Moji Privacy Policy

1. Information We Collect

We collect information directly from you, automatically when you use the Services, and from the third-party accounts you choose to connect.

a. Information you provide

• Account data: name, email address, and authentication tokens if you sign in through a third-party provider.
• Communications with us: any correspondence you send us, including support requests and feedback.
• Preferences: settings, notification and marketing choices.

Spaces: the projects you create, what you ask Moji to do, and the notes, plans, files, links, and details you add to them, including details about other people in your life. Approval preferences are part of your settings.

b. Information we collect automatically

• Device information: IP address, device type, operating system, browser type, unique device identifiers.
• Usage data: when you sign in, which features you use, crash reports, and security logs.
• Cookies and local storage: see Section 15.

Agent activity: the actions Moji proposes, the approvals you give, the actions taken on your behalf, and the output Moji creates for you.

c. Information from accounts you connect

When you connect an account, we access only the information needed for the features you enable and the permissions you grant. You can disconnect an account at any time.

A wider set of connections, which may include email messages and metadata, calendar events, files, and contacts. Moji creates summaries, plans, reminders, and proposed actions from that information.

d. Payment information

Your Moji subscription. Moji's paid plan is bought through Apple's in-app purchase, so Apple handles your payment information. We receive a transaction identifier and the state of your subscription, such as the plan, the renewal date, and whether it is active. We never see your card details. Purchases Moji makes for you. Purchases you approve inside Moji are processed by Stripe through Stripe Link. We receive the information needed to confirm and support the transaction, such as status, amount, and a transaction identifier. We do not receive or store your full card number.

e. Information about other people

You may add information about another person to a space. Please share only what you have the right to share. We process that information to provide the features you request. We do not otherwise collect data about people who are not our users.

2. How We Use Your Information

We use personal information only for legitimate purposes, including:

• Provide and operate the Services: delivering the features you use, such as running your spaces and keeping track of what is outstanding.
• AI-powered features: we process your content to power features such as summarizing, categorizing, drafting, and suggesting next steps. See Section 4 for what this means for training.
• AI service providers: some features use artificial intelligence provided by us or third-party vendors. When you use those features, the data necessary to perform the requested action may be processed by those providers. This processing is limited to delivering the feature you initiate, and those providers are not permitted to use it to train their AI models. You remain responsible for reviewing any AI-generated output before using or relying on it.
• Automated processing: some features sort, categorize, or summarize information automatically. They are designed to assist you, not to make independent decisions that produce legal or similarly significant effects.
• Improve and customize the Services: troubleshooting, analyzing usage trends, and testing features.
• Communicate with you: service updates, support messages, and account notices.
• Marketing (opt-out): we may send you updates or newsletters, and you can opt out at any time.
• Security and compliance: fraud prevention, detecting abuse, protecting the integrity of the Services, and complying with legal obligations.

Moji can act on your behalf: it can send messages, make calendar invitations and buy things.

By default, sensitive actions need your approval before they happen. See Section 3.

3. Approvals and Actions

By default, Moji asks for your approval before taking a sensitive action, such as making a purchase. Moji uses its best efforts to recognize which actions are sensitive. You see what is proposed before it happens, and it does not go ahead until you approve it. Moji does not ask before ordinary work, such as reading, organizing, summarizing, or drafting something for you to look at.

Activity log. Moji keeps a record of the actions it has taken. The log is available to you in the app at any time.

Purchases. Payment is handled by Stripe through Stripe Link, which supplies a single-use card number rather than giving Moji your real card details.

Changing what needs approval. Approval before sensitive actions is the default. You can ask Moji to change which actions need your approval.

4. AI Models and Training

We never sell your data, and we never send it to our model providers to train their models. Moji uses AI models provided by third parties to deliver features you ask for. Our agreements with those providers prohibit them from using your data to train or improve their models. The data sent to them is limited to what is needed to carry out the action you initiated. Moji names those providers in its vendor list. See Section 9.

Training is on by default, and you can turn it off at any time. We use your data to train and improve the AI models behind Moji, so the product gets better at the things you use it for. This is only ever to improve Moji for you. You can turn it off in your settings whenever you want, and we stop using your data for training from that point.

Google data has its own rules. Google user data is never used to train generalized AI models. It may only ever be used to improve Moji for you personally, and never to improve Moji for anyone else. See Section 5.

5. Google User Data and Limited Use

If you connect a Google account, our use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we access and why

When you sign in with Google, Moji asks for your name, email address and profile picture, access to read, organize and send email in Gmail, and access to your Google Calendar. Moji uses your mail and calendar to do what you ask in your spaces, such as finding details, keeping track of what is outstanding, drafting messages and proposing events. It sends email or changes your calendar only as described in Section 3. Calendar access is optional, and you can use Moji with your mail alone.

