RRE Solutions LLC is the controller of personal information processed through the Service. We have not appointed a Data Protection Officer or an EU representative because the scale of our processing falls below the thresholds at which appointment is mandatory; you may contact us directly for any privacy matter at ray@rre.solutions.

We collect only the information needed to provide the Service. The categories below describe what we collect.

Account information. When you create an account, we collect your email address and, where you sign in with Apple or Google, the name and identity token Apple or Google chooses to share with us. If you sign in with Apple and choose "Hide My Email," we receive a forwarding address ending in @privaterelay.appleid.com and treat it like any other email address.

Information you provide about your characters. If you create a character profile, we store the first name or nickname you choose for the character and the age archetype you select ("baby," "toddler," "big kid," "pre-teen," "teenager," "adult"). On the paid tier, you may also provide a free-text description that adds details about the character. We do not require, and ask you not to provide, sensitive personal information about a child (such as medical conditions, home addresses, school names, government identifiers, or financial information).

Photo for likeness reference (paid tier). On the paid tier, you may upload a photo to anchor a character's likeness in illustrations. The photo is transmitted to our processing layer in memory only and is never written to our long-term storage. We forward the photo to a third-party artificial intelligence provider (Google's Gemini API, paid tier) which generates a short text description of the character, a set of style tokens used to keep the character visually consistent across pages, and a generated cartoon reference image. We retain the text description, style tokens, and generated cartoon image with the character profile and discard the original photo bytes after the request completes. We do not generate, store, or use facial-recognition embeddings or any other biometric identifier derived from your photo. By uploading a photo, you confirm that you are the parent or legal guardian of the person depicted and that you have authority to provide the photo for this purpose.

Subscription information. If you purchase a paid subscription, we receive your subscription status (active, lapsed, in trial, etc.) and an opaque transaction identifier from our subscription provider, RevenueCat. The actual payment is processed by Apple App Store or Google Play; we do not see your payment card or financial account.

Device and usage information. We use Expo Application Services ("EAS") to deliver over-the-air application updates and to collect anonymous app-open and crash telemetry through Expo Insights. This telemetry is associated with an anonymous installation identifier, not with your account.

Product analytics. To understand which features are used, which screens load slowly, and where story generation drops off, we use PostHog. After you sign in, PostHog associates events with your WorkOS user identifier (an opaque identifier — not your email or name) and a small set of properties such as your tier and language. We do not enable session recording, do not capture the text you type into input fields, and do not engage in cross-app or cross-site advertising tracking. You can opt out at any time from Settings → About → "Help improve Moonmoth"; opting out stops sending events from your device immediately, and we will delete your PostHog data when you delete your account.

Marketing website (moonmothapp.com). Our marketing website is hosted on Amazon Web Services (S3 and CloudFront). Standard HTTP request metadata (your IP address, the page you requested, your user agent) is briefly visible to AWS to deliver the page to you. The website does not set cookies, does not use analytics, and does not include any advertising or tracking code. No cookie banner is shown because none is required.

We use the information we collect to provide and operate the Service, including to (a) authenticate you and keep you signed in; (b) generate the stories, illustrations, narration, and soundscapes you request; (c) deliver application updates and diagnose crashes; (d) confirm and manage your paid subscription; (e) communicate with you about your account or about issues affecting the Service; (f) detect and respond to fraud, abuse, and violations of our Terms of Service; and (g) comply with our legal obligations.

We do not use your information for any kind of cross-app or cross-site advertising, profiling, or behavioral targeting.

If you are in the European Economic Area, the United Kingdom, or another jurisdiction that requires us to identify a legal basis for processing personal information, we rely on the following bases:

We use Google's Gemini API to generate story text, illustrations, narration audio, and ambient soundscapes. We are on the paid Gemini API tier, which contractually does not retain inputs and does not use inputs to train Google's models. We do not use your stories, characters, photos, or other inputs to train artificial intelligence models, and we do not authorize any subprocessor to do so.

