Moth

Privacy Policy

Effective September 26, 2026 · Last updated October 2026

At Moth, we want you to know how your data is handled. We believe your private thoughts should stay private.

Moth is operated by Moth Self Care LLC. Moth Privacy Contact: support@mothselfcare.com is the contact for privacy questions, rights requests, and complaints.

Information we collect and why

Account data. Creating a Moth account is optional. If you sign in, Moth may receive basic account information from the authentication provider, such as your email address, an account identifier, and authentication information needed to maintain your session. Moth does not need your account-provider password.

Your writing and app activity. Reflections, Memory Jar entries, custom affirmations and quests, quest responses, likes, progress, discoveries, selected categories, and app preferences may be stored so the features you choose can work. Much of this information is stored locally on your device.

Technical data. Moth may use infrastructure and time-verification services to keep certain features working reliably. Those providers may process standard technical information such as IP address, device or request information, and timestamps as needed to provide and protect their services.

Purchases. Moth+ purchases are processed through the App Store or Google Play and services used to manage subscription access. Moth may receive transaction or subscription-status information needed to provide paid features, but does not receive your full payment-card number from the app store.

Moth does not currently use a general analytics SDK, advertising SDK, or crash-reporting SDK. The website does not use advertising or analytics trackers. It uses browser local or session storage for things such as theme choice, language choice, and temporary game or easter-egg state.

Unless a law specifically requires otherwise, providing personal information to Moth is generally voluntary. You can use Moth's local features without creating an account or enabling cloud backup. If an optional feature needs information you choose not to provide, that feature may not work. For example, signed-in account and cloud features need the account information required to operate them.

What we do not do

Moth does not sell your personal data or private reflections, and it does not use personal data from the app for targeted advertising.

If you enable cloud backup, Moth's systems and service providers process content included in cloud backup to store, synchronize, secure, restore, or delete it. Cloud-backed content may also be accessed when needed for support, security, legal compliance, or a request you make.

Cloud backup and sensitive content

Cloud backup is optional and separate from signing in. Private writing that can be backed up stays local unless you separately enable cloud backup. Before private self-care content is stored in Moth's cloud backup, Moth asks for separate consent because reflections or similar content may reveal information about physical or mental health or wellness.

You can later turn cloud backup off. Doing so stops future cloud synchronization and deletes the Moth cloud-backup copy while leaving your local data and Moth account intact.

Washington consumers can read Moth's separate Washington Consumer Health Data Privacy Policy, which is maintained separately as required by Washington law.

Consumer health data

This section serves as Moth's consumer health data privacy policy where Nevada law applies. Depending on what you choose to write or do, consumer health data may include reflections, Memory Jar entries, quest responses or history, custom affirmations or quests, category choices, interaction or personalization signals, account-linked progress, and information included in support or privacy requests when that information reveals or relates to health or wellness.

Moth receives this information directly from you or derives limited app context from your interactions. Moth does not buy consumer health data from data brokers. Moth uses it to provide the self-care, reflection, personalization, progress, support, security, and optional cloud-backup features you request.

When necessary for a requested function, consumer health data needed for that function may be processed by cloud infrastructure or authentication providers acting for Moth, by Moth's email/support provider for communications you send, or by an app or service you intentionally select through your device's share feature.

Moth does not currently have an affiliate that receives consumer health data and does not provide consumer health data to advertising or analytics providers for their independent use.

Moth does not sell consumer health data or use health-location geofencing, and does not authorize third parties to collect consumer health data about you over time across unrelated websites or online services.

Where Nevada consumer-health law applies, you may ask Moth to confirm whether it collects, shares, or sells consumer health data concerning you; provide the recipient information required by law; stop collecting, sharing, or selling that data where the law provides that right; delete it; or appeal a refusal to act. Email support@mothselfcare.com and describe the request. Moth may take reasonable steps to authenticate the request without requiring the text of a private reflection, diagnosis, symptom, or other sensitive detail merely to verify you.

Nevada consumer-health requests use the same privacy contact above. The request and deletion rights described above remain available. Moth responds within the time required by Nevada law, and deletion requests follow Nevada's rules for active and backup systems.

If Moth's use of consumer health data changes, this policy will be updated and Moth will ask for additional consent when required.

Children's privacy

Moth is intended for people age 13 and older and is not directed to children under 13. If you are under 13, do not create a Moth account or provide personal information through Moth. If Moth learns that a child under 13 provided personal information through the service, Moth will review and delete it as required by applicable law. If you believe this has happened, contact support@mothselfcare.com.

Deleting and retaining data

You can request deletion of your Moth account and associated cloud-backup data through the account deletion page, available in-app controls, or by contacting support@mothselfcare.com. Local-only data can be removed using Moth's reset controls or by removing the app, subject to device or operating-system backups.

Limited purchase-linked recovery records may remain after account deletion so Restore Purchases can recover previously earned Moth+ collectibles. These records use pseudonymized identifiers and are kept separately from your private content. They do not contain Memory Jar entries, custom affirmations or quests, or other cloud-backup content. Moth may also retain information when required for legal, security, fraud-prevention, accounting, or app-store transaction obligations.

Moth keeps personal information only as long as reasonably needed for the purposes described in this policy. Account and cloud-backup data are kept while needed to provide those features; support or privacy-request records may be kept long enough to respond and document the outcome; and purchase, security, fraud-prevention, accounting, dispute, or legal records may be kept longer where reasonably necessary or required by law. When information is no longer needed, Moth deletes or de-identifies it where appropriate.

