Privacy Policy

Last updated: 1 November 2026. This policy covers the Moonto mobile app, the Checkpad device, and the moonto.app website.

1. Who we are and what this covers

Moonto is made by MOONTO S.A.R.L-S ("Moonto", "we", "us"), a company established in Luxembourg at 90 Route d'Arlon, L-8210 Mamer. We are the data controller for the personal data described in this policy. "Personal data" means any information that identifies you, on its own or combined with other information we hold.

Because we are established in the EU, the EU General Data Protection Regulation (GDPR) applies to our processing of your data wherever in the world you use Moonto. Where local law gives you additional rights — for example in the United Kingdom, Switzerland, Brazil, Canada, South Africa, or individual US states — those rights apply on top of what is described here.

What this policy applies to

This policy applies to:

• The Moonto app on iOS and Android — your lists and everything in them, your calendar events and reminders, contacts, cards, and any use of Moonto's AI assistant.
• Moonto's integrations — personal access tokens, the REST API, the connection for AI assistants (MCP), webhooks, and our older public API used by services such as IFTTT.
• Checkpad, our physical wall-mounted button device, and its registration to your account.
• The moonto.app website and the pages linked from the app.

Two versions of the app are in use: the current version (version 3) and the previous one (version 2), which is still installed on some devices. Some features described below, notably the AI assistant (§ 5) and the integrations, exist only in version 3. Where the two versions differ in a way that matters for your privacy, we say so.

Our online shop runs on a separate system at shop.moonto.app and has its own privacy notice covering purchases made there.

This policy does not cover third-party services you reach through links we provide, or that you choose to connect to Moonto (§ 8). Those services have their own privacy practices, and we are not responsible for them.

2. The personal data we collect

2.1 Account data

When you use Moonto we hold an account record containing your user ID and, depending on how you signed in, your email address, display name, and profile photo, along with your country, language, currency, units and time zone, and your app preferences (for example notification settings and the order of your lists). Moonto supports signing in with Google, with Apple, with an email address and password, or anonymously without registering at all. If you use Moonto anonymously we hold no email address for you and cannot identify you outside the app.

We also keep a small public profile — your display name and profile photo — that other Moonto users can see, in practice the people you share lists, spaces or cards with. If you have not set a display name, your email address is used in its place, which means it will be visible to them. Set a display name in Settings if you would rather it were not.

2.2 The content you create

This is the bulk of what Moonto stores. Your content is organised in lists, and each list has a kind that decides what its rows hold:

• Shopping lists — item names, quantities, notes and categories.
• Tasks and routines — titles, descriptions, due dates, categories, recurrence, who a task is assigned to, and completion history.
• Notes — the text you write.
• People — names, phone numbers, email addresses, companies, notes and a photo. See § 6, because this is data about other people.
• Expenses — amounts, dates, the person or client concerned, and receipt photos.
• Cards — loyalty and membership cards you add, including their barcode and any card image you photograph.
• "About me" — facts you ask the assistant to remember about you (§ 5.1).
• Lists of your own design, with the fields you choose.
• Attachments — photos, voice clips and other files you attach to a row.
• Calendar events and reminders — titles, dates, times, notes, and where you fill them in, an address, email address and phone number for the event.
• Contacts — see § 6.
• Spaces and shared lists — how you group and name your lists, and who the members of each shared list, space or card are.

All of this is free text and media that you provide. We do not restrict what you put in it, which means it can contain anything you choose — including other people's names, health or medical appointments, or other sensitive details. Please bear that in mind, particularly in light of the AI processing described in § 5.

2.3 Device data

For each device you sign in on, we store a device identifier generated by the app, the device platform (iOS, Android or web), a notification token issued by Firebase Cloud Messaging so we can send you push notifications, and the time the device was last seen.

2.4 Purchases, subscriptions and Checkpad

If you buy a Moonto subscription, the payment itself is handled by Apple or Google — we never see or store your card number. Our subscription provider, RevenueCat, receives your Moonto user identifier — not your name or email address — and records which products you have bought, when, at what price, in which store, and whether your subscription is currently active. Some of this subscription information is written back into your Moonto account record, and your entitlement status is attached to your sign-in credentials so the app knows what you have access to. Our servers also ask RevenueCat whether your subscription is active.

