Privacy Policy

Last updated: September 7, 2026

This Privacy Policy explains how personal information is handled across the Moozgy website (moozgy.com) and the Moozgy iOS app. In this document, "Moozgy," "we," "us," and "our" refer to the individual founder who owns and operates the Moozgy project as a sole proprietor, currently based in Italy (contact details in Section 10 below). "You" means the person using the website or the app. Operation of Moozgy and this policy may be assigned to a company formed for the Moozgy business in the future (see the Terms of Use, General provisions).

By using the website, creating a Moozgy account, or using the Moozgy app, you acknowledge this Privacy Policy. If you do not agree, please do not use the website or the app. See also the Terms of Use, which governs your use of the app and any purchase.

1. What we collect

We deliberately collect as little as possible, and what we collect differs between the website and the app itself.

On the website

• Email address — only if you voluntarily submit a sign-up, waitlist, gift-purchase, or Founder form.
• Sign-up details — alongside your email we record the plan you chose (free / waitlist / Founder / gift), which form on the page you used, the date and time, and — if you arrived through a referral or campaign link — a short referral code identifying the source.
• Cookie consent choice — whether you accepted or declined cookies (see Section 3).
• Shared-problem page analytics — if you open a problem someone shared with you, we record that the page was viewed and whether you tapped the call-to-action, together with the share code and the referring user's id. These events carry no account and no personal identifier of yours.

We do not use third-party analytics trackers, advertising pixels, fingerprinting, or browser local storage on the website.

In the app

Creating a Moozgy account and using the app involves more information, because the app is a real product with an account, a subscription, and AI features:

• Account information — the email address (or Sign in with Google / Sign in with Apple identifier) you use to create your account, the handle (username) and display name you choose, and the name your sign-in provider passes to us. Your handle is public; see "What other people can see" below.
• Date of birth — Moozgy is for people aged 13 and over, and every sign-up path asks for your date of birth to check that. For an account, we store the date on your profile; it is never shown to other users. If you use the app as a guest, your date of birth stays on your device only and is never sent to us.
• Country or region — taken from your device's own region setting (not from GPS or any location sensor) and stored on your profile, so we can put you in the right pool for the "Local" leaderboard.
• Learning and usage data — problems you have seen and whether you got them right, answers, streaks, difficulty level, XP and achievements, session activity, and how you interact with the feed, Coach, and Explain features. This is what makes the adaptive difficulty and coaching work. Your detailed progress record is synced to your account so it survives a reinstall and follows you to a new device.
• Product-analytics events — first-party, in-house events (screens reached, onboarding and paywall steps, features used) recorded with a session id, your app version, and either your account id or, before you have an account, a random identifier generated on your device so pre-sign-up steps can be joined to the account you later create. You can turn product analytics off at any time in Settings, and we use no third-party analytics SDK.
• Contacts (optional, on-device hashing) — if you choose to look for friends already on Moozgy, the app reads the email addresses in your contacts, converts each one into a one-way SHA-256 hash on your device, and sends only those hashes to our server to match against other users. We never receive your contacts' names, raw email addresses, or phone numbers; the hashes are used for the lookup and are not stored on either side. The app does not read your contacts' phone numbers at all. Nothing happens here unless you open "Find friends" and grant iOS contacts permission, and permission can be withdrawn at any time in iOS Settings.
• Purchases — if you buy Moozgy Full Brain or redeem a gift or promo code, we record that the purchase or redemption happened, which transaction it corresponds to, and its status, so we can unlock your access. We never receive or store your card number; App Store purchases are billed and processed entirely by Apple.
• AI feature content — when you use Explain Anything, the Coach, or Coach-generated card sets, we send your question or the source material you provide — text you type or paste, and images or documents you upload — to our AI provider (see Section 4), together with minimal learning context, so it can answer or build your cards. We do not retain your uploaded source material. Files and the text extracted from them exist only for as long as it takes to answer your request, and are never written to our servers. We do save the card sets you create, so they are there when you come back, and we save reported answers when you report one. We do not store the text of your questions or the AI's answers otherwise. We record only the technical usage of each request (which feature, which model, token counts and cost) so we can meter fair use and control our costs. Your "Explain Anything" history is kept on your own device.
• Reports — if you report a problem as wrong or unclear, we receive the problem, the answer you gave, the reason you selected, and any note you type. If you report an AI answer, we also receive that answer and the question that produced it. If you report another person, we receive their handle as it read when you reported them, the reason you chose and any note you type. Reports are read only by our team, and the person you report is never told who reported them. We keep reports after an account is closed, with the link to the account removed, so that a record of abuse cannot be erased by deleting and re-registering.
• Email preference — whether you opted in to hear from us about Moozgy news.
• Technical data — standard information any server necessarily sees on a request, such as your IP address and the request metadata your device's network stack sends, held in our backend's operational logs.

