Privacy

What we store

• Your account: email address and a hashed password. The password itself is never stored — only a one-way hash, which means nobody here can read it, including us.
• What you told us at onboarding: your name, practice level, intention, traditions, and general location. The location is used to work out your timezone, sunrise and sunset.
• Birth details, if you give them: date, time and place of birth, plus the coordinates and timezone we look up from that place. These are optional. Without them we simply say a chart can't be calculated rather than guessing.
• Your conversations with the guides, so you can come back to them.
• A short memory note, generated automatically from your conversations — durable things worth remembering (a preference, an ongoing situation, an item you mentioned), not a transcript. It's visible on Settings, and you can clear it any time with one click.
• Whether you've confirmed your email, and how many of your free messages with the guides you've used.
• Short-lived anti-abuse records. To stop floods of sign-ups, password guesses and unwanted emails, we briefly note when an address or network makes one of those requests. They're stored scrambled (a one-way hash, not the address itself) and cleared out after 48 hours.
• How people use the site, counted by us alone. We record page views and a few key moments (making an account, confirming an email, using a free message, subscribing) so we can tell what's useful. To connect visits over time we set two cookies of our own: a random visitor ID, and a note of the page and site you first arrived from. We keep only the name of the site that sent you (like google.com), never the full address. No advertising or third-party trackers are involved. If your browser sends Global Privacy Control, we don't set either cookie.
• Billing: if you subscribe, Stripe handles the payment and we store only their customer and subscription IDs. Your card number never touches our servers.
• Mailing list: if you sign up for the weekly email, your address and when you confirmed it.
• Opening list: if you asked to be told when paid plans opened, we stored your address and which plan you were interested in. This was separate from the weekly mailing list.

What we don't do

• We don't sell your data. Not to anyone, at any price.
• We don't run advertising trackers or share your data with advertisers.
• We don't email you because you made an account. The weekly email is a separate, explicit opt-in, and you confirm it from your own inbox.

Who else sees it

A few services do specific jobs on our behalf: Anthropic (generates the guides' replies), Railway (hosting and database), Stripe (payments), and Resend (email delivery). Each sees only what it needs to do its job.

Your choices

• Change or remove your birth details any time from Your details.
• Clear what the guides remember about you any time from Settings — it starts fresh from nothing.
• Leave the mailing list from the link at the bottom of any email, or from Settings. One click, no questions.
• Delete your account from Settings. That removes your account, your conversations and your saved details for good — there's no undo and no hidden copy.

Children

Moon & Moss isn't intended for anyone under 13, and we don't knowingly collect their information.

Changes

If this policy changes in a way that matters, we'll say so here and update the date below rather than quietly editing it.