Moodbow Privacy Policy
Last updated: 2 October 2026
Moodbow is a private journal made by Vitor Ribeiro Carvalho, trading as BurrowSoft (297 Moo 1, Baan Sanian, Mueang Nan, Nan 55000, Thailand), "we" in this policy. We wrote this to be read, not skimmed past. If anything is unclear, email support@moodbow.com.
The short version
- Only you can read your journal. BurrowSoft staff don't read journals; direct database access is limited to maintenance by Vitor Ribeiro Carvalho. We don't sell your data, show ads, or use your journal to train AI.
- You can export everything, or delete your account and everything in it, at any time, from the app.
1. What we collect
Your account: your email address, your password (stored only as a secure hash), and when you agreed to our Terms and this policy, and confirmed you're 18 or older. Using Moodbow without an email: you can start without giving us an email. We create an account for your phone that only it can use, and store your journal there like any other account. If you add an email later, your journal stays the same account. If you never add an email and don't open the app while connected to the internet for 12 months, we delete that account and its journal. Your journal: the entries you write, your daily check-ins (mood, sleep, movement (active minutes), stress), the dates they belong to, and which entries you mark as moments. Your settings: language, country, time zone, reminder time, and your AI choices (on or off, tone, focus areas). AI content (only if AI is on): the reflections and reports the AI writes for you. AI usage: for each AI request, the feature, the model, the number of tokens, the cost and the credits used. Not the text of your entries or of the AI's answer. Error reports: if the app or website crashes or another error happens, a technical report (device type, app or browser version, the error) is sent to our error-tracking provider. We remove personal details and any text you've written before it's sent, and the provider doesn't store your IP address.
Cookies and storage on your device: the website uses only the cookies it needs to work: one that keeps you signed in, and one that remembers whether you view your Timeline as a list or a calendar. It also keeps a few display choices in your browser, such as light or dark appearance and the cards you've already closed. None of them track you across sites or are used for advertising or analytics.
What stays only on your device: unsent drafts, your app-lock PIN, and the share cards you create. Share cards are made on your device and only leave it if you share them yourself.
Technical logs: like almost every online service, our hosting providers record IP addresses and device or browser information when you connect, for security and to fix problems. They keep these logs for a limited time (see §4). We also keep daily totals of AI use (how many reflections were made that day and what they cost us), with no link to any person, so we can keep costs under control. Emails you send us: if you write to support@moodbow.com, we keep the conversation so we can answer you, and delete it when it's no longer needed.
We don't collect your name, contacts, precise location, or advertising identifiers, and we don't use advertising trackers.
2. Why we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Running your account and your journal | Our contract with you (the Terms) |
| Processing your journal, which can reveal health and wellbeing information | Your explicit consent, given separately when you create your account (you can withdraw it by deleting your account) |
| Keeping the service secure and fixing crashes and errors | Our legitimate interest in a working, safe service |
| Answering your emails | Our legitimate interest, or our contract with you |
3. Who processes your data for us
| Provider | What for | Where |
|---|---|---|
| Supabase (on Amazon Web Services) | Database, accounts, file storage | Ireland (EU) |
| Anthropic | AI reflections and reports, only if AI is on | USA |
| Vercel | Hosting the website and web journal | USA and global edge network |
| Resend | Sending account emails (confirmation, password reset) | USA (company); emails are sent from Japan |
| Sentry | Error and crash reports, with personal details removed | USA |
Each provider may use your data only to provide its service to us. Anthropic doesn't use data sent through its API to train its models, and it deletes it after a short period (at most 30 days) that it keeps for safety and abuse monitoring. When data goes outside your country (for example from the EU to the USA), we rely on each provider's data-processing agreement and its data-transfer safeguards, such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
We never sell your data, and we never share it with advertisers.
4. How long we keep it
- Everything is kept until you delete it or delete your account.
- Deleting your account removes your journal, check-ins, AI content, settings, credits history and login from our live database immediately.
- Copies in our encrypted backups disappear automatically within 8 days.
- Error and crash reports are kept by our error-tracking provider for up to 90 days.
- Technical logs at our providers (hosting, database, email delivery) are kept only for a limited period set by each provider, and then deleted.
- When you delete your account, copies in those providers' logs also expire under these retention periods.
5. Your rights
Wherever you live, you can:
- see and download everything: Me → Export my data;
- correct it: edit any entry, check-in or setting;
- delete it: delete any item, or your whole account in Me → Delete account;
- object or ask questions: email support@moodbow.com. We answer within 30 days. You can also complain to a data-protection authority: in Thailand, the Personal Data Protection Committee (PDPC); in the EU or UK, your local authority.
6. Security
Your data is encrypted in transit (HTTPS) and at rest. Database rules make sure each account can only ever read its own rows. No system is perfectly secure; if a breach ever affects your data, we'll tell you and the authorities as the law requires.
7. Age
Moodbow is for people aged 18 and older. We don't knowingly collect data from anyone younger. If you believe a child has an account, email us and we'll delete it.
8. Changes
If we change this policy in a way that matters, we'll update the date at the top and tell you in the app before the change applies.
9. Contact
Vitor Ribeiro Carvalho, trading as BurrowSoft, 297 Moo 1, Baan Sanian, Mueang Nan, Nan 55000, Thailand · support@moodbow.com