If you have ordered or registered a Checkpad device, we hold your order and the device's registration against your account: its serial number, model, firmware version, settings, battery level, the last time it was in contact, which list and item each button adds, and the name and password of the Wi-Fi network you connect it to, which the app reads from the device during setup and stores with the device record. Each button press travels from the device through Amazon Web Services to our servers, which add the item to your list and record the press.

2.5 What you send to the AI assistant

If you use Moonto's AI features (version 3), we process what you send: typed text, voice recordings, and photographs. § 5 describes this in detail, because it is the part of Moonto with the widest privacy implications.

2.6 Messages you send us

If you write to us from the app (Settings › Contact), we store your message, its category, the name and reply address you give, your user ID, your device platform and operating-system version, the app version and your language, and we email all of it to our support mailbox so we can answer you. If you email us directly, we receive what you write and your email address.

2.7 Integrations you set up

If you create a personal access token, we store a protected (hashed) form of it, its first characters so you can recognise it, the name you give it and what it is allowed to do — never the token itself. If you register a webhook, we store its address and its signing secret, and a record of each delivery (§ 8). If you connected Moonto to a service through our older public API, we hold the authorisation that service uses.

2.8 Usage and diagnostic data

We record events describing actions taken in the app — items added, items checked off, invitations sent and accepted, Checkpad button presses — each tagged with the account that performed it. We use these to produce aggregate statistics about how Moonto is used, and they also back the Moonto public API for lists and Checkpad devices. We also keep counters of your use of the assistant (daily, weekly and monthly) to apply the limits of your plan, and your progress in the app.

The app includes several Google Firebase components that report back to us automatically: Crashlytics, which sends a diagnostic report when the app crashes, tagged with your Moonto user ID; Analytics, which records aggregate usage along with app-open, sign-in, sign-up and purchase events; Performance Monitoring, which reports how quickly the app runs; and In-App Messaging, which delivers messages we send inside the app. Crash reports can contain technical details about your device and the state of the app at the moment it failed. These components are active by default and the app does not currently offer a way to turn them off.

Version 3 of the app shows no advertising, and the Android app no longer requests access to your device's advertising identifier. Version 2 shows banner advertising served by Google AdMob, which may use your device's advertising identifier under Google's own policies. We do not sell your personal data, and we do not share your lists or other content with advertising networks.

3. Where your data is stored

Moonto runs on Google Cloud in Europe:

• Database. The current version of Moonto keeps your lists, contacts, cards and account record in a Google Cloud Firestore database in europe-west1 (Belgium). Data from version 2 sits in a second Firestore database in Google's European multi-region eur3 (Belgium and the Netherlands) until your account moves to the current version.
• Servers. Our application servers and the AI service run in europe-west1. One exception: the function that deletes your data when your account is deleted runs in Google's us-central1 region (United States).
• Files. Card photos, attachments and profile photos are kept in Firebase Storage, in the same Google Cloud project.
• AI processing. The Gemini model is called on Google Cloud's European Union endpoint, so the request sent to the model is processed in the EU. The search index (§ 5.6) is built in europe-west1. Voice recordings are transcribed by the same Gemini model, on the same endpoint. If we use Google Cloud Speech-to-Text for a language, it is called on its global endpoint and the recording may then be processed outside the EU; we currently use it for no language.
• Checkpad. Button presses pass through Amazon Web Services in Frankfurt (eu-central-1).

Some of the providers in § 7 process data outside the European Economic Area — for example RevenueCat in the United States, and Google for the Firebase diagnostic components. Where that happens, the transfer relies on the European Commission's Standard Contractual Clauses or another safeguard the GDPR allows.

4. Why we process your data, and on what legal basis

Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights, and you can object at any time — see § 10.

On Android, scanning for a Checkpad over Bluetooth requires the location permission. We do not read or store your location. Reading text from a photo (for example a business card) and scanning barcodes happen on your device.

5. AI features, in detail

The AI features exist in version 3 of the app. Moonto uses Google's Gemini model and a Google embedding model, both provided through Google Cloud Vertex AI. Google acts as our processor. Moonto does not train any model on your data, and Google Cloud's terms for Vertex AI state that your data is not used to train its models. What Google retains is governed by its Google Cloud terms, not by us.

Your content reaches a model in several distinct ways. Some happen only when you ask; others happen automatically in the background. We describe them separately because that distinction matters.

