Privacy Policy

Last updated: October 15, 2026

This Privacy Policy explains how Moa collects, uses, shares and protects personal data when you use the website at moa.money, the web app at app.moa.money and the Moa mobile apps (together, the “Service”), and the rights you have over that data.

1. Who is responsible for your data

The controller of your personal data is Argently LLC, a Wyoming limited liability company that operates Moa (“Moa”, “we”, “us” or “our”). For any question about this policy or your data, contact help@moa.money.

Until October 13, 2026, the controller was Heeyun Lee, who founded Moa. Your data passed to Argently LLC together with the operation of the Service, and Argently LLC is bound by every commitment this policy makes to you.

2. Data we collect

We collect only the data needed to provide the Service:

• Account data. The email address you sign in with. If you use Sign in with Apple, this is the address Apple provides, which may be a private relay address.
• What you tell us about yourself. During setup Moa asks three optional questions — what you want to use it for, how you kept track of spending before (and, if you name a budgeting app, which one), and your ZIP code. The first two are answered by choosing from a fixed list. The ZIP code is the only answer you type, and it is accepted only as exactly five digits, so nothing else you type can end up here. Every question can be skipped, and skipping is not recorded as an answer. Your ZIP code is kept for one purpose: working out the local sales tax included in a charge total when Moa itemizes it. That feature is not available yet; until it is, your ZIP code is stored and shown back to you, and is not used for anything else. You can read, change or clear these answers at any time in Settings, under “What you told Moa”, and clearing one returns it to unanswered rather than to a default. We also record whether you have been through setup, so it is not shown to you twice.
• Transaction data. Transactions you bring into Moa from a connected bank, Apple Wallet, a statement file, a receipt or manual entry: the merchant name and descriptor, amount and currency, dates, and related details such as the account a transaction belongs to. Access to connected accounts is read-only. We keep the data as its source provided it, as well as our own reading of it, so that an earlier import can be read again with improved parsing instead of being requested from you again.
• Account balances. If you connect a bank, the balance of each connected account, the amount available and, for a credit account, its limit, together with the account’s type, such as checking or credit card. Moa keeps one figure per account per day, the last one it read that day, so that it can show your net worth and how it has changed. Moa also keeps your choices of which accounts count toward your net worth. Disconnecting a bank stops new balances from being read. Those already kept stay until you remove the disconnected account, with its transactions, in Settings → Cards & accounts, or until your account data is erased.
• Itemizations and corrections. The items you confirm or correct, so that future estimates reflect your actual purchases.
• Content you add. Trips and their itineraries, journal entries and photos, notes on transactions, budgets and goals, category rules, merchant names you set, and the bank connections you make. Photos are resized and stripped of location and camera metadata on your device before they are uploaded.
• Assistant conversations. Moa does not currently offer its assistant. If you used it in an earlier version, what you wrote to it and its replies remain in your account and your export until your account data is erased.
• Receipt photos. When you ask Moa to read a receipt, the photo is processed for that request and then discarded. It is never stored.
• Merchant suggestions. Corrections you submit about a merchant’s menu or details.
• Usage data. Which screens you open, which features you use, the app version, and any product test group you are in, recorded under your pseudonym. Usage data never includes the content of your data, such as a merchant, an amount, an item, a note or anything you type. See Usage analytics.
• Diagnostic data. Error and crash reports, and our server’s logs. See Service providers.
• Connection data. Your device’s IP address and browser or device details, which any server receives when your device connects to it. See Service providers for which providers receive them and what they keep.
• Support correspondence. The messages you send us and our replies.
• Records of agreement. Which versions of the Terms of Service and this Privacy Policy were in effect when you agreed to the Terms, and when you agreed.

We also use public menu and price information about merchants, which contains no information about you.

Apple Wallet transactions

Where Apple Wallet import is available, transaction history is read on your device with your explicit permission, which you can revoke at any time in your device settings. You choose which transactions to import, and nothing is read in the background. For each imported transaction, the app reads:

• the merchant name, and the descriptor sent by your bank or card network;
• the amount and currency, as billed;
• for a purchase made abroad, the amount in the local currency and the exchange rate applied by your card issuer;
• the transaction date, the date it settled, and whether it is a purchase, refund, fee or similar;
• the merchant category code, which your card network assigns to the merchant;
• an account identifier, so that transactions from different cards stay separate.

