privacy policy

what you give us

• Account: your email address. You sign in with a one-time code, so there is no password. We store the codes only in hashed form, and they expire after 10 minutes.
• Your Mochi and profile:
  • her name and colour, her card, and the clothes and colours you choose
  • her adoption number and birthday
  • your name as you enter it, your handle, and your bio
  • the signature you draw on her adoption papers
• Habits and answers: the habits you pick, when you do them, your streaks, and your answers to our questions (for example, when you have the most energy, and what motivates you). See section 3.
• How you found us: your answer to “how did you hear about Mochi?”, which may include that a professional, such as a doctor or therapist, recommended it. We use this only to understand where people come from. We don't ask about, and don't want, your medical history.
• Photos and posts: photos you take as proof of a habit or share to the feed, plus captions, comments, likes, and messages.
• Friends: who you add, accept, or block, and any reports you make.
• Purchases:
  • your plan and trial
  • the price you picked for the trial
  • your subscription status
  • what you buy with coins
  Payments are handled by Stripe (web) or Apple (iOS). We receive a record of the transaction, not your full card number.
• Messages to us: anything you send support.

what we collect automatically

• Usage:
  • the screens you see and the steps you take in the Service
  • when you take them
  • which version of the site you saw
  • events like starting checkout
• Identifiers: a random ID stored in your browser (the “web ID”) that links your visits, and a session cookie that keeps you signed in.
• Device and network: IP address, browser and device type, operating system, and language. We use your IP address to work out your approximate country. We don't collect precise location.
• On your device: the website saves your in-progress adoption in your browser's local storage, so you don't lose her if the page reloads. It stays on your device until you make an account.
• Diagnostics: error and performance logs that help us fix problems.

what we get from others

• Payment providers (Stripe, Apple, and RevenueCat, which manages app subscriptions) tell us whether a payment or subscription succeeded, renewed, or was refunded.
• Advertising platforms may tell us, in aggregate or by an ad click ID, which ads brought people to Mochi.
• Other users may mention you, add you as a friend, or report your content.

Some habits, like sleeping on time, drinking water, eating better, moving every day, or calming down, could say something about your health. Laws in some places, including Washington's My Health My Data Act and Nevada's consumer health data law, call this “consumer health data.” We treat all of your habit information, and your answers to our questions, as consumer health data and as sensitive, wherever you live:

• We collect it only to provide the features you asked for: tracking habits, reminders, streaks, your Mochi's reactions, and your settings.
• We never sell it, and we never share it with advertisers or use it to target ads.
• We share it only with the service providers who host and run Mochi for us, under contract, and as the law requires.
• Your habits are private by default. They become visible to others only if you choose to share them.
• You can see, delete, or withdraw consent to our processing of it at any time (section 10). You can also ask for a list of the third parties and affiliates we've shared it with.

By making an account and adding habits, you consent to this collection and use. If you don't, don't add habits you consider sensitive.

• To run the Service: make your account, sign you in, save your Mochi, track habits, give coins and items, run the shop and the feed, and sync between devices.
• To bill you: process trials, subscriptions, renewals, and refunds, and prevent payment fraud.
• To talk to you: send sign-in codes, receipts, notices about your subscription and our terms, and support replies.
• For news and offers: email you about your Mochi, what's new, and offers. You can unsubscribe from these at any time with the link in every email. Transactional emails still come.
• To keep Mochi safe: moderate content, act on reports, stop spam, abuse, and fake accounts, and protect our rights and users.
• To improve Mochi: understand which screens work, test versions of the site, and fix bugs. We use aggregated or de-identified data where we can.
• To advertise Mochi: measure which ads bring people to us (section 6). We never use your habits, answers, or photos for this.
• For the law: follow legal obligations, respond to lawful requests, and enforce our Terms.

We don't use your information to make decisions about you that have legal or similarly significant effects based solely on automated processing.

We don't sell your personal information for money. We share it only:

• With service providers who work for us under contracts that limit their use of it to our instructions. These include Cloudflare (hosting, database, file storage, and email delivery), Stripe (web payments), Apple and RevenueCat (app purchases), and providers of support and analytics tools.
• With advertising partners, in the limited way described in section 6.
• With other users, as described in section 7.
• For legal reasons: if we believe in good faith it's needed to follow the law or a legal process, protect anyone's safety, investigate fraud or abuse, or protect our rights and property.
• In a business transaction: if we're involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of it, under this policy.
• With your consent or at your direction.

We use a few kinds of storage in your browser:

• Necessary: the session cookie that keeps you signed in, and local storage that holds your adoption in progress. The website doesn't work without these.
• Analytics: the web ID and the screens and steps you visit, which we record ourselves to see where people drop off. It's not shared with advertisers.
• Advertising: the website may use the Meta Pixel and similar tags from other ad platforms, such as TikTok. They tell those platforms that someone who saw an ad visited, started checkout, or subscribed, so they can measure and improve our ads. They may use cookies and link this to your account with them. We send them only funnel steps and the plan you chose. We never send your habits, answers, Mochi, photos, or email address.