5.1 When you ask the assistant something (you initiate this)

For each request, the model receives: your message (text, voice or photo); the name and type of each of your lists; your "About me" facts; your language, the date and time, and the list that is open; the last six exchanges with the assistant, if they are less than ten minutes old; and rows from your lists, but only those the assistant reads with its search and read tools, at most fifty per read. Nothing else. Rows can include item titles, quantities, due dates and who an item is assigned to; if a task is assigned to another Moonto user, that person's user identifier forms part of that data.

At your request the assistant can also add, change or delete rows and create lists. We keep a record of each request — the text of your request, the transcript of a voice message, a summary of the answer, and what is needed to undo it — so you can see your history and undo a change. You can delete that history at any time in Settings › Storage and privacy.

"About me". When you ask the assistant to remember something about you, it is kept as a fact in a private "About me" list that only you can see, edit or delete, and that cannot be shared. A fact can carry an expiry date, after which it is no longer used. These facts are sent with each of your requests so the assistant can take them into account.

5.2 Voice and photos (you initiate this)

When you speak to the assistant or send it a photo, the recording or image is sent with your request directly to our AI service, which passes it to the model. The model receives the recording itself, and also produces the transcript. We do not store the recording or the photo. What we keep is the transcript, as part of the request record in § 5.1.

A small number of recordings and photos sent to earlier test versions of the assistant are still in our file storage. Each is deleted when the account it belongs to is deleted, and you can ask us to delete yours at any time.

5.3 Notes, imports, forwarded emails and things you share into Moonto (you initiate this)

When you ask for a title for a note, or dictate a note, the note text or the recording is sent to the model and the result comes back to you; we keep no record of the call. When you import content — for example during onboarding, or by sharing text or photos into Moonto from another app — it is sent to the model, which proposes rows for you to review. We keep the proposal for 90 days (§ 9); the rows you accept become ordinary rows in your lists.

Each account can have a private forwarding address on in.moonto.app, shown in the app's settings. An email you forward to it is received by Mailgun, our inbound email provider, in its European Union region, which hands it to our AI service. Its subject, its text and its image and PDF attachments are then processed by the model like a request you make in the app (§ 5.1, § 5.2) and become rows in your lists. We keep the sender's address and the subject on the request record (§ 9); the text and the attachments are deleted as soon as the request has run, and within a day in any case. Nothing else from the email is stored, and Moonto never replies to it. An email sent to an address that belongs to no account is discarded without being stored. You can replace your address in the app at any time; the old one stops working at once.

5.4 Automatic categorisation (happens in the background)

When you create a task without a category, or change a task's title, the title — together with the names of the available categories and today's date — is sent to Gemini to work out which category it belongs to and whether it looks like a calendar event. This happens for every user of version 3, in the background, whether or not you have ever opened the assistant. It means that task titles you type reach Google's model even if you never knowingly use an AI feature.

When you add a shopping item that our catalogue does not recognise straight away, our servers match it against the catalogue without any AI model. If we switch on a second matching step, the item name is sent to the model in the same way.

5.5 Nightly enrichment of task titles (happens in the background)

When this feature is switched on, once a night Moonto collects the task titles you created recently and sends them to Gemini in a single batch, asking what person, place or thing each title is about. The answers build a private vocabulary for your account, which is what lets the app complete "Call Mom" as you type it, and can suggest a category for a task that has none.

Precisely what this does and does not involve:

• What is sent: the task title text, an internal identifier for the task, and your language setting. No name, no email address, no user account identifier, no contact details, no list membership, no task descriptions or due dates. Very short titles and long ones (over 80 characters) are never sent.
• What is kept: only text you typed yourself. An extracted word is rejected unless it appears inside the title you wrote, so nothing the model invents can be stored.
• What it is for: your own autocomplete and category suggestions. It is not used for profiling, for advertising, or to train any model.
• How often: once per title. A title is sent again only if you edit it.
• Where it goes: Google's European Union endpoint, as in § 3.

Because task titles are free text, they often name real people — "Call Dr. Weber", "ring Mum about the boiler". That is processing of personal data about people who are not Moonto users, and § 6 applies to it.

The vocabulary built this way, and the words the app learns as you type, live in your account. Records tracking which titles have already been processed are deleted after 30 days.

