Privacy Policy

This Privacy Policy explains how MoonSignal ("MoonSignal", "we", "us") collects, uses, shares, and protects personal information when you use our website, web application, and related services (together, the "Service"). It also explains your privacy rights and how to exercise them.

MoonSignal is a self-reflection tool. It uses your birth date, time, and place together with your quiz answers to describe behavioral patterns and tendencies. It does not predict the future and is not a medical, psychological, legal, or financial service.

1. Who we are (data controller)

The data controller responsible for your personal information is Heorhi Chukhlei, a sole proprietor registered in Poland (ul. Bolesława Prusa 24, 80-447 Gdańsk, Poland; NIP 5842834317) ("MoonSignal"). MoonSignal is operated by this sole proprietorship rather than a company; if this changes, we will update this section and notify you as described in Section 16.

Contact for all privacy matters: support@getmoonsignal.com. Because we are established in the European Union, the EU General Data Protection Regulation (GDPR) applies to all our processing of personal data, wherever you live. Where your local law grants you additional rights (for example in the UK, the United States, Brazil, Canada, or Australia), we honor those as described in Section 11.

2. Summary (short version)

We collect your email, birth details, quiz answers, and optional journal entries to provide the Service. Birth details are treated as sensitive information: they are used only to calculate your chart and generate your content, are never sold, never used for advertising, and never shared with data brokers. You can access, correct, or permanently delete everything at any time from your account settings, and request a full export of your data by emailing support@getmoonsignal.com. The rest of this policy is the detailed version of that promise.

3. Information we collect

Information you provide directly:

• Account data — your email address and, if you add one, your name. You can begin the quiz anonymously; an anonymous account holds your data until you claim it with an email address.
• Birth data — your date of birth, time of birth (optional), and place of birth. We treat birth data as sensitive personal information and apply heightened protection to it regardless of how it is classified under any particular law.
• Quiz answers — your responses to our onboarding and reflection questions about how you experience relationships, work, and self-worth.
• Journal and reflection entries — optional free-text notes and daily check-in responses you choose to record.
• Bonds data about other people — if you use the Bonds (compatibility) feature, the name, relationship label, and birth details of another person that you enter. See Section 12 for how we handle other people's information.
• Support communications — messages you send us and our replies.

Information collected automatically:

• Usage and device data — app interactions and screen views, device type, operating system, browser type, language, approximate (city-level) location derived from your IP address (the IP address itself is discarded and not stored), crash/diagnostic logs, and session recordings of how pages are used (every form field and everything about you — your chart, patterns, Today, readings, and Compatibility — is masked before anything leaves your browser; the recording keeps layout and clicks, not words). We collect this through the analytics provider listed in Section 6, and in the EEA, UK, and Switzerland only after you consent via our cookie banner.
• Cookies and similar technologies — see Section 7.
• Security signals — our sign-in and sign-up flows are protected by Cloudflare Turnstile, which evaluates technical browser signals to distinguish humans from bots without tracking you across sites.

Information from third parties:

• Payment and subscription status — if you subscribe to Premium, Stripe (Section 6) tells us the email address you paid with, your plan, a customer and subscription identifier, and your subscription status and dates (trial, renewal, cancellation, refund). We use this only to open Premium in your account and to send the reminders described in Section 14. We never receive or store your card number.

We do not collect your contacts, precise GPS location, photos, biometric data, health data, or government identifiers, and we do not ask for access to them.

4. How we use information and our legal bases

Under the GDPR, every use of personal data needs a legal basis. Ours are:

• To provide the Service (calculate your chart, generate your Pattern Blueprint and daily signal, run Bonds comparisons, maintain your account, process payments) — performance of a contract (Art. 6(1)(b) GDPR).
• To keep the Service secure (bot prevention, abuse detection, access controls, fraud prevention) — legitimate interests (Art. 6(1)(f)) in protecting the Service and its users.
• To understand and improve the Service (aggregate analytics, crash diagnostics, feature usage) — legitimate interests in improving our product; in jurisdictions and contexts where consent is required for analytics cookies or SDKs, we rely on your consent (Art. 6(1)(a)), which you can withdraw at any time.
• To communicate with you (service emails such as sign-in links, receipts, and important changes) — performance of a contract; marketing emails, if we ever send them, only with your consent, with a working unsubscribe link in every message.
• To comply with law (tax, accounting, responding to valid legal requests) — legal obligation (Art. 6(1)(c)).

What we never use your data for: we do not sell personal information, we do not share it with data brokers, we do not use birth data or quiz answers for advertising or ad targeting of any kind, and we do not use your personal data to train artificial intelligence models.

