reports, if enabled | European Union or United States |
| The publisher's mailbox provider | Receiving the emails you write to us (beta feedback, exercising your rights) | Given in the up-to-date list below |
The up-to-date list of our providers can be requested from moreaust+moai@gmail.com.
Other services, only at your initiative. When you type an address, the text entered is sent to your phone's mapping service (Apple) or, on request, to OpenStreetMap, to suggest addresses. Displaying a map uses your device's map service (Apple or Google). When you import from a link, that link's website is consulted, by our servers or by your phone, which then shows it its IP address. When you send a shopping list to Bring!, Bring! receives a link, valid for one hour, to the unchecked items of that list, without your name or the event's name. When you share it as text, it is handed to the app you choose in your phone's share sheet. Moai stores no credentials for any other service. These services apply their own privacy policies.
Signing in with Google, if you choose it. Google (Google Ireland Limited for Europe) identifies you on its own page or in its own window: Moai never sees your Google password. Google then knows that you sign in to Moai and when, and processes that information on its own behalf, under its privacy policy. The email link remains available instead.
We do not sell, rent or pass on your data to anyone.
5. Transfers outside the European Union
Your content is hosted in the European Union. Some providers are established in the United States: they may process technical data there (notification token, text of a notification, error report). These transfers are governed by the European Commission's standard contractual clauses or by the EU-US Data Privacy Framework. You can request a copy from moreaust+moai@gmail.com.
The text of a notification contains what it announces (for example the title of an event and the first name of its author). You can turn notifications off at any time.
6. Retention periods
The periods for each type of data are in the table in section 2. In addition:
- Deleting your account. Your profile, your settings, your personal records and your access are erased immediately. Depending on your choice, what you shared in your circles is deleted, or stays there under an anonymous profile ("Deleted member") that nothing links to you any more. Shared expenses remain in all cases, so as not to distort the other members' balances.
- Deleting a circle. It takes effect fourteen days after its owner's request; all its content is then erased.
- Backups. Technical backups of the database, made by the host or by us, are kept for 7 days at most, then erased.
- On your device. The app keeps a copy of what you have viewed for seven days, so it can work without a network. It is erased when you sign out.
- Export. The archive of your data is available for one hour through a private link, then erased from our servers after one day; a new request replaces the previous one.
7. Your rights
You have the following rights over your data:
- Access and portability: "Export my data", in your profile, gives you an archive of everything you have shared.
- Rectification: you edit your profile and your content in the app.
- Erasure: you delete content where it is, and your account from your profile or on the deletion page.
- Withdrawing consent: you remove your birthday or turn off notifications at any time.
- Objection and restriction: by writing to moreaust+moai@gmail.com.
- Instructions after death: you can tell us what should happen to your data.
We reply within one month. If a photo of you or your child has been posted in a circle without your agreement, you can ask for its removal at the same address, even without an account.
If you believe your rights are not being respected, you can lodge a complaint with the French data protection authority (CNIL, cnil.fr) or with the data protection authority of your country.
8. Security
Exchanges with Moai are encrypted. Data is partitioned by circle at database level: a member can only read the circles they belong to. Files are only accessible through private, time-limited links. Your session is kept in your phone's secure storage.
If a data breach posed a risk to you, we would inform you, and the CNIL, within the time limits set by law.
9. Children
Moai is for people aged 16 or over and does not offer accounts for children. If we learn that an account was created by a younger person, we delete it.
Children may appear in a family circle's photos. These photos stay in the circle: they are not public, not indexed and not analysed. The circle charter asks for the parents' agreement before posting a child's photo.
When you answer an event, you can say how many people come with you and, if you wish, their first name (never a surname, an age or a date of birth; for a child, a nickname is enough). You can also say that a pet is coming, with its name and, if you wish, an icon (cat, dog or fish): this is visible to the circle's members and erased with your account.
10. Cookies and trackers
This website and the app set no advertising cookies and no audience measurement trackers. The web version of the app stores in your browser what is needed to keep you signed in and to work without a network; these items, strictly necessary for the service, do not require consent.
11. Automated decisions and artificial intelligence
Moai makes no automated decisions about you and builds no profile. Artificial intelligence suggestions (formatting a recipe, an event filled in from a message or a web page) are produced on your device and are always submitted to you before being saved.
12. Changes to this policy
This policy has a version number and a date. A significant change is flagged to you in the app before it applies.