Privacy

• Moonshot has no accounts and no ads. We sell nothing about you, to anyone, ever.
• The app ships with no analytics, telemetry, or tracking SDK. This website sets no cookies and loads no trackers.
• Microphone audio stays on your iPhone. Speech is transcribed on the device.
• To understand a moment, Moonshot sends text — recent transcript lines, and context such as names and calendar titles — through our server to Anthropic's Claude, and shows you the result. Our server relays that request and keeps no copy of it.
• To speak a reply, Moonshot sends only the text of that spoken reply to Fish Audio. It sends no microphone audio, call audio, voiceprint, Mind, mail archive, or other stored file to Fish.
• Some of your files are mirrored on our server so that a reinstall does not erase your life: your Mind, your ledger, your morning history, and your call records. What that copy contains is listed below.
• Gmail and Google Calendar data are read on your phone with your permission and stay under the Google Limited Use terms. How sensitive data is protected is described below.
• You can delete all of it.

This policy covers the Moonshot iOS app and this website, which is served at moonshot.computer, moonshot.mobile, oons.hot, m.oons.hot, inner.you, and gets.you. "We" means the small team that builds Moonshot. Write to us at privacy@moonshot.computer about anything on this page.

Moonshot is an early build in the hands of a small, known group of testers. It has no user accounts and no sign-up. Your phone identifies itself to our server with a key it generates on first launch, which means the separation between one tester and the next rests on that key. We say so here plainly, so you can judge the boundary that exists.

When listening is on, the microphone feeds audio to Apple's on-device speech recognition. Moonshot writes no recording of your ambient day to disk, and that audio is never uploaded anywhere. What survives the moment is text.

That text is the substrate for everything else: the ledger of real things you said you would do, and the Mind — the profile of people, projects, promises, and preferences that Moonshot studies from your own words.

Understanding a moment is a single request to Anthropic's Claude, sent through a small server we run on Google Cloud. Your phone holds no model keys; the server holds them, so it stands between your phone and the model. It relays each request and reply without logging or storing the contents.

A request can carry:

• recent transcript lines from what was just heard, as text
• your name and time zone
• people from your contacts — names, and the phone numbers and email addresses saved with them — so Moonshot spells a name right and knows who you mean
• calendar events in roughly the next two days: titles, times, and locations
• your Mind: the profile Moonshot has built about your life
• for the Gmail catch-up, mail headers and previews — sender, recipients, subject, and the snippet Gmail shows in the inbox list

Anthropic processes each request to answer it, under their terms. We do not authorize Anthropic to train a model on your material.

Moonshot's spoken voice is generated by Fish Audio from only the text of Moonshot's spoken reply, requested by our server. Fish's public terms permit Fish to use submitted content and usage data to develop, train, or improve its models and third-party components. Fish's privacy policy says it may keep content as long as needed to operate its systems. Fish publishes no fixed retention period for this text in those public terms. Read Fish's Terms of Use and Privacy Policy. Weather comes from Apple WeatherKit with a coarse location.

Every one of these is an iOS permission you grant, and every one can be revoked at any time in Settings. Where a permission's data can travel in a model request, it says so.

Microphone

Ambient listening. Audio stays on the phone; the transcript text travels in model requests.

Speech

On-device transcription of that audio.

Contacts

Names for correct spelling and for knowing who you mean. Names, numbers, and email addresses can travel in model requests.

Calendar

Your rhythm and what is coming. Event titles, times, and locations can travel in model requests.

Reminders

Creating and completing reminders you asked for. Stays on the phone.

Photos

Moonshot reads only each photo's date and location to learn where you have been. Images are never read and never leave the phone.

Location

Coarse position for weather, and a private diary of places you visit that is kept on the phone.

Health

The time you woke, for the morning brief. Stays on the phone.

Notifications

Push. Your device's Apple push token is stored on our server so Moonshot can reach you.

Focus

One bit — whether a Focus is on — so Moonshot stays quiet.

When you make or take a call through Moonshot, the call is bridged by Twilio, which records both sides. Your phone downloads that recording and then deletes Twilio's copy; the audio lives on your phone from that point. The transcript of the call, including the other person's turns, is synced to our server so it survives a reinstall.

The other person is told nothing by the app. Some places require every party to consent to a recording, and meeting the law where you and the other person are is your responsibility. Moonshot's in-app screens say the same thing before you start.

Connecting Google is optional. The app works without it. First connect asks Google for sign-in identity and read-only mail. Sending mail and Google Calendar are later, separate permissions, each requested only when you tap the thing that needs them. Moonshot requests these scopes and no others:

openid

A signed Google ID token so our server can tell your snapshots from someone else's. It verifies the token and keeps only a hash of Google's stable account id (`sub`). It does not request your Google email or profile scopes.

gmail.readonly

Reading your mail so Moonshot learns your life: who your inner circle is, what you promised, what is in motion. It reads senders, recipients, subjects, and Gmail's own preview snippets. It does not fetch message bodies.

gmail.send

Sending an email you asked Moonshot to send, from your address. Before it sends, Moonshot shows you the message with a five-second bar; tap to stop it and nothing is sent.

calendar.events

Reading, creating, changing, and removing events on Google calendars you can reach, after you tap Connect Google Calendar. A write waits for your confirmation. Apple Calendar on the phone is a separate source.

Your Google access token is stored on your phone and is never sent to our server. Mail and Google Calendar calls go from your phone directly to Google. The signed ID token is the one Google credential our server sees, and only to verify the account id above. So that new mail can wake the app, Moonshot registers your inbox with Google's notification service, which pings our server; the server knows only an irreversible hash of your address and answers by waking your phone silently.