• We use Google user data only to provide or improve features that are visible to you in the product.
• We do not transfer Google user data to others except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with your consent.
• We do not use Google user data for advertising.
• We do not allow humans to read Google user data unless we have your affirmative agreement for specific messages, it is necessary for security purposes such as investigating abuse, it is necessary to comply with applicable law, or the data has been aggregated and anonymized and is used for internal operations.
• We do not use Google user data to create, train, or improve a machine learning or artificial intelligence model, other than a model personalized to you, for the features you use. You can turn training off at any time in your settings. Google user data is never used to train generalized models, ours or our providers'.

6. Credentials and Passwords

Your credentials stay secured and in your control. Credentials you provide are securely stored within the virtual computer your spaces use. We cannot read them, they are not visible to our team, and they are never sent to our AI model providers. Your passwords are never accessible by us. If you remove them, Moji can no longer use them.

Connection credentials are different. When you connect an account or service, we may use an access token or, in some cases, securely transfer a session cookie to establish the connection. Access tokens may be stored securely by us so the connection continues to work and are deleted when you disconnect the account or delete your account. Session cookies are transferred securely and are never stored or retained by us. See Section 10.

7. Shared Spaces

You can invite other people into a space. When you do, the members of that space can see the content and the agent activity available to it, and we process the information needed to send the invitation and manage access. Check a space's membership before adding sensitive information.

If you approve or allow an action that sends information to someone outside Moji, the recipient may keep their own copy. We cannot delete copies held by other people or services.

Leaving a space, and deleting your account. If the owner of a shared space deletes their Moji account, we delete the spaces they own. If another member deletes their account or leaves a space, what they already contributed stays in that space for the other members, and nothing further is added from them. The same applies if an owner leaves a space without deleting their account.

8. Text Messages

If you give Moji your phone number, we use it to sign you in, to text you sign-in codes and updates on what you ask Moji to do, and to reply when you text Moji. Moji tells you this where you enter your number. Message frequency varies, and message and data rates may apply. Reply STOP to stop texts, or HELP for help.

We do not share your number or your consent to texts for marketing. We do not sell, rent or share your phone number, text messaging opt-in data or consent with third parties or affiliates for their marketing or promotional purposes. We share them only with the service providers that deliver our texts, such as Twilio.

When you text Moji, we handle your messages like anything else you ask Moji to do. See Section 10.

9. How We Share Information

We do not sell your personal information.

• Service providers and subprocessors: we work with third-party companies to help operate, support, and secure the Services, including hosting, security, payments, analytics, and AI functionality. They process personal information on our behalf, only as instructed by us, and receive the minimum necessary data. Moji publishes its current list in its vendor list. You can ask us which providers handle your data at any time by emailing help@buildforever.com.
• People you choose: members of a space you share and recipients of actions you approve or allow. See Section 7.
• Legal purposes: if required by law, subpoena, or government request, or to protect the rights, property, or safety of BuildForever, our users, or others.
• Business transfers: in the event of a merger, acquisition, or asset sale, your information may be transferred to the successor entity. Any transfer of Google user data will follow Google's applicable consent requirements.
• With your consent: where you explicitly agree to share data with a third party.

We do not give the content of your email or your connected accounts to advertising platforms. See Section 15 for the technologies our websites use.

10. Data Retention and Deletion

We retain personal information only as long as necessary to provide the Services, comply with our legal obligations, and enforce our agreements. We retain only what the law requires us to keep, for the period required, kept apart from ordinary product use.

Delete your account and everything in it is gone within 30 days. When you delete your Moji account, we remove your personal information and content from the systems we control within 30 days, backups included. See the account deletion page.

A deleted Moji account is removed from the product immediately. We hold it for the rest of that window only so we can recover from an exceptional situation such as a security incident or a system failure, and it is not used for anything else in the meantime. Two things are not removed: content you contributed to a shared space owned by someone else stays with that space for its other members, and anything you already sent outside Moji stays with its recipient. Disconnect a connected account and Moji stops accessing it immediately, and the connection tokens and the content we hold that came only from that account are deleted within 30 days. Disconnecting removes what we hold from that account, not just our access to it. Work already in a space, such as a plan or a saved detail, stays there until you delete it, even if Moji built it partly from the account you disconnected. You can delete a space, or anything in it, at any time.

Moji does not keep a copy of your mailbox. When Moji reads an email to carry out what you have asked, it holds that email only in temporary memory, for no more than 24 hours, and does not write it to our databases. Details drawn from an email can appear in what Moji keeps for you, such as your conversations with Moji and the plans and summaries in a space, and in records of Moji's work that we keep for up to 7 days to run and fix the service.

11. Your Privacy Choices and Rights

• Access and correction: request access to your personal information and ask us to correct inaccuracies.
• Deletion: request deletion of your account and associated data. You can delete a space, disconnect an account, or delete your account and everything in it, all from the app, without emailing us. See Section 10.
• AI training: on by default, and you can turn it off at any time in your settings.
• Sharing: manage who has access to each space.
• Marketing opt-out: unsubscribe from promotional communications at any time. Service and security messages may still be sent.
• Restrictions: request that we limit or stop processing in certain circumstances.