Service providers and international processing

Moth uses service providers for account authentication and optional cloud backup, subscription and paid-feature access management, time-verification and related infrastructure, app distribution and store purchases, and support email. RevenueCat manages subscription and paid-feature access information and may process app-user technical and transaction information such as store receipts or purchase identifiers; Moth does not send private reflections or Memory Jar text to RevenueCat.

The public Moth website is hosted through GitHub Pages. GitHub states that when a GitHub Pages site is visited, the visitor's IP address is logged and stored for security purposes. Moth does not add advertising or analytics trackers to the website.

Depending on where you live and where a provider operates, information may be processed or stored outside your country. RevenueCat currently states that customer data is stored using Amazon Web Services in the United States. Other providers may process or store data in different locations depending on their infrastructure and service configuration. Cross-border processing is subject to any safeguards required by applicable law.

Your privacy rights

Depending on where you live, you may have rights to access personal information Moth controls about you, request correction or deletion, obtain a portable copy where applicable, withdraw consent, object to certain processing, complain about Moth's handling of personal information, or appeal certain request decisions.

How to make a request. Email support@mothselfcare.com and tell Moth what you want to do. You do not need to identify the law that applies. If the request concerns an existing Moth account, include the email address associated with the account or another identifier needed to locate it. Moth may take reasonable steps to verify the request, but please do not send private reflections, diagnoses, symptoms, or other sensitive content merely to prove your identity.

Moth does not currently make decisions about you based solely on automated processing that produce legal or similarly significant effects.

European Economic Area and United Kingdom. Where the GDPR or UK GDPR applies, Moth processes personal data as necessary to provide features you request or perform its agreement with you; with consent where required, including separate consent for optional cloud backup of private self-care content that may reveal health or wellness information; for legitimate interests in service security, fraud prevention, reliability, and protecting Moth and its users where those interests are not overridden by your rights; and to comply with legal obligations. Where sensitive or special-category data is involved, Moth relies on an additional condition required by applicable law, including explicit consent where required. You may withdraw consent at any time without affecting earlier lawful processing. You may also complain to the data-protection authority in your EEA country or, in the United Kingdom, the Information Commissioner's Office.

Brazil. Where the Lei Geral de Proteção de Dados (LGPD) applies, you may have rights to confirm processing, access or correct personal data, request anonymization, blocking or deletion where applicable, request portability where available, receive information about sharing, revoke consent, object where the law allows, and request review of qualifying automated decisions. Use Moth's privacy contact first; if the issue is not resolved, you may be able to petition Brazil's National Data Protection Authority (ANPD).

Canada. Where Canadian private-sector privacy law applies, you may request access to personal information Moth holds about you and challenge its accuracy or completeness. The Moth Privacy Contact above handles privacy inquiries, access or correction requests, and complaints. If a complaint is not resolved, you may be able to complain to the Office of the Privacy Commissioner of Canada or the applicable provincial privacy authority.

Consumer health data. Nevada consumer-health requests and appeals can use the same privacy contact; Section 4 explains the applicable rights. Washington consumers have a separate legally required Washington Consumer Health Data Privacy Policy with its own request and appeal instructions.

New Zealand. Where the Privacy Act 2020 applies, you may request access to or correction of personal information. If you first raise a privacy complaint with Moth and remain dissatisfied, you may be able to complain to the New Zealand Office of the Privacy Commissioner.

Singapore. The privacy contact above is also Moth's published business contact for Singapore data-protection matters. Where the Personal Data Protection Act 2012 applies, you may request access or correction and may withdraw consent on reasonable notice. Moth will explain the likely consequences of withdrawal and stop the affected collection, use, or disclosure unless law permits or requires it to continue. You may also be able to use the Personal Data Protection Commission complaint process.

Hong Kong. Where the Personal Data (Privacy) Ordinance applies, you may request access or correction. Moth responds within the time and form requirements of the Ordinance. After first raising the issue with Moth, you may be able to complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong.

United Arab Emirates. Where Federal Decree by Law No. 45 of 2021 applies, you may have applicable rights relating to information about processing, portability, correction, erasure, restriction or stopping of certain processing, certain automated decisions, and consent withdrawal. The law also provides a complaint route to the UAE Data Office; the UAE Government's data-protection page provides current federal framework information.

Australia. Where Australian privacy law applies, you may request access or correction and may raise a privacy complaint with Moth. If the issue remains unresolved after Moth has had a reasonable opportunity to respond, you may be able to complain to the Office of the Australian Information Commissioner.

Connecticut. Where the Connecticut Data Privacy Act applies, you may have rights to confirm whether Moth is processing your personal data, access that data, correct inaccuracies, request deletion, obtain a portable copy where applicable, and exercise any opt-out rights the law provides. Moth does not currently sell personal data, use it for targeted advertising, or use it for profiling that produces legal or similarly significant effects. If Moth declines to act on a request, you may appeal through the privacy contact above; if the appeal is denied, Moth will provide the applicable Attorney General complaint route.

Security

Moth uses reasonable technical and organizational measures intended to protect information it handles. No device, storage system, or internet transmission can be guaranteed to be completely secure.

Changes and contact

Moth may update this Privacy Policy as the service or legal requirements change. The last-updated date will change when the policy changes, and additional notice or consent will be provided when applicable law requires it.

For privacy questions, access or correction requests, deletion requests, consent withdrawal, or complaints, contact support@mothselfcare.com.