Privacy Policy

This Privacy Policy explains what personal data we collect when you use moose, why, who else handles it, how long we keep it, and the rights you have over it. It sits alongside our Terms of Service and Acceptable Use Policy.

Who we are

moose is run by Andrei Onel, an individual based in Ireland ("we", "us"). We decide how and why the personal data described here is used, which makes us its controller under the General Data Protection Regulation (GDPR). We are not required to appoint a data protection officer. For anything about your data, email support@mooseos.com.

What this policy covers, and what it does not

It covers our website at mooseos.com, your moose account, billing, and the work we do to run your box.

It does not cover what is on your box. The files, data and accounts you and the people you let in keep on your box, and whatever the apps on it collect, are yours. For that data you are the controller, and we act only on your behalf to run your box: we store it, back it up and restore it when you ask. We do not look at it except as our Terms of Service describe. If you run apps on your box for other people, such as your customers, it is up to you to tell them how their data is used. If your business needs a data processing agreement with us, email support@mooseos.com.

What we collect and why

For each purpose below we say what we collect, the legal basis the GDPR gives us for it, and how long we keep it.

Your account.

• What: your email address, the first name you give us if you give one, the date you created your account, and the version of these documents you agreed to and when.
• Why: to create your account, let you sign in, and reach you about your account and your box. The basis is our contract with you.
• How long: until your account is deleted.

Signing in and keeping your account safe.

• What: the one-time codes we email you, which expire after 10 minutes; the passkeys you add, of which we keep only the public part; and for each signed-in browser, its IP address and a short description such as "Firefox on Linux", so you can see and end your sessions. We also keep a security log of sign-ins and important account and box actions, with the IP address they came from.
• Why: to sign you in and to detect and investigate misuse of your account. The basis is our legitimate interest in keeping accounts and the service secure.
• How long: a session lasts 30 days unless you sign out first. Security log entries are deleted after 12 months.

Payments.

• What: payments are handled by Stripe. You enter your card details on Stripe's own page, and we never see them. We keep the identifiers Stripe gives us for you and your subscription, and we can see in Stripe the details you gave it, such as your name, billing address and invoices.
• Why: to charge for your box and keep the records the law requires. The basis is our contract with you and our legal obligation to keep accounting records.
• How long: billing records are kept for 6 years after the year they relate to, as Irish tax law requires, even after your account is deleted.

Running your box.

• What: your box's name, its IP address, its size, its state, its subscription status and the dates of any failed payment and the warnings we sent about it. When you open your box from your account, we pass your email address and first name to it, so it can set up your account on your box.
• Why: to create, run, update, back up and delete your box. The basis is our contract with you.
• How long: for as long as your box exists. When a box is deleted, for any reason, its last backup is kept for 30 days and then deleted for good, as our Terms of Service describe.

Emails we send you.

• What: your email address and the content of the email: sign-in codes, security notices, billing notices and news about the service that affects you. We do not track whether you open our emails or click their links. If an email to you bounces, or you mark one as spam, we note the address so we stop sending to it.
• Why: to run your account and your box. The basis is our contract with you. We do not send marketing emails.
• How long: our email providers keep a copy of each email for a limited time, and keep your email address until your account is deleted. We keep a note of an address that bounced for as long as we might otherwise send to it.

Support and abuse reports.

• What: what you write to us and your email address. If you report abuse to abuse@mooseos.com, your name, email address and the report itself.
• Why: to answer you, and to handle abuse under our Acceptable Use Policy. The basis is our contract with you, or our legitimate interest in answering you and keeping the service lawful and safe.
• How long: 3 years from our last exchange, or longer if a legal claim needs it.

Visiting our website.

• What: our servers see the IP address and browser details every website receives, to deliver the page. We do not use analytics, advertising or tracking tools. Our pages load nothing from other companies' servers, with two exceptions. The app icons and screenshots in our app store are kept in Google Cloud's storage, so your browser loads them from Google's servers (storage.googleapis.com); Google handles those requests for us, as part of the Google Cloud service listed below. And our sign-up page loads a check from Cloudflare (challenges.cloudflare.com) that tells people apart from automated programs, for which Cloudflare sees your IP address and browser details.
• Why: to deliver the website and protect it from attacks. The basis is our legitimate interest in running the website securely.

