Privacy Policy

Effective date: October 11, 2026

This privacy policy describes how MoonPal (the "App"), provided by Marcana B.V. (the "Developer"), collects, uses, and shares information when you use the App. If you have a question about it, email contact@marcana.app.

1. What information do we collect?

No account needed

The App does not ask you to create an account or sign in. There is no email address, password, or phone number linked to your use of the App.

Your profile answers

When you first open the App, it asks for a few details so that your guidance fits you: your name, your pronouns, your birthday, your occupation, your relationship status, how much you know about the moon, and your goals. The App saves these answers on your device. Your name never leaves your device: the App only shows it on your screen.

AI guidance and analysis

The daily guidance and the birth moon analysis are written by an AI service. Before the first one, the App asks for your permission to send your profile answers to that service. Nothing goes to the AI service until you allow it.

When you open new daily guidance, the App sends your pronouns, your occupation, your relationship status, your sun sign and whether today is your birthday (both worked out on your device, so the date itself is not sent), the day and time, and the moon data for the day to the Developer's server. A birth moon analysis also sends your birth date, your birth time if you know it, and the name of your birth place. The server runs on Google Cloud (Cloud Functions for Firebase). It passes the request to OpenAI, whose AI writes the text, and returns it to the App. The server does not save your answers.

OpenAI does not use data sent through its API to train its models by default. It stores each request and the text it writes for at least 30 days, and keeps abuse monitoring logs for up to 30 days, unless the law requires it to keep them longer. Your guidance and your birth moon analysis are saved only on your device.

If you change your mind after allowing it, you can delete the App. When you install it again, it asks again before it sends your profile.

Your location

The App asks for your location and uses it at about 1 kilometer accuracy to calculate the moon's phase and position for your sky. The location is saved on your device and is never sent to the Developer. To find your time zone, the App sends this approximate location to Apple's geocoding service. When you look up your birth place, the App uses Apple Maps search, so Apple receives the text you type.

Reminders

The daily reminder and the new moon and full moon reminders are scheduled on your device. The App does not send your notification settings to the Developer.

Support emails

If you contact support by email, the Developer receives the information you choose to share, such as your name and email address. The support email the App prepares for you puts the app version, your subscription user ID (a random identifier RevenueCat creates for your installation, see below), and your region in its subject line, so that the Developer can help you faster.

Payment data

Purchases and subscriptions are processed through Apple's App Store. Payment details are handled and stored by Apple, not by the Developer. The Developer uses RevenueCat, a subscription management service, to check your subscription status. RevenueCat receives your purchase records (product, price, currency, and dates), your device's vendor identifier, your IP address, the subscription user ID it creates for you, and the identifier Firebase Analytics gives your installation, so that the two records can be matched. It does not receive your payment details.

Information automatically collected

The App uses analytics services (Amplitude and Google Firebase Analytics) to understand how the App is used and to improve it. These services automatically collect usage and diagnostic information such as device model, operating system version, language, app version, in-app events (for example, which screens you open, whether your guidance was created, or that a subscription was bought), session information, whether you are a subscriber or on a free trial, and approximate region derived from IP address.

The App also uses Google Firebase Remote Config, which lets the Developer change some settings of the App without an update.

Tracking and ad measurement

The Developer advertises the App with Google Ads. To learn which ads bring people to the App, Google uses two of the events Firebase Analytics records: the first time you open the App, and each subscription you buy, with its product, price, and currency.

When you first open the App, iOS asks whether the App may track your activity across other companies' apps and websites. If you allow it, Firebase Analytics and RevenueCat collect your device's advertising identifier (IDFA). Google can then match your first open and your purchases to the Developer's ads you saw or tapped, for example on Google Search, YouTube, or in other apps. If you decline, the App does not collect the advertising identifier, and Google receives the first open and purchase events without it. Section 8 explains how to change your answer later.

The Developer may also advertise on the App Store with Apple Ads. The App asks Apple for an attribution token and sends it to RevenueCat together with your subscription records. RevenueCat passes the token to Apple, which answers whether you installed the App after tapping or seeing one of these ads, and from which campaign. The App does not need your tracking permission to send it.

2. How do we use your information?

Section 3 lists the legal bases for this processing.

• Providing the App. Your profile answers are used to write your guidance and your birth moon analysis, and your location to show the moon for your sky.
• Customer support. Emails you send are used to answer you and fix problems.
• Analytics and improvement. Usage data helps the Developer understand which features people use, decide what to build next, and fix problems.
• Order fulfillment. Purchase information is used to unlock premium features and manage subscriptions.
• Ad measurement. First opens, subscription purchases, and Apple Ads attribution show the Developer which of its ads work, as described in section 1.

The App does not show ads and does not send marketing emails. It tracks you across other companies' apps and websites only if you allow it, and the Developer uses that tracking to measure its own ads and for nothing else.