This data does not include your cardholder name, card number or address.

3. How we use your data

We use personal data only for the purposes below. Each has a legal basis under the EU General Data Protection Regulation (GDPR).

Where we rely on our legitimate interests, you have the right to object (see Your rights). Account and transaction data are necessary to use the Service; everything else you provide is optional. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

4. Pseudonymization

Before Moa analyzes your data, your identity is replaced with an opaque pseudonym. The inference engine and the stores that hold your financial data never receive your name, email address, account number or bank credentials.

We describe this as pseudonymization, not anonymization. A purchase history is identifying by nature, and personalized estimates require your data to be associated with you. Our commitment is to minimize the data we process and to keep your identity separate from it.

5. AI model providers

We use OpenAI and Anthropic for features that require an AI model: itemizing a purchase you describe in your own words, reading a receipt photo, identifying merchants and extracting their public menus, and checking suggestions about merchants.

A request to a model provider contains only what the task needs: the transactions concerned (for example the merchant, amount, date, candidate items and statistics from your past confirmations), the text you wrote to describe a purchase, or the receipt photo you asked Moa to read. It never contains your name, email address, account identifiers or ZIP code, and never contains your transaction notes, trip journal entries or trip photos. A receipt photo is held in memory for the duration of the request and is not stored or logged.

We use only provider services whose terms do not allow submitted data to be used to train their models; a service whose terms we cannot verify is not used. OpenAI and Anthropic may retain submitted data for up to 30 days, for example to monitor for abuse, unless a longer period is required by law or to enforce their usage policies.

6. Service providers

We use the following providers to operate the Service. Each receives only the data needed for its role. Except where stated below, they process personal data on our behalf, under data processing terms that bind them to our instructions.

• Supabase — authentication and database. Supabase holds the email address you sign in with, the IP address and browser or device details of each signed-in session for as long as that session lasts, and the records described above under your pseudonym. Its logs of sign-in activity, which include IP addresses, are kept for up to 7 days. The database is hosted in the United States (US East).
• Vercel — hosting for the website, the web app and our server, which runs in the United States (US East).
• Plaid — bank connections, if you choose to connect a bank. You sign in to your bank within Plaid’s interface, so your bank username and password are never entered into Moa and never reach us. Plaid returns your transactions, your accounts’ names and types, and their balances. Plaid acts as an independent controller of the data it collects, as described in Plaid’s End User Privacy Policy.
• OpenAI and Anthropic — AI models, as described in AI model providers.
• Mixpanel — usage analytics, as described in Usage analytics. Data is stored in the European Union.
• Datadog — error and crash reports and server logs, described below. Data is stored in the European Union.
• Google Workspace — our email. It sends sign-in emails, which carry only your email address, and holds the support correspondence you send us.
• Google Maps Platform, Kakao and Naver — place search, used to identify merchants. These services receive merchant names only, never information about who made a purchase, so they receive no personal data from us.
• Google Maps Platform — maps. In the iOS and Android apps, the small map shown for a place in a trip’s itinerary is requested from Google by our server, not by your device. Google receives the area of the map being shown, and never your IP address or any information about your account.

Your device also connects directly to the following services, which receive your IP address and device details but no information about your account or your data. They handle these requests under their own privacy policies.

• Google Fonts — in the web app, when text contains a character that Moa’s own fonts do not include, such as an emoji, your browser downloads a font for it from Google (fonts.gstatic.com).
• Your device’s geocoding service — in the iOS and Android apps, when a trip’s itinerary names a place, the app asks the operating system to find it on a map. The place name, and the first location of the trip, are sent to that service: Apple’s on an iPhone, and on Android the service your device provides, usually Google’s.

We do not sell personal data, and we do not share it with data brokers or advertisers.

Error and crash reports

We use Datadog to detect errors and find their cause. From our server, Datadog receives one record per request: a request identifier, the route as a template (never an address containing your identifiers), the status code, the response time and, for a failure, the error type and stack trace. Fields that could contain a transaction, merchant, amount, name or anything you typed are blocked by our server, and an automated test prevents new ones from being added.

From the app, Datadog receives crash reports: the error type and the code it passed through, with the message withheld for error types that include their input, together with the screen as a template, the app version, and the device model and operating system version. Crash reports contain nothing you did or bought. Datadog holds no account or user identifier for you; the only identifier is a session identifier that expires with the session. Datadog discards your IP address before storing anything and derives no location from it. Datadog processes this data only on our instructions, and its AI features are disabled for our account.

