Privacy Policy

Effective June 12, 2026Last updated June 14, 2026

Welcome to Mooday. This Privacy Policy explains what data we collect when you use the Mooday mobile application and the Mooday landing page (together, the "Service"), why we collect it, how we use it, and the choices you have.

We keep this policy straightforward because Mooday is a personal journaling product and your trust matters to us. If you have questions, email admin@mooday.app.

1. Who We Are

Mooday is a mood-journaling app built by a small independent team. When this policy says "we", "us", or "our", it means the Mooday team. When it says "you" or "your", it means you as a user of the Service.

2. Information We Collect

Account and Profile Data

When you create an account we collect:

Email address (used for authentication and communications)
Display name and optional profile photo
Preferred language and notification settings
Account creation timestamp and last-sign-in time

Authentication is powered by Supabase Auth. We do not store your password in plain text; it is hashed by the authentication provider.

Mood and Journal Data

When you use the app we store:

Mood check-ins: emotion label, intensity rating, and timestamp
Activity and context tags you attach to a check-in
Free-text notes you write
Photos you attach to an entry (stored in Supabase Storage)
Voice memos you record (stored in Supabase Storage)
Streak data and usage frequency derived from your check-ins

This is your private content and we treat it accordingly. See Section 4.

Push Notification Data

If you grant notification permission, we store a push token on your device and in our database so we can deliver the daily reminders you configure. This is handled by Expo's push notification service.

Device and Diagnostic Data

We plan to collect limited device and diagnostic information to keep the app stable, including:

Device model, operating system, and app version
Crash reports and error logs (tool to be confirmed at launch)
App performance and load-time data

This data is used solely for bug fixing and service reliability. It does not include the content of your journal entries.

Product Analytics Data (App)

We instrument the app with PostHog to collect anonymised product-usage events such as:

Which screens you visit and how long you spend on them
Feature interactions (e.g. "completed sign-up", "created a check-in", "enabled notifications")
Onboarding funnel steps

Analytics events capture what you do in the app, not what you write. See Section 4 for our explicit commitment on journal content.

Landing Page Analytics

The Mooday landing page (the public website at mooday.app) uses two analytics tools. Neither runs inside the mobile app's private journaling experience, and neither collects the content of your mood entries.

Google Analytics measures website traffic and campaign performance, including:

Page views and visitor counts
Traffic sources and marketing campaign attribution (e.g. UTM parameters)
Conversion events such as clicks on "Get the app"

Google Analytics may set cookies in your browser. You can opt out using your browser settings or a standard browser extension.

PostHog captures landing-page behaviour analytics so we can understand how visitors move through the page and where they drop off, including:

Autocaptured clicks and in-page navigation
Conversion funnels (e.g. visit → newsletter sign-up)
Heatmaps of where visitors click and scroll
Session replay (recordings of anonymised page interactions)

Heatmaps and session replays are configured to mask all text and form inputs, so any text you type on the landing page - such as your newsletter email address - is never recorded. PostHog runs with anonymous visitor profiles by default and does not build a personal profile for drive-by traffic.

Cookies and Consent

Google Analytics and PostHog may store first-party cookies or use your browser's local storage to measure visits and behaviour as described above. Today you can decline or remove these through your browser's cookie controls, a privacy extension, or by exercising the objection right in Section 8.

We do not currently show a cookie or consent banner. If we expand to regions that require explicit consent (for example, running paid campaigns targeting the European Economic Area or the United Kingdom), we will add a consent banner that lets you accept or reject analytics cookies before they are set, and we will update this policy accordingly.

3. How We Use Your Data

We use the data we collect to:

Operate the Service - store and sync your mood entries across devices via Supabase
Deliver reminders - send the daily push notifications you configure
Improve the product - understand which features are used and where users drop off, so we can fix problems and prioritise improvements
Provide support - respond to questions or bug reports you send to us
Ensure security - detect and prevent abuse, unauthorised access, and fraud
Comply with law - meet our legal obligations in the jurisdictions where we operate

We do not sell your data. We do not use the content of your personal journal entries for advertising or AI model training.

4. Privacy of Your Journal Content

Your mood check-ins, notes, photos, and voice memos are your private content. We apply the following rules strictly:

Journal content is not sent to analytics tools. When analytics events are collected (Section 2), they capture usage metadata (e.g. "entry created") - never the text, images, or recordings you write or attach.
Journal content is not used for advertising. We have no advertising partnerships, and we do not share your entry content with any third party for commercial purposes.
Journal content is not used to train AI models. We do not feed your personal entries into any machine-learning pipeline.
Analytics never collect sensitive free-text. No journal content, mood notes, or other sensitive free-text fields are ever sent to Google Analytics or PostHog. The landing page collects no journal data at all, and any text typed on the website is masked in PostHog heatmaps and session replays (Section 2).