We rely on a small number of third-party service providers ("subprocessors") to operate the Service. Each handles a specific function and acts only on our instructions, under written terms equivalent to those required by Article 28 of the GDPR where applicable.

We are located in the United States. Some of our subprocessors are also located in the United States or process data internationally. Where we transfer personal information from the European Economic Area, the United Kingdom, or Switzerland to a country that has not been determined to provide an adequate level of protection, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable) as the transfer mechanism.

The Service is intended for parents and legal guardians and is not directed to children under 13 (or under 16 in the EEA and UK). We do not knowingly permit children to create accounts or interact directly with the Service.

When you, as a parent or legal guardian, provide information about your child (such as the child's first name, age archetype, or, on the paid tier, a photo for likeness reference and free-text descriptors), you are acting on behalf of your child and on the basis of your consent as the child's parent or guardian. We treat this information with the same protections that apply to your own information: it is used only to generate the story you requested, it is not used to build advertising profiles, and we do not transfer it to data brokers or share it for cross-context behavioral advertising.

If you believe a child has provided personal information to us directly, please contact us at ray@rre.solutions and we will delete it promptly.

We keep account and content information for as long as you maintain an active account. When you delete your account from Settings, your account enters a 30-day pending-deletion state, after which all stories, character profiles, generated reference images, audio, soundscape clips, and account information are permanently deleted from our systems and from the storage of our subprocessors. During the 30-day window your account is locked; you can cancel deletion by signing in again before the window expires.

Photo bytes uploaded for character likeness are not retained: they are processed in memory and discarded when the request completes. Generated text descriptions, style tokens, and generated cartoon reference images persist with the character profile until you delete the profile or your account.

We may retain information for longer where required to comply with legal obligations (such as tax or accounting), to resolve disputes, or to enforce our Terms.

Depending on where you live, you have rights with respect to your personal information, which may include:

You can delete your account and all associated information from the Settings screen of the application. For other rights, please contact us at ray@rre.solutions; we will respond within the time required by applicable law (typically 30 days).

If you are a California resident, you have the rights described in the section above and may also be entitled to request information about the categories of personal information we have collected, the purposes for which we collected it, and the categories of recipients with whom we have shared it; you may exercise these rights through the same contact methods.

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. There is no "Do Not Sell or Share My Personal Information" link on this site because there is nothing to opt out of.

We do not use or disclose sensitive personal information for any purpose that would require us to offer a right to limit under the CCPA. We do not engage in any activity that would require us to offer a financial incentive for the collection of personal information.

Our marketing website does not set cookies and does not use cookie-based tracking. The application uses platform-secure storage on your device to keep you signed in (Apple Keychain on iOS, Android Keystore on Android, browser local storage on the web). This is strictly necessary for the application to function and is not used for analytics or advertising.

We do not engage in cross-context behavioral advertising and do not display the iOS App Tracking Transparency prompt.

We protect your information using a combination of access controls, encryption in transit (TLS) and at rest where supported by our subprocessors, hashed and rotated authentication tokens, and the principle of least privilege. No method of transmission or storage is perfectly secure; if you have reason to believe your account or any of your information has been compromised, please contact us immediately at ray@rre.solutions.

If we become aware of a data breach that affects your personal information, we will notify the appropriate supervisory authority and, where required by applicable law, you, in accordance with the timelines required by that law (typically within 72 hours for the GDPR).

We do not currently send push notifications. If we add push notifications in the future (for example, to alert you when a long-generating story has finished, or for marketing), we will request your permission through the operating system before sending any.

We do not currently send marketing or promotional emails. If we begin sending such emails in the future, every email will include an unsubscribe mechanism, and we will obtain any consent required by applicable law before adding you to a marketing list.

We may update this Privacy Notice from time to time. The current version is identified by the version date listed at the top of this page. When we make material changes, we will notify you in the application before the changes take effect.

Questions or concerns about this Privacy Notice or our data practices? Email ray@rre.solutions or write to RRE Solutions LLC, 2522 Lincoln Ave., Miami, FL 33133, United States.