Under some US state laws, this advertising use may count as “selling” or “sharing” personal information, or “targeted advertising.” You can opt out in several ways:

• by emailing david@diallabs.so with “do not sell or share”
• by turning on Global Privacy Control in your browser, which we treat as a valid opt-out for that browser
• by blocking third-party cookies
• through the ad settings of the platforms themselves

The iOS app doesn't track you across other companies' apps and websites unless you allow it through Apple's App Tracking Transparency prompt. We don't respond to “Do Not Track” signals, which have no agreed standard, but we do honor Global Privacy Control.

• Always public: your Mochi (her name, look, clothes, and level), your handle, and your display name.
• Public unless you change it: your posts and their photos, captions, comments, and likes. You can make posts friends-only or private, and change the default.
• Private unless you share them: your habits, streak details, and answers.
• Never shown: your email address and your payment details.

Anything public can be seen by anyone, and copied or shared by them. Think before you post, especially photos of yourself or others.

We keep your information for as long as your account is open, and after that only as long as we need it for the reasons in this policy:

• Sign-in codes expire after 10 minutes. Sessions end after up to 90 days.
• When you delete your account, we delete or de-identify your information within 30 days. Copies in backups are gone within 90 days after that.
• If you never make an account, the adoption on the website stays only in your browser until you clear it.
• Records of purchases and payments are kept for as long as tax and accounting laws require, usually up to 7 years.
• Website analytics events are kept for up to 24 months.
• We may keep information longer where it's needed to resolve disputes, enforce our Terms, prevent fraud and abuse (for example, to stop a banned user returning), or comply with the law.

We protect your information with measures including:

• encryption in transit
• hashed sign-in codes
• limited access for staff
• infrastructure from established providers

No system is perfectly secure, and we can't guarantee that your information will never be accessed, disclosed, changed, or destroyed without authorization. Keep your email account secure, since it's the key to your Mochi account. If a breach affects you, we'll tell you as the law requires.

Depending on where you live, you may have the right to:

• know what personal information we have about you and how we use it
• get a copy of it in a portable format
• correct it
• delete it
• opt out of its sale or sharing, or of targeted advertising
• limit our use of sensitive information
• withdraw consent
• object to or restrict processing

We give these rights to everyone, wherever you live. You can delete your account at any time. Email david@diallabs.so for anything else.

• Verifying it's you: we'll confirm your request from the email address on your account, and may ask for more if we need it. You can use an authorized agent. We'll ask them for proof that you authorized them, and may ask you to confirm directly.
• Timing: we respond within 45 days (or one month in the EEA and UK). We may extend that where the law allows, and we'll tell you if we do.
• Appeals: if we decline your request, you can appeal by replying to our decision. If you're still not satisfied, you can contact your state attorney general.
• No discrimination: we won't treat you differently for using your rights.
• Emails: unsubscribe from marketing with the link in any email. We'll still send sign-in codes and account notices.
• Notifications and permissions: you can turn off notifications, camera, and photo access in your device settings. Some features won't work without them.

This section is for residents of US states with consumer privacy laws. These include California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Nebraska, and Rhode Island.

In the last 12 months we collected the following categories, from the sources in section 2, for the purposes in section 4:

• Identifiers (email, handle, web ID, IP address): shared with service providers. The web ID and ad click IDs go to advertising partners.
• Customer records (name as you enter it, and billing records through our payment processors): shared with service providers.
• Commercial information (plans, trials, purchases): shared with service providers. Whether you started checkout or subscribed goes to advertising partners.
• Internet activity (screens and steps on the website): shared with service providers. Funnel steps go to advertising partners.
• Approximate geolocation (country from IP address): shared with service providers.
• Audio, electronic, visual (photos, and the signature you draw): shared with service providers, and with other users as you choose.
• Inferences (the habit style and settings we suggest from your answers): shared with service providers.
• Sensitive: consumer health data (habits and answers): shared with service providers only.

We “sell” or “share” (for cross-context behavioral advertising) only identifiers, commercial information, and internet activity, and only to advertising partners, as described in section 6. You can opt out. We don't knowingly sell or share the personal information of anyone under 16.

We use sensitive personal information only for purposes the law allows without offering a “limit” right, such as providing the Service you asked for. We don't use it to infer characteristics about you. We keep each category for the periods in section 8.

We rely on these legal bases:

• Contract: to provide the Service you signed up for.
• Consent: for habit and health-related information, marketing emails, and advertising cookies. You can withdraw it at any time.
• Legitimate interests: to keep Mochi safe, prevent fraud, understand and improve the Service, and promote it. You can object.
• Legal obligation: for tax records and lawful requests.

You can complain to your local data protection authority, though we'd appreciate the chance to sort it out first at david@diallabs.so.

Mochi is not for children under 13, and we don't knowingly collect personal information from them. If you believe a child under 13 has given us information, email david@diallabs.so and we'll delete it and close the account. Users aged 13 to 17 must have a parent or guardian's permission. Parents and guardians can contact us to review or delete their teen's information.

We're based in the United States, and our providers process information in the US and other countries where privacy laws may differ from yours. When we transfer personal information from the EEA, UK, or Switzerland, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses and their UK equivalent.

We may update this policy and will change the date at the top. If a change is material, we'll tell you before it takes effect, by email or in the Service. Where the law requires it, we'll ask for your consent.

Questions or requests: david@diallabs.so, or write to Dial Labs LLC, 15 Beekman Hill Road, Essex Fells, NJ 07021.