We do not ask for, and do not intentionally process, precise location, payment card numbers, health data, or biometric data. Our Terms ask you not to upload source material containing them; because we do not retain uploaded material, anything that reaches us incidentally is discarded once your cards are made. We do not use advertising, attribution, or third-party tracking SDKs, we do not track you across other companies' apps or websites, and we do not sell any of the above.

What other people can see

Moozgy has leaderboards and friends. Other users can see your handle, the number of problems you have solved, and your rank — on the global board, on your region's local board, and among your friends. Your real name, email address, date of birth, and detailed progress are never shown to other users. You can remove yourself from the public global and local boards at any time in Settings; your friends board is unaffected.

Sets you publish. If you choose to make a card set public, the set's title, its subject, and the full text of every card in it become readable by anyone who has the set's link, including people who are not Moozgy users. We do not attach your name, handle, email address, or any other detail about you to a public set — a visitor sees the cards and nothing about who made them. What the cards themselves contain is up to you; please read the "Sets you publish" section of our Terms before publishing one.

2. How and why we use your information

We use the information above only to:

• create and operate your account, sync your progress across your devices, and deliver the app's core features — legal basis: performance of a contract (GDPR Art. 6(1)(b));
• run the adaptive difficulty engine, the leaderboards, and the AI Coach / Explain features you use — legal basis: performance of a contract;
• check that you meet the 13+ age minimum — legal basis: legal obligation and legitimate interests (Art. 6(1)(c) and (f));
• match you with friends who separately opted in to contact matching, using only on-device hashes — legal basis: consent (Art. 6(1)(a));
• understand how the app is used in aggregate so we can improve it, using our own first-party analytics that you can switch off in Settings — legal basis: legitimate interests (Art. 6(1)(f));
• process subscription purchases, trials, gift codes, and promo redemptions, and keep the public "spots claimed" counter on the website accurate — legal basis: performance of a contract / legitimate interests;
• act on problem reports and support requests you send us — legal basis: legitimate interests;
• tell you about Moozgy launch news or account-related updates, and attribute website sign-ups to referral links — legal basis: consent for marketing email and for the referral cookie; legitimate interests for service messages;
• keep the app secure, enforce fair-use limits, prevent abuse, and comply with legal obligations — legal basis: Art. 6(1)(c) and (f).

If someone sends us a copyright complaint about a set you published, we pass their notice — including their contact details — to you, and we pass any counter-notice you send back to them. United States copyright law requires this, and it is the only way either of you can resolve the dispute.

We do not sell your personal information, "share" it for cross-context behavioral advertising, or use it for automated decision-making producing legal or similarly significant effects. Any marketing email will include a way to opt out.

3. Cookies (website)

The website uses a small set of first-party cookies (no third-party tracking or advertising cookies). The functional cookie is only written after you press "Accept" on the cookie banner. If you press "Decline," we store only your choice and remove the rest. The app does not use cookies; it uses a securely stored session token to keep you signed in.

These are plain first-party cookies stored only in your browser (SameSite=Lax, and Secure when served over HTTPS). You can withdraw cookie consent at any time by clearing this site's cookies in your browser; the banner will reappear on your next visit.

4. Service providers (processors)

• Supabase — the app's backend: authentication, the problem database, your synced progress, the social and leaderboard graph, and the AI edge functions described below all run on Supabase (Postgres + edge functions), acting as our data processor. See Supabase's privacy policy.
• Anthropic — powers Explain Anything, the Coach, and Coach-generated card sets through Claude. Your questions and any source material you provide are sent to Anthropic to produce the response. Anthropic does not use these inputs or outputs to train its models, and automatically deletes them within 30 days. See Anthropic's privacy policy.
• Apple — Moozgy Full Brain purchases, free trials, and Sign in with Apple are handled by Apple through StoreKit and your Apple ID; Apple acts as its own controller for the payment and account data it collects. See Apple's privacy policy.
• Google — website sign-ups are stored in a private Google Sheet via Google Apps Script, the website loads fonts from Google Fonts, and the app offers Sign in with Google; in each case Google receives your IP address and request metadata, as with any web request. See Google's privacy policy.
• Stripe — if you purchase the website's Founder plan or a gift of Moozgy, checkout happens entirely on Stripe, Inc.'s hosted payment page. Stripe receives your email address and independently collects and processes your payment details; we never see or store your card number. Stripe acts as its own controller for fraud prevention and compliance. See Stripe's privacy policy.