You can switch crash reports off, under Privacy in Settings, in the app and in the web app. Switching them off takes effect immediately and discards anything not yet sent; switching them on takes effect the next time you open Moa, because the reporter has to be in place before the app starts. In the European Economic Area, the United Kingdom and Switzerland the setting starts off and we rely on your consent, which you can withdraw at any time with the same switch; elsewhere it starts on and we rely on our legitimate interest in diagnosing failures, which you can object to by switching it off. See Cookies and local storage for how your device decides which of the two it starts with.

7. Usage analytics

We record usage to understand which parts of Moa are used, so that we can maintain and improve them. The legal basis is our legitimate interest in running and improving the Service. The app does not currently have a setting to turn usage analytics off, but you can object at any time, as described below.

Usage data is limited by design. Every event must come from a fixed list, and every field must be a fixed choice, a yes-or-no value or a small number. Screens are recorded as templates, such as /feed/:transactionId, never as an address containing your identifiers. No field can hold free text, so usage data cannot contain a merchant, an amount, an item, a note, a file name or anything you type, and an automated test prevents such a field from being added. Nothing is recorded before you sign in.

Usage data is processed by Mixpanel. Mixpanel receives these events under your pseudonym and never receives your name, email address, IP address, device identifiers or any transaction data. The app contains no Mixpanel code: every event passes through our server, which forwards only the permitted fields. The data is stored in the European Union, Mixpanel processes it only on our instructions, and Mixpanel’s AI features are disabled for our account.

You can object. Email help@moa.money; you do not need to give a reason. We will stop recording usage for your account, erase the usage data we hold, including Mixpanel’s copy, and confirm when this is done. Deleting your account has the same effect on usage data.

8. Cookies and local storage

• Website. moa.money sets no cookies. If you choose a language on the site, that one choice is stored in your browser’s local storage, so that the site opens in it next time; nothing else is stored on your device, and the choice is not sent anywhere. Visits are counted by Vercel without cookies.
• Web app. app.moa.money stores your sign-in session and a copy of your data in your browser’s local storage, so that you stay signed in and the app opens without waiting for the network. This storage is necessary for the web app to work, and it is cleared when you sign out.
• Error reporting. The web app uses Datadog’s browser software to report errors. It stores a session identifier in a first-party cookie, which expires after 15 minutes of inactivity and lasts no more than four hours. This cookie is written only while crash reporting is switched on, and switching it off writes nothing at all. In the European Economic Area, the United Kingdom and Switzerland, crash reporting starts switched off, so nothing is stored until you turn it on in Settings; elsewhere it starts switched on and you can turn it off in the same place. Which of the two your device started with is decided from your device’s time zone and language settings, without a location lookup, and if that cannot be determined we apply the stricter of the two. The same applies to the iOS and Android apps, which store nothing for crash reporting while the setting is off.
• Software from providers. The web app loads software directly from Plaid, to open bank connections, and from Datadog, to report errors, and loads fonts from Google when text needs a character Moa’s own fonts do not include, so your browser connects to their servers.

We do not use advertising or cross-site tracking cookies.

9. International transfers

Some of our providers process personal data outside the European Economic Area, mainly in the United States. Where a provider processes personal data on our behalf, the transfer is protected either by the EU–U.S. Data Privacy Framework, under which Vercel, Google, Mixpanel and Datadog are certified, or by the European Commission’s Standard Contractual Clauses included in the provider’s data processing terms, which is the case for Supabase, OpenAI and Anthropic. Mixpanel and Datadog store the data they receive in the European Union.

When you connect a bank, Plaid, which is based in the United States, processes your data as an independent controller under its own privacy policy. Google Fonts and your device’s geocoding service receive only your IP address, device details and what they are asked for, under their own privacy policies.

10. Storage and security

Your transactions, account balances, itemizations and content are stored in our database, under your pseudonym, so that your history remains available after you reinstall the app and on any device where you sign in. The app also keeps a copy on your device so that it opens quickly.

We protect your data by keeping your identity separate from your financial data, by using encrypted connections between your device, our server and our providers, and by limiting what each provider receives. Our database provider encrypts stored data, including backups.

