Moony Privacy Policy

1. Who we are

Moony ("we") is an app for tracking spending and a monthly budget.
We are responsible for the information collected in Moony (the database controller, in the law's terms).
For any privacy question or request: moonysupport@gmail.com.

2. What we collect and why

2.1 Account and sign-in

The sign-in service (Supabase) passes your number to Twilio, the SMS provider, only to send the code. The sign-in service also keeps a technical log of sign-ins, including IP address and device type, for security and abuse prevention.

2.2 Budget, expenses and cards

All of these are stored on the phone and in your account on the server.
An automatically captured payment is uploaded to your account while it is still waiting for your approval.

Moony never stores a full card number, expiry date, security code, password or balance. It is not connected to your bank account and cannot charge a card.

2.3 Technical information and app usage

To know the app works and where it can be better, your phone sends short records to our server. They contain no amounts, merchants, notes or notification text.

• Once a day: the app version, the operating system and its version, and the installed update.
• Sync problem: the error code and the table name.
• App error: the kind of error (for example TypeError), which screen, and whether the app closed. Not the error's message.
• On Android, while notification capture is on: for each payment app and day, how many notifications were captured and how many were dropped, and why. From this one can tell which bank or card apps send you notifications.
• App usage: which screens open and which actions happen, and when. For example: progress through sign-up steps, connecting Apple Pay or notifications, scanning an image, approving an expense and opening the payment screen. No amounts, merchant names or notes.

These records are linked to your user id, so they are not anonymous. We use them mostly in aggregate, for example to see which sign-up step people get stuck on. When we need to help you or check a problem, we can also see the activity in your account (section 11). They are kept for up to 90 days, and are also deleted when you delete your account.
You can ask us by email to delete them.

Moony contains no third-party analytics, advertising or crash-reporting tools.

2.4 App updates

When the app checks for an update, it contacts Expo. The request includes your IP address, the operating system, the app version and a random install id. It does not include your details or your expenses.

2.5 Support requests

When you contact us from the help screen in the app, the server keeps: the topic, your messages (up to 1,000 characters each), our replies, and which help video you wrote from, if you did.
If you choose "Attach technical details", these are sent too: the app version, the phone model, the operating system and its version, and the language. On iPhone, the Apple Pay log is sent as well, without amounts, merchants or cards.
Support requests are deleted when you delete the account.

2.6 What Moony does not collect

• Contacts, location, camera or microphone.
• SMS, email or chat messages.
• Browsing history or advertising ids.

3. What stays on your phone only

• The full text of payment notifications (Android).
• The statement file you import. Only the expenses added from it are kept.
• Which merchant belongs to which category.
• The snapshot shown in the widget (section 9).

Data on the phone is kept in the app's private storage. The sign-in token is kept in the phone's secure storage. A screen lock is recommended.

4. Payment capture from notifications (Android)

Capture works only if you give Moony notification access in the phone's settings, and only while you are signed in.

• Moony looks only at notifications from a closed list of card, bank and wallet apps (for example Isracard, Max, Cal, bit and Google Wallet). The list is shown in the app.
• We can update the list remotely, for example when a bank changes its app. Messaging, email, SMS, social and phone apps are blocked and can never be added.
• Notifications from every other app are dropped before their content is read.
• From a listed app's notification, only the amount, the merchant, the last 4 digits (if shown), the card issuer and the time are kept. For a payment in a foreign currency, while foreign-currency capture is on, the original amount and currency are kept too.
• Notifications with a verification code, incoming money transfers, offers or no amount are dropped, and so are foreign-currency payments while foreign-currency capture is off. A refund from a card company is recorded as a refund, with the same details.
• The full notification text is never stored or sent.
• A captured payment waits for your approval and is stored in your account like any expense (section 2.2).
• After each captured payment, Moony shows a short notification with the merchant and the amount. You can turn it off.

You can revoke notification access at any time in the phone's settings.

5. Apple Pay on iPhone

On iPhone, apps cannot read other apps' notifications. Instead, you install a Moony shortcut and set up a Wallet automation in Apple's Shortcuts app.

• After an Apple Pay payment in a store, the automation passes the amount and the merchant to Moony.
• Moony does not access Wallet and never receives a card number or a balance.
• The payment waits for your approval and is stored in your account like any expense.
• You can delete the automation at any time in Shortcuts.

6. Statement import

You can pick an Excel or CSV file from your card issuer's website. The file is read on the phone only and is never sent to the server. Only the date, amount and merchant of each expense you add are kept.
A temporary copy of the file may remain in the app's temporary cache until the operating system clears it.

7. Adding from an image

You can pick screenshots of the transaction list in a bank or card app, or an image of a receipt or a bill from your photos. Moony offers to add the transactions it does not have yet.

• What is sent: each image goes through our server to Anthropic, which runs the AI model Claude. Today's date and your category names, each with an internal id, are sent with it, so the model can match each transaction to one of them.
• What comes back: date, merchant, amount, the kind of transaction and a suggested category. The model is told never to return card or account numbers.
• What is kept: we do not store the image, on the server or in logs. Only the transactions you approve are kept. Anthropic processes the image under its commercial terms.
• Please note: the image shows whatever is in it: a screenshot may show a balance or other transactions, and a receipt or a bill may show a name, an address or the last 4 digits of a card.
• On the phone: the copy Moony received is deleted after reading. An image you picked from your photos stays there.
• Daily limit: up to 10 images a day. For this we keep your user id, the date, the number of images and how much processing they took.