We disclose personal information to no other recipients, except if required by law, court order, or governmental authority, to enforce our terms, or in connection with a sale, merger, or transfer of the Moozgy business (in which case the recipient remains bound by this policy).

5. International data transfers

The founder operates from Italy; our service providers (Supabase, Anthropic, Apple, Google, Stripe) store or process data primarily in the United States. Where personal data of EEA/UK residents is transferred outside the EEA/UK, the transfer relies on the providers' compliance mechanisms, including the EU–US Data Privacy Framework and/or Standard Contractual Clauses.

6. Data retention & deletion

Website sign-up information is kept until Moozgy launches and any promised benefits have been delivered, plus a reasonable period thereafter (no longer than 24 months after launch), or until you ask us to delete it — whichever comes first.

Account data in the app is kept for as long as your account is active. Product-analytics events are in any case retained for no longer than 24 months, after which they are deleted automatically. Uploaded source material is not retained on our servers at all. Card sets you create are kept for as long as your account is active, and are deleted with your account. A set you make private again stops being readable from its link immediately, and a set we remove for breaking our rules stops being readable at the same moment. Both stay in your own account until you delete them, and both are deleted with your account. We cannot recall copies that people who opened the link have already saved.

You can delete your account and its associated data directly in the app (Settings → account deletion). This permanently removes your profile, date of birth, synced progress, friendships, AI usage records, and purchase links from our systems; historical analytics events are irreversibly detached from you and kept only in de-identified form. Reports you filed or were named in (content_reports) are kept as described in Section 1, with the link to your account removed rather than the report deleted. Records we must keep for legal, tax, or fraud-prevention purposes are retained, and backups age out on a routine schedule. You can also request deletion at any time by emailing us (Section 10).

7. Your rights

Everyone: you may request access to, correction of, or deletion of your data, or opt out of non-essential emails, at any time by emailing us (Section 10) or, for account data, using in-app account deletion. We will respond within 30 days.

EEA / UK residents (GDPR): you additionally have the rights to restriction of processing, data portability, objection to processing based on legitimate interests, and withdrawal of consent at any time (without affecting prior processing). You also have the right to lodge a complaint with a supervisory authority — in Italy, the Garante per la Protezione dei Dati Personali (garanteprivacy.it), or the authority of your habitual residence.

California residents: although Moozgy does not currently meet the thresholds that make the CCPA/CPRA apply, we voluntarily honor its core rights: to know what we collect (this policy), to delete, to correct, and to non-discrimination for exercising those rights. We do not sell or share personal information as those terms are defined in the CPRA, and we have not done so in the preceding 12 months.

8. Children

Moozgy is a general-audience product for people aged 13 and over. It is not directed to children under 13, it is not offered in the App Store Kids Category, and we do not knowingly collect personal information from anyone under 13. Every path into the app — email sign-up, Sign in with Google, Sign in with Apple, and guest — asks for your date of birth first and refuses to continue if you are under 13.

In some EEA countries, national law sets a higher age (between 13 and 16) below which a parent or guardian must consent to online services being provided to a child. If you are in one of those countries and are below that age, please use Moozgy only with your parent's or guardian's permission.

If you believe a child has created an account or submitted an email address, contact us (Section 10) and we will delete it promptly.

You must be at least 18 (or the age of majority where you live) to make a purchase.

9. Security

We use reasonable technical and organizational measures appropriate to the scale of the data we hold: all traffic runs over HTTPS, access to backend systems is restricted and credential-protected, database access is governed by row-level security scoped to your own account, the queued analytics on your device is stored in a protected, backup-excluded file, payments are handled by Apple and Stripe (PCI DSS Level 1), and the website itself stores nothing server-side beyond the sign-up sheet. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security; if a breach affecting your data occurs, we will notify you and the competent authorities as required by applicable law.

10. Contact

Privacy questions, access/deletion requests, or opt-outs: hello@moozgy.com.

11. Changes to this policy

We may update this page from time to time. The "Last updated" date above will change, and material changes will be highlighted on this page. If you have an account and a change materially affects how your information is used, we will notify you at your account email before the change takes effect.