Privacy Policy

Effective: January 1, 2026 · Last updated: January 1, 2026

Moonpath ("we," "our," or "us") makes a bedtime story app for children ages 5-8. We've built it the way we'd want a kids app built — with as little data collection as possible, no advertising, and no tracking. This page explains exactly what we collect and why.

The short version

• We don't ask for a name, email, phone, photo, address, or location.
• We don't show ads. We don't run third-party analytics. We don't sell data.
• The app saves story progress on your device. It works offline.
• We collect a random ID (a UUID generated locally) to send story notifications and remember which stories you've rated. It's not tied to any personal information.

What we collect

1. Anonymous device identifier

When the app starts for the first time, it generates a random UUID and stores it locally. We use it to send push notifications about new stories and to record anonymous story ratings. This identifier is not linked to any personal data and cannot be used to identify your child.

2. Push notification token

If you allow notifications, your device gives us a token from Apple Push Notification service or Firebase Cloud Messaging. We use it solely to send notifications about new stories or bedtime reminders. You can turn this off in your device's notification settings at any time.

3. Aggregate story ratings

When a kid taps a star to rate a story, we record only the star count (1-5). The rating is added to a per-story counter on our server. No identifier is sent. We use this to show an average rating and decide which stories work well.

4. App state on device

Your child's progress, earned stickers, sparks, and streak count are saved on your device using the operating system's local storage. None of this leaves the device unless you contact support and choose to share it.

What we don't collect

• Name, email, phone number, address, date of birth.
• Location, photos, microphone, camera, or contacts.
• Advertising ID. Our Android build explicitly removes the AD_ID permission so it cannot be requested.
• Behavioral or analytics data sent to third-party tools (no Google Analytics, no Facebook SDK, no Mixpanel, etc.).

Children's Privacy

Moonpath is designed for children. We comply with the Children's Online Privacy Protection Act (COPPA) and equivalent regulations in other jurisdictions. We do not knowingly collect personal information from children. The data we do collect (described above) qualifies as "internal operations" — strictly to make the app work — and contains no identifiers that could be tied to a specific child.

If you believe your child has provided personal information through the app, please contact us at hello@moonpath.app and we will investigate and delete it.

Service providers we use

• Cloudflare — hosts the app's backend. We store the anonymous identifiers and ratings in a Cloudflare D1 database.
• Apple Push Notification service / Firebase Cloud Messaging — delivers notifications. Used only for transactional pushes about new stories; no behavioral targeting.

We do not embed third-party analytics, advertising, or tracking SDKs anywhere in the app.

Your choices

• You can turn off notifications in your device's Settings at any time.
• You can delete the app to remove all on-device state.
• You can email hello@moonpath.app to ask us to delete the random device identifier from our server.

Changes to this policy

We'll update this page if we ever change what we collect. The "Effective" date at the top will reflect the latest revision. For material changes, we'll surface a notice in the app before the change takes effect.

Contact

Questions or concerns: hello@moonpath.app.

Placeholder document — final wording, business entity, and address will be filled in before App Store / Play Store submission.