What we keep, and what we don't.

Your data sits in a Postgres database.

Specifically, Neon Postgres in AWS region us-east-2 (that's Ohio). One database, scoped per user. Encrypted at rest by the cloud provider; not end-to-end. EU residency is on the roadmap for the EU rollout; if that matters to you, write to us before you sign up.

Anthropic and OpenAI see your messages each turn.

The chat is powered by Claude (Anthropic) by default, with an option to switch to ChatGPT (OpenAI). Whichever you pick, your message is sent to that provider so they can write the reply, then their answer comes back. The same providers also do the quiet background work of turning your conversations into the pages we keep about your people.

Zero-retention DPAs with both: pending We're working on having both signed before the wider launch. Until they are, the providers may retain prompts and completions for up to 30 days under their default API terms. We don't grant ourselves access to that retained data, and neither provider uses it to train models on us (see below).

Your messages aren't used to train any model.

Not by us, not by Anthropic, not by OpenAI. We don't have a training pipeline; we're not in that business. Both providers have explicit policies that API data is not used for training, and we've kept the matching toggles off on our accounts.

Only you, and the operator (Corey) for narrow reasons.

You can see your own data through the app, anytime. The operator (that's me, Corey) can technically read the database because someone has to be able to look when something breaks. That access is used narrowly: support tickets you've opened, and abuse review (e.g. a credible report of someone using the app to harass another person). It is not used for product research, curiosity, or any kind of casual browsing.

Our analytics provider (PostHog) only sees structural events (e.g. "user opened a chat", "user marked a fact as wrong") and never sees the message content itself.

You can ask us to forget. We will.

Delete your account in the app, or write to hello@getmooncake.com and ask. Your data goes into a 30-day soft-delete grace window first (so you can change your mind and recover), then a nightly cron permanently removes it from our database. Backups roll over within another 30 days.

You can also ask for an export of everything we have on you, in plain JSON, at any time. Same address.

The legal stuff lives in plain English here on purpose.

If you want a more formal version (DPA terms, subprocessor list, the rest), write to hello@getmooncake.com and we'll send you what you need. We'd rather answer specific questions than ship a wall of TOS text most people won't read.