3. Will your information be shared with anyone?

The Developer shares information only with service providers needed to operate and advertise the App, for legal compliance, rights protection, or business obligations.

Service providers. The following third parties process data on the Developer's behalf:

• OpenAI writes your daily guidance and your birth moon analysis.
• Google runs the Developer's server (Google Cloud and Firebase), provides analytics and remote settings through Firebase, and measures the Developer's Google Ads campaigns.
• Apple processes payments and subscriptions, provides Apple Ads attribution, looks up your time zone from your approximate location, and runs the Apple Maps search for your birth place.
• RevenueCat manages subscription status.
• Amplitude provides usage analytics.

Most of these providers process data in the United States.

Legal bases for processing:

• User consent for specific purposes, such as sending your profile answers to the AI service
• Legitimate business interests
• Contract performance
• Legal obligations and law enforcement compliance
• Vital interests involving safety or illegal activity investigation

Business transfers. Information may be shared during mergers, asset sales, financing, or business acquisitions.

Personal data sales. The Developer does not sell personal information to third parties.

4. How long do we keep your information?

Section 1 says how long OpenAI keeps the data sent for your guidance. Other information is retained only as long as necessary for the purposes described in this policy or as required by law. When no legitimate business need exists, information is deleted, anonymized, or securely isolated from further processing.

5. How do we keep your information safe?

The Developer implements technical and organizational security measures to protect information. However, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, and you use the App at your own risk.

6. What are your privacy rights?

Regional rights

If you live in the European Economic Area or the United Kingdom, you have rights that include accessing, correcting and erasing your personal information, restricting its processing, and receiving it in a portable format. You may withdraw your consent at any time, and you may complain to your data protection supervisory authority.

If you live in Switzerland, you can contact the Federal Data Protection and Information Commissioner.

Exercising your rights

The App does not use accounts, so there is no account to manage or delete. To request access to or deletion of the analytics and subscription data associated with your device, email contact@marcana.app. If you send the email from the Profile tab of the App, it includes your subscription user ID, which helps the Developer find your data. Requests are handled within 30 days, though legal requirements may necessitate retention of some records.

Children

The App is not meant for children under 13. If you believe a child under 13 has used the App, email contact@marcana.app and the Developer will delete the data it can link to that child.

7. What is our stance on third-party websites?

The App links to other websites, such as Apple's page on cancelling a subscription. The Developer is not responsible for the safety or privacy practices of these websites. Check each website's own privacy policy.

8. Controls for do-not-track features

The App asks for permission to track through Apple's App Tracking Transparency prompt, and it collects the advertising identifier only if you allow it (see section 1). You can change your answer at any time in the iOS Settings app under Privacy & Security, then Tracking.

9. Do California residents have specific privacy rights?

Shine the Light law

If you live in California, you may ask once a year which categories of personal information the Developer disclosed to third parties for their direct marketing, and the names and addresses of those third parties. The Developer does not disclose personal information to third parties for their direct marketing purposes.

CCPA privacy notice

Resident definition. California residents are people who are in California for other than a temporary or transitory purpose, and people domiciled in California who are outside the state for a temporary or transitory purpose.

Collected personal information categories:

• Identifiers (device and app instance identifiers, the subscription user ID, IP address, and the advertising identifier if you allow tracking)
• Commercial information (subscription purchases)
• The profile answers sent to the AI service (pronouns, occupation, relationship status, and birth details)
• Usage data
• Diagnostics data
• Approximate location derived from IP address

Data usage and sharing. Sections 1 to 3 describe what the App collects, why, and who receives it.

Service provider disclosures. The Developer may disclose information to service providers through written contracts for processing on behalf of the business.

Personal data sales. The Developer does not sell personal information for money. The App sends your first open and your subscription purchases to Google, which uses them to measure the Developer's ads (section 1). If you allow tracking, the App also shares your advertising identifier with Google, so it can link these events to the ads you saw or tapped. California law may treat this as sharing personal information. Turning tracking off in the iOS Settings app (section 8) stops the advertising identifier from being shared. The first open and purchase events are still sent, without it.

Consumer rights

• Right to deletion. You may ask the Developer to delete your personal information, subject to legal exceptions.
• Right to know. You may ask which categories of personal information the Developer collects and how, for which purposes it uses them, and with which third parties it shares them.
• Right to non-discrimination. The Developer will not treat you differently for using your privacy rights.
• Verification process. Before acting on a request, the Developer checks that it comes from you, using information or a contact method you used before. It may ask for more information for security reasons.

10. Do we make updates to this notice?

The privacy notice may be updated periodically to maintain legal compliance. Material changes are communicated through prominent notices or direct notification.

11. How can you contact us about this notice?

Email: contact@marcana.app

12. How can you review, update, or delete the data we collect from you?

You can change your profile answers in the Profile tab of the App at any time. Deleting the App deletes everything it saved on your device. You may request access, modification, or deletion of other information by emailing contact@marcana.app.