5. Automated processing

Your Pattern Blueprint is generated by deterministic, rule-based software that maps your chart and quiz answers to pre-written, human-reviewed content. The output is reflective content for your own consideration. We do not use your data to make automated decisions that produce legal effects or similarly significant effects on you (such as decisions about credit, employment, insurance, or housing), within the meaning of Art. 22 GDPR and equivalent laws.

6. Who we share information with

We share personal data only with service providers ("processors") that help us run the Service, under contracts that restrict them to processing on our instructions, and with no one else except as required by law. Our current providers:

• Supabase — database, authentication, and storage (account data, birth data, quiz answers, generated content, subscription status). Data is stored in the European Union.
• Cloudflare — application hosting, content delivery, security, and Turnstile bot protection.
• Stripe (Stripe Technology Europe, Limited, Ireland, and its affiliates, through the Link service) — processes Premium payments as merchant of record, including tax, receipts and payment support. Stripe collects your payment details directly on its checkout page and acts as an independent controller of that billing data; see Stripe's and Link's privacy policies. We pass Stripe only your account email and an internal account ID, so a payment can be matched to your account.
• Resend (Resend, Inc., United States) — delivery of service emails: sign-in codes, trial-ending and renewal reminders. Only your email address and the content of that email are processed.
• AI providers — today none of your content is generated by AI: every text in MoonSignal is pre-written and selected by rules from your chart, so nothing about you is sent to an AI provider. If we enable AI-assisted content in the future, we will update this policy first; at most, chart-derived placements and relevant quiz answers would be processed server-side under a zero-retention configuration, and your email, name, and journal entries would never be sent.
• PostHog (PostHog Inc., data hosted in the European Union) — product analytics, session recordings with all inputs masked, and error reporting. Event data is pseudonymous: it is linked to a random identifier and, once you have an account, to your internal account ID — never to your email. We do not send birth data, quiz answers, your name, email, or journal content to PostHog. Configured without advertising features.
• Sentry (Functional Software, Inc., data hosted in the European Union) — error alerts. When something breaks, we send the error type, the error message with emails and dates removed, the code location, and the page address without query parameters. No account ID, name, birth data, or quiz answers, and IP addresses are not stored. In your browser, errors are sent only if you consent to analytics.
• Open-Meteo — city-name geocoding during onboarding. Only the place name you type is sent; it is not linked to your identity or account.

We may also disclose information if required by law or valid legal process, to protect the rights, safety, or property of MoonSignal or others, or as part of a merger, acquisition, or sale of assets — in which case this policy will continue to apply to your data and we will notify you of any change of controller.

7. Cookies and similar technologies

We use strictly necessary cookies and local storage for sign-in sessions and security (including Cloudflare Turnstile). These cannot be switched off because the Service does not work without them. We use analytics cookies and SDKs (PostHog) to understand aggregate usage; where required by law (including the EEA and UK), these are set only after you consent via our cookie banner, and you can withdraw consent at any time in Cookie settings. We do not use advertising or cross-site tracking cookies.

8. International data transfers

Your data is primarily stored in the European Union. Some of our providers are based in the United States or process data there. Where personal data is transferred outside the EEA, UK, or Switzerland, we rely on safeguards recognized by applicable law: an adequacy decision (including the EU–US Data Privacy Framework for certified providers) and/or the European Commission's Standard Contractual Clauses, supplemented where appropriate by encryption and data minimization. You can request a copy of the relevant safeguards via support@getmoonsignal.com.

9. How long we keep information

• Account, birth data, quiz answers, generated content, journal entries — kept while your account exists; permanently deleted when you delete your account. Accounts not signed into for more than 2 years with no active subscription may be deleted after we email you at least 30 days in advance.
• Unclaimed anonymous quiz sessions — kept until claimed with an email address; we periodically delete unclaimed sessions that are more than 90 days old.
• Subscription records — plan, status, and dates are kept while your account exists. Payment and tax records held by us are kept for the period required by Polish tax and accounting law (generally 5 years from the end of the relevant tax year); Stripe keeps its own records under its policy.
• Analytics data — pseudonymous event data is retained by our analytics provider for no longer than 14 months, then deleted or aggregated. Session recordings are kept for no longer than 90 days.
• Support correspondence — up to 24 months after the ticket is closed.

When you delete your account, all rows associated with your user ID — including birth data, charts, blueprints, quiz answers, journal entries, and any Bonds records you created — are deleted from our production database. Any backup copies are deleted within 30 days.