The mail headers and preview snippets described above travel in the model request that builds your Mind, and facts learned from your mail or Google Calendar become part of the Mind we mirror (see what we keep). Google user data is used for those features and for nothing else: never for advertising, never sold or transferred, never used to train any model, and never read by a human on our side except with your permission or where the law requires it.

Moonshot's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnect Gmail from the app at any time, and revoke Moonshot's access to your Google account at myaccount.google.com/permissions.

The controls that protect this data in transit, at rest, and from unnecessary access are listed in How sensitive data is protected.

All network traffic is encrypted in transit with HTTPS/TLS. That covers traffic between your phone and our server, your phone and Google, and our server and Anthropic, Fish Audio, or Twilio.

Server-held data is encrypted at rest by Google Cloud's provider-managed encryption. Data stored by Moonshot on your iPhone also receives iOS's built-in device encryption and data protection. The server copies listed below are not encrypted under a key only you hold; that limit remains stated in What our server keeps.

Moonshot limits access to the least privilege needed for each feature. A random per-device identity key is kept in the iOS Keychain and our server uses its irreversible hash to separate one device's records from another's. For account-owned snapshots, the server verifies Google's signed ID token and stores only an irreversible hash of the stable account id. It stores only an irreversible hash of a watched Gmail address. Google access and refresh tokens stay on the phone. Moonshot asks only for the scopes listed above, does not fetch Gmail message bodies, and no person on our team reads Google user data unless you give permission or the law requires it.

We keep server-held data until you use Delete all data. That single request removes the device record, mirrored files, call records, standing orders, receipts, and Google-account snapshots associated with you. The exact behavior and the Gmail-watch exception are described under Your control.

We promptly investigate any breach affecting your data and notify affected users. We also take steps to contain the incident and prevent it from recurring. Write to privacy@moonshot.computer to report a suspected incident.

Google user data is never sold, never used for advertising, and never used to train models. Moonshot uses it only for the user-facing features described in this policy.

Our server runs on Google Cloud and stores, per device, only the following. Everything is kept until you erase it; there is no other schedule.

• the standing orders you wrote and the receipts of what Moonshot did about them
• your Apple push token, and your time zone
• the phone number you verified as your caller ID, and when you verified it
• an irreversible hash of the Gmail address being watched
• your call records: the transcript turns from both sides, and what Moonshot made of them
• mirrored copies of your Mind, your pending notes, your ledger, and your morning history, stored as opaque bytes that the server never opens, parses, or sends to a model

Call audio, ambient audio, your voiceprint, your photos, and your Gmail token are never stored on our server. What is stored there is held in ordinary storage rather than encrypted under a key only you hold; encrypting it that way is the next thing we want to do, and until it ships this sentence is the honest description.

Half of every call transcript belongs to the person you were talking to, who agreed to a conversation with you. We think that is the most sensitive material Moonshot holds, and we treat requests to remove it accordingly.

• Every fact in the Mind can be corrected or forgotten one at a time, and the whole Mind can be erased, from the Mind screen.
• Settings has Delete all data: it clears the Mind, the ledger, your voiceprint, every call record and its audio, and your sign-ins from the phone, and then deletes everything our server holds for that phone in a single request — the mirrored files included. The app shows you what came back: how many records were deleted, or, if the server could not be reached, that the copy is still there.
• Any call record can be deleted on its own, and every synced call can be erased in one action.
• Disconnecting Gmail or Google Calendar drops that grant from the phone; revoke Moonshot at Google as well to be certain. Google cannot drop one scope from a shared token, so revoking there disconnects both.
• Revoking any iOS permission in Settings stops that channel immediately.

Deleting is a deletion, not a flag: the request removes the mirrored files, the call records, the standing orders and the row itself, and nothing is kept behind to remember that a phone was ever there. Two honest exceptions. Your phone can go on being used after an erase — it is not an account being closed — so the moment it syncs again a new empty row appears, carrying nothing from before. And if a Gmail watch cannot be stopped at Google in the moment, it lapses there within seven days; while it lasts it points at nothing.

If any of that does not behave the way this page describes, write to privacy@moonshot.computer and we will fix it and delete what is left by hand.

Anthropic

The model that reads a moment and answers.

Google

Sign-in, Gmail, and Google Calendar on your phone; Google Cloud runs our server and stores what is listed above.

Apple

Push notifications, WeatherKit, and on-device speech.

Twilio

Bridging and recording calls you place through Moonshot.

Fish Audio

Turning only the text of Moonshot's spoken reply into speech. Fish's public terms permit model training and improvement uses described above.

Vercel, Supabase

This website and the waitlist.

Each one is a supplier doing a job for us. Moonshot works with no advertising networks, no data brokers, and no analytics vendors.

The landing page loads an image, a font, and the code that draws it. It sets no cookies, runs no analytics, and identifies nobody. Joining the waitlist stores three things: the email address you typed, which of our domains you typed it on, and the time. Our host keeps ordinary server logs, as every web host does.

To be removed from the waitlist, email privacy@moonshot.computer from that address and we will delete the row.

Moonshot hears whoever is near you and reads mail written by people who never installed it. Their words can end up in a transcript, and facts about them can end up in your Mind. Moonshot builds no profile of anyone to sell or share, and anyone can write to us to have material about them removed.

Moonshot is built for adults and is not directed at children. We do not knowingly collect data from anyone under 13.

When the product changes what it collects, this page changes with it and the date at the top moves. If a change materially expands what leaves your phone, we will say so in the app before it takes effect.

Questions, deletion requests, and corrections to anything written here go to privacy@moonshot.computer.