Our Privacy Promise
MoodMonkey is built on a foundation of privacy and trust. We understand that your emotional journey is deeply personal, and we've designed our entire system to ensure your journal entries remain completely private—even from us.
We use end-to-end encryption and zero-knowledge architecture, which means your journal entries are encrypted on your device before they're ever sent to our servers. We literally cannot read your entries, even if we wanted to.
1. Information We Collect
1.1 Information You Provide Directly
When you use MoodMonkey, we collect:
- Account Information: Email address, username, and password (hashed and salted)
- Profile Information: Optional display name, profile picture, and timezone
- Journal Entries: Your mood data, journal text, and tags (end-to-end encrypted)
- Usage Preferences: Notification settings, app preferences, and customization choices
1.2 Information Collected Automatically
We automatically collect certain information about your device and usage:
- Device Information: Device type, operating system, app version
- Usage Analytics: Feature usage, session duration, crash reports (anonymized)
- Log Data: IP address, access times, and error logs (for security and troubleshooting)
1.3 Emergency SOS Location Data
SOS Emergency Feature:
When you activate the SOS emergency feature, we collect and share your GPS location coordinates with your designated emergency contacts to help them find you during a crisis. This location data is:
- Event-Driven: Only collected when you activate SOS (not continuous background tracking)
- Shared via Push & WhatsApp: Sent to your emergency contacts through app notifications and WhatsApp messages
- Encrypted in Transit: Protected during transmission to our servers and your contacts
- User-Controlled: You decide who receives your location by managing emergency contacts
- Biometrically Protected: Emergency contact list requires Face ID or fingerprint authentication to modify
Important: By using the SOS feature, you consent to sharing your location with your designated emergency contacts. WhatsApp message delivery means your location data passes through Meta's infrastructure (end-to-end encrypted).
1.4 Information We DO NOT Collect
We do not collect:
- Your journal content in plain text (it's encrypted before leaving your device)
- Location data for tracking purposes (only collected during SOS activation)
- Contacts or photos from your device without your permission
- Health data from Apple Health or Google Fit (unless you explicitly enable integration)
- Social media activity or browsing history
2. How We Use Your Information
We use the information we collect for the following purposes:
2.1 To Provide Our Services
- Create and manage your account
- Store and sync your encrypted journal entries
- Generate mood analytics and insights
- Send notification nudges (if enabled)
- Provide customer support
2.2 To Improve Our Services
- Analyze usage patterns to improve features (using anonymized data)
- Fix bugs and improve app performance
- Develop new features based on user needs
2.3 To Communicate With You
- Send important service announcements
- Respond to support requests
- Send optional product updates (you can opt out anytime)
We will NEVER:
- Sell your personal information to third parties
- Use your journal content for marketing or advertising
- Share your data with advertisers
- Train AI models on your private journal entries
3. Data Security & Encryption
3.1 End-to-End Encryption
All your journal entries are encrypted using AES-256 encryption on your device before being transmitted to our servers. Your encryption key is derived from your password and never leaves your device.
3.2 Zero-Knowledge Architecture
We've designed MoodMonkey with a zero-knowledge architecture. This means:
- Your encryption key is generated locally on your device
- We never have access to your unencrypted journal entries
- Even our engineers cannot read your private entries
- If you lose your password, we cannot recover your encrypted data
3.3 Additional Security Measures
- Transport Security: All data transmission uses TLS 1.3 encryption
- Password Security: Passwords are hashed using bcrypt with a strong work factor
- Two-Factor Authentication: Optional 2FA for additional account protection
- Regular Security Audits: Annual third-party security assessments
- Secure Data Centers: SOC 2 Type II certified infrastructure
4. Data Storage & Retention
4.1 Where We Store Your Data
Your encrypted journal entries are stored on secure cloud servers located in the United States. We use industry-leading cloud providers with robust security certifications.
4.2 How Long We Keep Your Data
- Active Accounts: We retain your encrypted data as long as your account is active
- Deleted Accounts: Data is permanently deleted within 30 days of account deletion
- Backup Retention: Encrypted backups are retained for 90 days for disaster recovery
- Legal Requirements: Some data may be retained longer if required by law
4.3 Data Deletion
You can delete your account and all associated data at any time from the app settings. Upon deletion:
- Your encrypted journal entries are permanently deleted within 30 days
- Your account information is removed from our systems
- Anonymized usage analytics may be retained for product improvement
5. Third-Party Services
We use carefully selected third-party services to operate MoodMonkey:
5.1 Essential Services
- Cloud Hosting: Amazon Web Services (AWS) / Firebase for encrypted data storage
- Authentication: Firebase Authentication for secure account management (Google, Apple OAuth)
- Payment Processing: RevenueCat / Stripe for secure payment handling (we never store credit card information)
- Push Notifications: Firebase Cloud Messaging for app notifications including SOS alerts
- WhatsApp Messaging: Meta's WhatsApp Business API for SOS emergency alerts (location data shared end-to-end encrypted)
5.2 Analytics Services
- Crash Reporting: Sentry for anonymized error tracking
- Privacy-Focused Analytics: Plausible Analytics (no cookies, no tracking)
Important: None of these third-party services have access to your unencrypted journal entries. They only process encrypted data or anonymized information necessary for their specific function.
6. Your Privacy Rights
You have the following rights regarding your personal information:
6.1 Access & Export
You can access and export all your data at any time from the app. We provide:
- Complete journal export in multiple formats (JSON, CSV, PDF)
- Account information download
- Usage analytics summary
6.2 Correction & Update
You can update your account information and preferences directly in the app.
6.3 Deletion
You can delete your account and all associated data at any time. Contact us at privacy@moodmonkey.app for assistance.
6.4 Opt-Out Rights
- Marketing emails: Unsubscribe link in every email
- Push notifications: Disable in app settings
- Analytics: Limited to essential functionality (no tracking)
6.5 GDPR Rights (EU Users)
If you're in the European Union, you have additional rights under GDPR:
- Right to be forgotten
- Right to data portability
- Right to restrict processing
- Right to object to processing
6.6 CCPA Rights (California Users)
If you're in California, you have rights under CCPA:
- Right to know what personal information is collected
- Right to delete personal information
- Right to opt-out of sale (note: we don't sell personal information)
- Right to non-discrimination
7. Children's Privacy
MoodMonkey is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you're a parent and believe your child has provided us with personal information, please contact us at privacy@moodmonkey.app and we will promptly delete it.
For users aged 13-17, we recommend parental guidance when using MoodMonkey.
8. International Users
MoodMonkey is operated from the United States. If you're accessing the app from outside the US, your information will be transferred to, stored, and processed in the United States.
We comply with international privacy frameworks including:
- GDPR (General Data Protection Regulation) for EU users
- UK GDPR for UK users
- Swiss Federal Data Protection Act for Swiss users
9. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by:
- Posting the updated policy with a new "Last Updated" date
- Sending an email notification to your registered email address
- Displaying an in-app notification
Your continued use of MoodMonkey after changes become effective constitutes acceptance of the updated policy.
10. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:
Email: privacy@moodmonkey.app
Data Protection Officer: dpo@moodmonkey.app
Mail:
MoodMonkey Privacy Team
123 Privacy Lane
San Francisco, CA 94102
United States
We aim to respond to all privacy inquiries within 48 hours.