11. Retention and deletion

• Account and financial data — transactions, account balances, itemizations, corrections, content you add, assistant conversations and records of agreement — are kept for as long as your account exists.
• Usage data is kept under your pseudonym for as long as your account exists, and for up to two years at Mixpanel. It is erased when you object or delete your account.
• Error reports and server logs at Datadog are not linked to your account and expire automatically: crash reports and their sessions after 30 days, and server logs after a shorter period.
• Receipt photos are not retained.
• Connection data held by Supabase for a signed-in session is kept for as long as that session lasts, and is erased with your sign-in. Supabase’s logs of sign-in activity expire after at most 7 days.
• Support correspondence is kept in our email account for as long as it is needed to handle your request and keep a record of it. You can ask us to delete it.

Deleting your account

You can delete your account in the app, in Settings → Delete account, without contacting us. The request closes your account immediately. You then have 30 days to change your mind: during that period none of your data is erased, and signing in and choosing Keep my account restores your account and all of its data. On the date shown to you, and not before, your data is erased.

On that date we erase your transactions and imports, account balances and your choices of which accounts count, confirmed itemizations, trips with their itineraries, journals, notes and photos, assistant conversations, budgets and goals, category rules, your setup answers and records of agreement, together with your connected bank items, which we also disconnect at the provider before erasing our copy. Trip share links stop working permanently. We also erase your sign-in. Because your pseudonym is derived from your sign-in using a keyed hash, and no table links the two, the pseudonym can then no longer be linked to anyone, including by us.

Usage data is the exception to the 30-day period. We ask Mixpanel to erase its copy on the day you make the request, and your account is not recorded as erased until Mixpanel confirms that it has done so. If you cancel the request within the 30 days, your account is restored, but that usage data is not.

Menu price information that your corrections contributed to is kept, because it describes merchants and contains no information about you.

You can export your data at any time in Settings → Export my data. The export is generated when you request it and is not stored on our servers. It includes your daily account balances and which accounts you count toward your net worth. It excludes the access token for a connected bank and the secret in a trip share link, because both are credentials that would work for anyone who had the file.

12. Your rights

Under the GDPR, you have the right to:

• access your personal data and obtain a copy of it, which Settings → Export my data provides at any time;
• data portability, to receive the data you provided in a structured, machine-readable format;
• rectification of inaccurate data, most of which you can correct directly in the app;
• erasure of your data, through Settings → Delete account;
• restriction of processing in certain circumstances;
• objection to processing based on our legitimate interests, including usage analytics.

You can also disconnect a bank or revoke device permissions at any time. To exercise any of these rights, use the settings above or email help@moa.money from the address associated with your account. We will respond within one month and may ask you to confirm your identity.

You also have the right to lodge a complaint with a data protection authority. In France, this is the Commission nationale de l’informatique et des libertés (CNIL), at www.cnil.fr. If you live elsewhere in the European Union, you can contact the authority in your country.

If you live in the United States

Wherever you live in the United States, you can use the same rights: to know and access the personal data we hold about you, including the categories in Data we collect, the purposes in How we use your data and the providers that receive it in Service providers; to obtain a portable copy of it; to correct it; and to delete it. Some state laws give their residents these rights. We provide them to everyone in the United States, whether or not such a law applies to Moa, and we will not treat you differently for using them.

We do not sell or share personal data. We do not sell it, we do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising or for profiling that produces legal or similarly significant effects. There is therefore nothing to opt out of, and the Service has no “Do Not Sell or Share” link. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out: the web app then sends no crash reports and stores no crash reporting cookie, whatever the setting described below says.

To make a request, use the settings described above or email help@moa.money from the address associated with your account. You may use an authorized agent, in which case we may ask for proof of their authority and confirm the request with you. If we decline all or part of a request, we will explain why, and you can appeal by replying to that decision. We will answer an appeal within 45 days. If we deny your appeal, you can contact your state’s attorney general.

Do Not Track. Browsers’ Do Not Track setting has no agreed meaning, and the Service does not change its behavior when it is set. Moa does not track you across other websites and uses no advertising or cross-site analytics services. When you connect a bank, Plaid collects information about your browser or device as described in its End User Privacy Policy.

13. Children

The Service is intended for people aged 18 and over, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will erase it.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the “Last updated” date at the top of this page. If a change materially affects you, we will notify you in the app before it takes effect.

15. Contact

For questions about this Privacy Policy or your personal data, email help@moa.money. For help with the Service, see our Support page.