To exercise these rights, contact us at help@buildforever.com. We may need to verify your identity before responding.

12. Security

CASA Tier 2. Moji's Google Cloud Application Security Assessment at Tier 2, the level required for apps handling restricted Google user data, is pending. Once complete, it is reassessed annually. Strix, an independent security company, also tests our systems for vulnerabilities every week on a continuous basis. Findings are triaged and fixed on a defined schedule.

How we protect your data.

• Encryption at rest. Data we store is encrypted with AES-256. The tokens that let us reach your connected accounts are encrypted again before storage, with keys held in Google Cloud Key Management Service.
• Encryption in transit. Connections to our Services use TLS 1.2 or newer.
• Infrastructure. Our Services run on Google Cloud. Google's infrastructure is independently audited for SOC 1, SOC 2, SOC 3 and ISO/IEC 27001. Those reports cover Google, not us.
• Staff access. Only a small number of people on our team can access the production systems that store your information, and every staff account must use 2-step verification. Each time one of them reads data in our production database, we log who read it and what they looked up, and we review that log every day.

Whichever email provider you use, a person on our team reads the content of your email only in the circumstances described in Section 5.

No system is completely secure. If we experience a data incident that affects you, we will notify you as required by law.

13. International Users and Transfers

BuildForever is based in the United States.

Moji is intended for users in the United States.

Wherever you use our Services, your information is processed in the United States and in other locations where our service providers operate. Where the law requires it, we use appropriate safeguards for international transfers, including standard contractual clauses.

14. Children's Privacy

Our Services are not directed to children under 13 and we do not knowingly create accounts for them or collect their data. An adult may add information about a child to a space, for example when planning something for their family, so that Moji can provide the features they request. If you believe a child has created an account or given us information directly without appropriate permission, please contact us so we can address it.

15. Cookies, Analytics and Advertising Technologies

Our apps use cookies and local storage that are essential for core functionality, such as keeping you signed in.

Our marketing website uses analytics technologies and may use advertising technologies, including the Meta pixel, which allow us to measure how our advertising performs and to reach people who may be interested in Moji. These technologies receive information about your visit to that website, such as pages viewed and actions taken, and may be used for advertising across other services. They never receive the content of your connected accounts or anything inside your spaces.

If you visit our website from the European Economic Area, the United Kingdom or Switzerland, we ask for your consent before using analytics or advertising cookies and similar technologies. Until you choose, we use only the cookies and local storage the website needs to work. Our cookie banner lets you accept all, reject all, or choose analytics and advertising separately, and you can change your choice at any time with the "Cookie settings" link in our website footer. Your choice is saved in that browser for 12 months, after which we ask again. We also ask again if we change the technologies we use. Our website does not otherwise know where you are, so we decide whether to ask from the time zone your browser reports, and we ask if it does not report one.

Wherever you are, you can opt out of these technologies on our Do Not Sell or Share My Personal Information page. We also honor Global Privacy Control signals from your browser automatically. When you opt out, the website will not load advertising technologies or Google Analytics in that browser, even if you accepted them in the cookie banner. See Section 16.

16. California Residents' Privacy Rights (CCPA/CPRA)

If you are a resident of California, you may have rights under the California Consumer Privacy Act ("CCPA") as amended by the California Privacy Rights Act ("CPRA"). These rights apply to "personal information" as defined by California law.

Your rights

• Right to Know: request information about the categories of personal information we collect, the sources, the purposes for which we use it, and the categories of third parties with whom we share it.
• Right to Access: request a copy of the personal information we hold about you.
• Right to Deletion: request that we delete the personal information we have collected from you, subject to certain exceptions such as legal obligations or security.
• Right to Correct: request that we correct inaccurate personal information we hold about you.
• Right to Opt Out of Sale or Sharing: we do not sell your personal information. Our marketing website may use advertising technologies, including the Meta pixel, which may qualify as "sharing" for cross-context behavioral advertising under California law. You can opt out on our Do Not Sell or Share My Personal Information page, by sending a Global Privacy Control signal from your browser, which we honor automatically, or by emailing help@buildforever.com. We never share the content of your email, your connected accounts, or anything in your spaces.
• Right to Limit Use of Sensitive Personal Information: we do not use or disclose sensitive personal information for purposes beyond those permitted by law.
• Right to Non-Discrimination: we will not discriminate against you for exercising your privacy rights.

How to exercise these rights

Email us at help@buildforever.com with "CCPA Request" in the subject line. We may need to verify your identity before responding. You may designate an authorized agent to submit requests on your behalf, and we may require proof of authorization.

17. Changes to This Policy

We may revise this Policy from time to time. Updates will be posted with a new effective date. Where a change materially affects how we handle your data, we will tell you before it takes effect. If we change how we use Google user data, we will provide the notice and obtain the consent required by Google's policies before using it in the new way.

18. Contact Us

If you have questions, concerns, or requests about this Policy, please reach out:

Moji (BuildForever, Inc.)
Email: help@buildforever.com