10. How we protect information

We apply technical and organizational measures appropriate to the sensitivity of the data: encryption in transit (TLS) and at rest; row-level security in our database so that each account can only ever read its own records, verified by automated tests; server-side-only secrets (no API keys in the client); minimal data collection by design (for example, we do not keep a separate registry of birth inputs and we do not write birth data to request logs); access on a need-to-know basis; and bot and abuse protection on authentication endpoints. No system is perfectly secure, but if a breach occurs that risks your rights, we will notify you and the relevant supervisory authority as required by law (including within 72 hours where the GDPR applies).

11. Your privacy rights

Everyone, everywhere: regardless of where you live, you can access, correct, and permanently delete your data directly in the app (My Space → your details, and Account → Delete account & data), and request a portable export of your data by emailing support@getmoonsignal.com. We do not discriminate against you for exercising any privacy right.

European Economic Area, United Kingdom, and Switzerland: you have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection to processing based on legitimate interests (Art. 21), and withdrawal of consent at any time without affecting prior processing (Art. 7(3)). You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (Prezes UODO, uodo.gov.pl); in the UK, the Information Commissioner's Office (ico.org.uk); or the authority where you live.

United States: if you live in California or another state with a comprehensive privacy law (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, Delaware, Iowa, Indiana, Tennessee, New Hampshire, New Jersey, Kentucky, Nebraska, Minnesota, Maryland, and Rhode Island), you have rights to know/access, correct, delete, and obtain a portable copy of your personal information, and to opt out of the sale of personal information, its sharing/processing for targeted advertising, and certain profiling. We do not sell personal information and do not share it for cross-context behavioral or targeted advertising, and we have not done so in the preceding 12 months; there is therefore nothing to opt out of, but you may still submit a request at support@getmoonsignal.com. We treat birth data and quiz answers as sensitive personal information and use them only to provide the Service you request, which means no separate "limit use of sensitive personal information" action is needed. We honor Global Privacy Control (GPC) signals where legally required. California residents: the categories of personal information we collect are identifiers (email, pseudonymous IDs), sensitive personal information (birth data), other personal records (quiz answers, journal entries), commercial information (subscription status), and internet activity (usage data), collected for the purposes in Section 4 and disclosed only to the service providers in Section 6. You may appeal a denied request by replying to our decision email; if the appeal is denied, you may contact your state attorney general.

Brazil (LGPD): you have equivalent rights of confirmation, access, correction, anonymization, deletion, portability, and information about sharing, and the right to complain to the ANPD. Canada (PIPEDA): rights of access and correction, and the right to complain to the Office of the Privacy Commissioner. Australia (Privacy Act): rights of access and correction, and the right to complain to the OAIC. Residents of other jurisdictions may exercise the rights granted by their local law through the same contact.

We answer verified requests within 30 days (or the shorter period your local law requires) and free of charge, except where the law allows a fee for manifestly excessive requests. To protect your data, we may need to verify your identity — normally by confirming control of the email on the account. An authorized agent may submit a request on your behalf with proof of authorization.

12. Information about other people (Bonds)

The Bonds feature lets you enter another person's name, relationship to you, and birth details to see a compatibility reading. By entering this information you confirm that you are legally permitted to provide it. We use it solely to generate the reading shown to you, never to contact that person, build a profile of them, or for any other purpose, and it is deleted when you delete the Bond or your account. If you believe someone has entered your information into MoonSignal and you want it removed, email support@getmoonsignal.com and we will delete it.

13. Children

The Service is not directed to children and is available only to users aged 16 or over (or older where local law sets a higher age of digital consent). We do not knowingly collect personal information from anyone under 16. If we learn that we have, we will delete it promptly. If you believe a child has provided us personal information, contact support@getmoonsignal.com.

14. Marketing and communications

We send transactional emails needed to run the Service: sign-in codes, security and policy notices, and — if you subscribe — a reminder 2 days before a free trial ends and 7 days before a yearly renewal (receipts and billing emails come from Stripe/Link). We send marketing or product-news emails only if you opt in, and every such email contains an unsubscribe link that works immediately. You can also switch them on or off at any time in Account → Notifications. We do not send marketing text messages and we do not permit third parties to market to you based on your MoonSignal data.

15. Third-party links and services

The Service may link to third-party websites (for example, Stripe's checkout and link.com). Their privacy practices are governed by their own policies, which we encourage you to read.

16. Changes to this policy

We may update this policy as the Service or the law changes. The "Last updated" date above always reflects the current version. For material changes — especially any change to how we handle birth data — we will give you prominent advance notice in the app or by email before the change takes effect, and where required by law we will ask for your consent. Earlier versions are available on request.

17. Contact

For any question, concern, or request about your personal data: support@getmoonsignal.com. If you are not satisfied with our response, you may contact your data protection authority (Section 11) at any time.