8. Couple accounts

In a couple account two people manage a shared budget. Each signs in with their own phone number.

What your partner sees:

• Your first name and the monthly income you entered.
• The shared settings: fixed expenses, savings, the month's start day, budgets, goals and categories.
• The expenses you confirmed and did not mark private: amount, date, merchant, category, card (name and 4 digits), installments and notes. Both of you can write a note on such an expense.
• The cards you chose to connect to the couple account.
• In the widget: your name and your total spending for the month.

What your partner does not see:

• Your phone number.
• A private expense: only how many private expenses you had in the month and their total.
• Expenses waiting for approval, and expenses you marked "not an expense".

A card not connected to the couple account: the card itself is not shown. But its confirmed expenses are shown, with the card name and 4 digits, unless you mark them private.

Invitation: a 6-character code, valid for 7 days. You send it from your phone, in the app you choose. Before joining, whoever has the code sees your first name and the shared budget amounts.

Joining from a personal account: when you join a couple account from an existing personal account, your expenses, cards, categories and goals move to the couple account, and the personal account's budget and settings are deleted. When you turn a personal account into a couple account and invite a partner, the account keeps all its expenses. Either way, your partner will see your earlier expenses, except the ones you marked private. Mark as private what you do not want to share before joining.

Leaving: when you leave, your expenses and cards move to a new personal account. Your partner stays in the couple account.

9. The widget and notifications

• The widget shows on the home screen, if you add it. To show it, a small snapshot is kept on the phone: the budget, this month's and this week's spending, up to 5 pending expenses (merchant, amount, 4 digits) and the last 3 expenses. In a couple account it also shows each person's name and spending. The snapshot is never sent anywhere.
• Moony's notifications are created on the phone itself: reminders and the captured-payment notice. The only notification sent from our server is on iPhone, when we reply to your support request. For it, the server keeps your phone's notification token, and sending goes through Expo and Apple. The token is deleted when you sign out. Some notifications show a merchant, an amount or a number of expenses, so they may appear on the lock screen, depending on your phone's settings.
• Remote settings and messages: the app downloads general settings and messages from the server. The request includes no information about you.

10. Who we share information with

We do not sell, rent or give information to advertisers.
Information goes only to providers who run the service for us, and only as much as they need:

We will also disclose information when the law requires it, for example under a court order.

11. Who at Moony sees your information

Only Moony's operator. We have an internal, secure admin system, used for support and operations.

It does not show the amounts, merchants, notes, income or budget of any account. Among other things, a user's card shows when they were active, how many expenses they have, which screens they used and which actions they took, without amounts, merchant names or notes. Every view of an account and every action is logged.

In support requests we see what you wrote, and the technical details if you attached them.

We access an account's information only when needed for operations and security, when you ask for help, or when the law requires it.

12. Security

• In transit: all traffic between the app and the server is encrypted (HTTPS).
• On the server: the provider encrypts stored data. Each user can read and change only what they are allowed to, under access rules enforced in the database itself.
• What it is not: this is not end-to-end encryption. The server can read the data, to sync it, to compute couple totals and to delete it.
• On the phone: see section 3.

No security is perfect. If a serious security incident happens, we will act and report as the law requires.

13. How long we keep information

14. Deletion and your rights

Sign out: Settings → Sign out.

• Moony tries to sync what has not been uploaded yet. If something did not upload, it asks before going on.
• Then it deletes from the phone the expenses, cards, settings and the queue of captured payments.
• The information stays in your account and comes back the next time you sign in.

Delete account: Settings → Delete account. It is always available.

• In a personal account, the account, expenses, cards, settings, technical information, image count and support requests are deleted, from the server and the phone.
• In a couple account, your expenses, cards, details and support requests are deleted. The couple account stays with your partner, with their expenses. A note you wrote on one of their expenses stays.
• After deletion only one record remains, with no user id, phone or name, and not linked to the account: the deletion date and whether you or we deleted it, the account type and whether a partner stayed in it, the phone type, how long and on how many days you used Moony, the subscription status, whether Apple Pay or notifications were connected, and the reason if you chose one. It helps us understand why people leave.
• Sign-in service logs are deleted as in section 13.
• You can also ask for deletion by email to moonysupport@gmail.com, with the account's phone number. We may ask you to confirm the request is yours.

Your rights, under the Israeli Privacy Protection Law, 5741-1981, including its Amendment 13:

• To access the information we hold about you.
• To ask for correction of information that is wrong, incomplete or out of date.
• To ask for deletion, or delete the account yourself.
• To withdraw consent to notification access, the iPhone automation and the captured-payment notice. You can ask us by email to delete the technical information.

You are not legally required to give us information. Still, without a phone number you cannot open an account, and without expenses Moony has nothing to show.
Write to moonysupport@gmail.com. We will answer within 30 days. You may also contact the Israeli Privacy Protection Authority.

15. Minors

Moony is meant for ages 16 and up. The app does not currently ask for age. If we learn that we collected information from someone under 16, we will delete it.

16. Transfers outside Israel

Information is stored on servers in the European Union. Some providers in section 10 operate in the United States or other countries. Transfers follow the Privacy Protection Regulations (Transfer of Information to Databases Abroad), 5761-2001.

17. Changes to this policy

If we change this policy materially, we will tell you in the app before the change takes effect. The date at the top is the current version's.

18. Contact

Questions, requests and complaints: moonysupport@gmail.com
Moony