Your journal data is stored in Supabase under your account and is protected by row-level security so that only your authenticated session can read it.

5. Third-Party Services and Subprocessors

We use the following third-party services to operate Mooday. Each acts as a data processor on our behalf and is bound by appropriate data-protection obligations.

Service	Purpose	Data involved	Status
Supabase	Database, authentication, file storage	Account data, mood entries, media files	Active
Expo	Push notification delivery	Push tokens, notification payload	Active
PostHog	Product analytics, heatmaps & session replay (app + landing page)	Anonymised usage events, masked landing-page interactions	Active
Google Analytics	Landing-page traffic & campaign analytics	Page views, traffic, campaign/UTM data	Active
RevenueCat	In-app purchase entitlements	Purchase metadata, entitlement status	Planned for launch
Crash/diagnostic tool (TBC)	Error and crash reporting	Crash logs, device info	Planned for launch

We do not permit subprocessors to use your data for their own purposes beyond what is necessary to provide their service to us.

6. Purchases

Premium features are purchased through the Apple App Store or Google Play. Payments are handled entirely by those stores - Mooday does not receive or store your credit-card number or full payment details.

RevenueCat handles entitlement verification: it receives a receipt from the app store, confirms whether you have an active subscription, and returns that status to the app. RevenueCat stores purchase metadata (transaction IDs, entitlement identifiers, and timestamps) and links it to your app-store identifier. It does not access your journal content.

7. Data Retention and Deletion

We retain your account and journal data for as long as your account is active. When you delete your account, your data is deleted from our production database within 30 days, subject to any retention obligations imposed by law.

How to Delete Your Account and Data

From inside the app:

Go to Account → Settings → Delete Account
Confirm deletion when prompted
Your data is queued for deletion immediately and purged within 30 days

By email:

If you cannot access the app, send a deletion request to admin@mooday.app with the subject "Account Deletion Request" and include the email address linked to your account. We will process your request within 30 days.

What is deleted:

Your profile and account credentials
All mood entries, notes, tags, and streaks
Attached photos and voice memos from storage
Push tokens and reminder settings

Anonymised, aggregated analytics events (e.g. total check-ins per day across all users) that do not identify you personally may be retained.

For full details of what is deleted, what may be retained, and the timelines that apply, see our Account & Data Deletion Policy.

8. Your Rights

Depending on where you live, you may have the following rights regarding your personal data:

Access - request a copy of the personal data we hold about you
Correction - ask us to correct inaccurate or incomplete data
Deletion - ask us to delete your personal data (see Section 7)
Portability - request your data in a machine-readable format
Objection - object to certain processing, such as analytics

To exercise any of these rights, contact us at admin@mooday.app. We will respond within 30 days. If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your local data-protection authority.

9. Children

Mooday is not intended for users under the age of 16, consistent with our Terms of Service. We do not knowingly collect personal data from anyone under 16. If you believe a child under 16 has provided us with their data, please contact admin@mooday.app and we will delete that data promptly.

10. Data Security

We take reasonable technical and organisational measures to protect your data:

Data in transit between the app and our servers is encrypted using TLS
Data at rest is encrypted by Supabase's managed database and storage infrastructure
Access to production data is restricted to authorised team members on a need-to-know basis
Row-level security in the database ensures each user can only read their own data

No system is completely secure. We cannot guarantee that unauthorised access will never occur. If you believe your account has been compromised, contact admin@mooday.app immediately.

11. International Data Transfers

Mooday is operated by a team based in Singapore. Your data is stored on Supabase infrastructure and may be processed in data centres outside your country of residence (including within Southeast Asia, the United States, or Europe depending on Supabase's regional configuration at the time).

We take steps to ensure that any international transfers of your personal data are protected by appropriate safeguards, such as standard contractual clauses or the data-processing terms of our subprocessors.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. For significant changes, we may also provide notice within the app. Your continued use of the Service after the changes take effect constitutes acceptance of the revised policy.

13. Contact

If you have questions, concerns, or requests related to this Privacy Policy or your personal data, please contact us:

Email: admin@mooday.app

We aim to respond to all privacy enquiries within 30 days.