5.6 Search indexing (happens in the background)

So that you and the assistant can search your lists by meaning rather than exact words, we send the text of each row — its title, its text fields and its description — to a Google embedding model in europe-west1, which returns a numeric representation we store alongside a copy of that text. An index entry is deleted when the row it was built from is deleted.

5.7 Improving the shared catalogue (happens in the background)

When this feature is switched on, we look for shopping item names that our catalogue does not recognise and that several different people have typed, and ask the model to propose catalogue entries for them, which we review by hand. Only the item text, its language and how often it was typed are used — never who typed it.

6. Contacts, and people who are not Moonto users

Moonto lets you keep contacts, keep lists of people, and invite people to share your lists, spaces and cards. A contact record can hold that person's email address, first and last name, nickname, phone numbers, company, address, and how they relate to you. A row in a list of people can hold their name, phone number, email address, company, notes and a photo. If you fill one in from your phone's address book, the app reads only the contact you pick.

We want to be direct about what this means: this is personal data about someone who has not agreed to anything with us. When you add a contact, you decide what to store about another person. Please only add details you have a proper reason to hold, and keep in mind that a task, list row or item naming that person may be processed as described in § 5.

When you invite someone by email, we send an email to the address you gave us and record whether it was sent and accepted. That email identifies you — by your display name, or by your email address if you have not set one — and names the list you are inviting them to. A person only becomes a member when they accept; Moonto never adds someone to a list without their acceptance. An invitation link you create works for whoever holds it until it expires, after seven days, so share it only with the people you mean to invite.

If the address you enter already belongs to a Moonto account, the contact is linked to that account so the invitation can be delivered in the app as well as by email. This means the app shows you that the person uses Moonto.

If you are not a Moonto user and someone has stored your details: you have the same rights over that data as anyone else. Email us at ar@moonto.app and we will locate and delete it. You do not need a Moonto account to make that request, and we will not require you to create one.

7. Who we share your data with

We do not sell your personal data. We share it only with the service providers we need to run Moonto, each of which processes it on our instructions:

We may also disclose personal data where we are legally required to, to comply with a request from a public authority or a court, to prevent harm, or to establish or defend legal claims. Where we are permitted to tell you, we will.

If Moonto is ever involved in a merger, acquisition or sale of assets, personal data may be transferred as part of it. We will tell you before that happens and before any different privacy policy starts to apply.

8. Sharing with other people, and tools you connect

When you share a list, a space or a card, the people you share it with can see it, everything in it, and your display name. Anything you add to a shared list is visible to every member. If you later delete your account, a shared list or card you own is passed to another member rather than deleted, so that they do not lose it — which means content you contributed remains visible to the other members after you leave.

Tools you connect. You can give other software access to your lists: an AI assistant through our MCP connection, a script or app through our REST API, a service such as IFTTT or Home Assistant through our older public API, or any address you register as a webhook. Each of them receives the data you allowed it to reach — for example, a token with write access can add, change and delete rows, and a webhook receives the content of each changed row. Once data reaches that tool, its use is governed by that tool's own terms, not by this policy. You can revoke a token or remove a webhook at any time in the app; changes an AI assistant makes through a token appear in your assistant history and can be undone.

9. How long we keep your data

We keep your personal data for as long as your account is active, and for a limited period afterward if you stop using Moonto.

Inactive accounts

If you have not used Moonto for at least 180 days (accounts created without registering an email address or a sign-in provider) or at least 1 year (registered accounts), we may delete your account and the content associated with it — the data listed in § 11, in both of our databases. We measure this from the last time the app was used while signed in to your account, on any of your devices, not from the last time you changed something. We check this again at the moment of deletion, so an account used in the meantime is kept. We do not currently send a warning before deleting an inactive account.

This does not apply to you if any of the following is true:

• you have an active subscription, or you have paid for a Moonto subscription or purchase at any time in the past;
• you have ordered a Checkpad, or a Checkpad device is registered to your account;
• you use Moonto through an integration: an account connected to our older public API, a personal access token that has not been revoked, or a registered webhook;
• you have a separate arrangement with us to retain your data.

When we delete an inactive account, we keep a short record that the deletion took place: the account identifier, how long it had been inactive, and how many records were deleted.

Why we do this. Keeping data for accounts nobody uses any more increases the risk if that data is ever exposed, with no benefit to you. Deleting it is how we limit that risk.

Your choice either way. You can delete your account and its data at any time from within the app, or by contacting us at ar@moonto.app — you do not need to wait for inactivity.

Specific retention periods

Deletion at the end of a period is automatic and typically completes within a day. Some older records, created by earlier versions of Moonto before these periods were introduced, carry no automatic expiry. They are deleted when the account they can be linked to is deleted, and we are removing the rest.

10. Your rights

You have the right to ask us for a copy of the personal data we hold about you; to have inaccurate data corrected; to have your data deleted; to restrict or object to how we use it; to receive it in a portable, machine-readable format; and to withdraw any consent you have given, without that affecting processing already carried out.

You also have the right not to be treated worse for exercising any of these rights.

Depending on where you live you may have further rights, including to opt out of targeted advertising, the sale of personal data, or profiling with legal effects. Moonto does not sell personal data or profile you, but the rights stand regardless.

How to exercise them

If you signed in with an account, you can delete it and its data directly in the app, under Settings. In version 3, Settings › Storage and privacy also lets you export your lists, rows and "About me" facts, and delete your assistant history. For anything else, or if you use Moonto without registering, email ar@moonto.app. We will respond within one month. We may need to verify your identity first, and we will not ask you for more information than is necessary to do so.

If you are unhappy with how we have handled your data you can complain to your local data protection authority. In Luxembourg this is the Commission nationale pour la protection des données (CNPD), cnpd.public.lu. A list of EEA authorities is available from the European Data Protection Board.

11. What happens when you delete your account

When you delete your account, we remove it from both of our databases: your account record and public profile; the lists only you use, with their rows, attachments and search index entries; your tasks, events, reminders, contacts and invitations; your devices; your assistant requests, imports and conversation context; your access tokens, webhooks and their deliveries; the messages you sent us from the app; your usage counters and progress; the activity events you generated; your card photos and profile photos; and any recordings or photos left from earlier test versions of the assistant (§ 5.2). Lists and cards you own that are shared with other people are transferred to another member rather than deleted, and your membership is removed from lists and cards owned by others.

Some records are not removed by this automatic process:

• your Checkpad device registration and its button settings;
• subscription and purchase records we need for accounting;
• the autocomplete vocabulary built from your task titles (§ 5.5);
• the spaces you created or joined;
• the definitions of list kinds you designed yourself (their names and fields, not their rows);
• content you added to lists or cards that other people still use, as explained in § 8;
• copies of the invitation and support emails we sent, held by our email system and in our support mailbox.

If you want these deleted as well, email us and we will do it manually.

12. Children

Moonto is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, contact us and we will delete it.

13. Security

Data in transit between the app and our servers is encrypted, and data at rest is encrypted by Google Cloud. Access to the database is restricted by per-collection security rules, so that you can reach your own records and those shared with you, and not other people's private records. We require the providers listed in § 7 to protect data to an equivalent standard. If a personal data breach occurs, we will notify you and the relevant regulator where the law requires it.

14. The moonto.app website and cookies

The moonto.app website is hosted on Google Firebase Hosting, which processes your IP address and browser details to deliver the pages to you. The website does not ask you for any personal data; if you email us from it, § 2.6 applies.

Cookies on this website

This website (moonto.app) sets no cookies unless you agree. It uses Google Analytics, provided by Google Ireland Limited, only with your consent: if you click "Accept" in the cookie banner, we load Google Analytics, which sets first-party cookies (_ga and _ga_<ID>, kept for up to two years) to count visits and understand how our pages are used. We do not use them for advertising. If you click "Decline", or make no choice, Google Analytics is not loaded and no request is sent to Google. You can change your choice at any time with the "Cookie settings" link at the bottom of our pages; withdrawing consent deletes these cookies from your browser.

15. Changes to this policy

We may update this policy. When we do, we will post the updated version here and change the date at the top. If a change materially affects how we use your personal data, we will make a reasonable effort to tell you in the app before it takes effect.

16. Contact us

For any privacy question, or to exercise any of the rights in § 10, email ar@moonto.app.

Or write to us:

Data Privacy Officer
MOONTO S.A.R.L-S
90 Route d'Arlon
L-8210 Mamer
Luxembourg