We do not sell your personal data, we do not use it for advertising, and we do not make decisions about you by purely automated means.

Who else handles your data

We use a small number of companies to run moose. Each handles personal data only to provide its service to us, under a contract that requires it to protect that data.

• Hetzner (Germany) runs the servers your box lives on and stores its backups.
• Google Cloud (Belgium) runs our website and control systems, the database that holds your account, its backups, our DNS, and the app icons and screenshots shown in our app store.
• Stripe (Ireland and the United States) handles payments. Stripe also uses some payment data for its own purposes, such as fraud prevention, under its own privacy policy.
• Postmark (United States), Resend (United States) and Plunk (European Union) deliver the emails we send you.
• Cloudflare (United States) protects our sign-up page from automated programs.
• Fastmail (Australia) handles email you send to our support and abuse addresses.

We share personal data with anyone else only if the law requires it, for example a valid court order, or if it is necessary to protect someone's safety. If a company takes over running moose, as our Terms of Service allow, your data moves to it under this policy.

Your box's name is public by design. It is part of your box's address in the public DNS, and the certificate that secures your box is listed in public certificate transparency logs, as every trusted certificate is. Choose a name you are happy for anyone to see.

Transfers outside the European Union

Your box and your account are stored in the European Union. Stripe, Postmark, Resend, Cloudflare and Fastmail may process data in the United States, Australia or other countries outside the EU. Where they do, the transfer is protected by the European Commission's standard contractual clauses or, for companies certified under it, the EU-U.S. Data Privacy Framework. You can ask us for a copy of the safeguards that apply.

How long we keep it

Each section above says how long we keep that data. In short:

• Your account: until it is deleted.
• Billing records: 6 years, as tax law requires.
• Security log: 12 months.
• Sign-in sessions: 30 days, or until you sign out.
• A deleted box's last backup: 30 days.
• Support emails and abuse reports: 3 years.
• Copies of emails we sent: for a limited time, at our email providers.

We back up our own database every day and keep each backup for 30 days. Data we delete can therefore stay in those backups for up to 30 more days before it is gone completely. We never restore it from them except to recover from a failure.

Security

Everything between your browser and us is encrypted. You sign in with an emailed code or a passkey, so we hold no password that could leak. The most sensitive credentials we store are encrypted, and only we can reach our systems. If a breach puts your data at risk, we will tell the Data Protection Commission within 72 hours where the law requires it, and tell you without undue delay.

Your rights

Under the GDPR you have the right to:

• get a copy of the personal data we hold about you;
• have it corrected if it is wrong;
• have it deleted;
• have us restrict how we use it;
• receive the data you gave us in a common machine-readable format;
• object to our using it where we rely on our legitimate interests.

To use any of them, email support@mooseos.com from the address on your account. We answer within one month. Your email address cannot be changed from your account at the moment, so ask us if it needs correcting.

Deleting your account. Email us and we delete your account within 30 days. This deletes your box too, so take anything you want to keep first. Your box's last backup is then kept for 30 days as with any deleted box, billing records are kept for as long as tax law requires, and entries in the security log are deleted on their normal 12-month schedule.

If you are unhappy with how we handle your data, please tell us first. You also have the right to complain to the Irish Data Protection Commission (dataprotection.ie), or to the data protection authority where you live or work.

Cookies

We set two cookies, both needed for the service to work, so we do not ask for consent to them:

• moose_portal_session keeps you signed in. It lasts until you sign out or for 30 days.
• moose_known_device remembers that this browser has signed in to your account before, so we can recognise a sign-in from somewhere new. It holds a random identifier for the browser and a code for each account that has signed in on it, which only we can check. It contains nothing else about you and lasts 400 days.

We use no analytics, advertising or tracking cookies. When you pay, Stripe's payment page may set its own cookies for security and fraud prevention, under its own policy.

Children

moose is for people aged 18 or over, and we do not knowingly collect data from anyone younger. If you believe a child has given us personal data, tell us and we will delete it.

Changes to this policy

We may update this policy. We will email you at least 30 days before a change that matters takes effect, and update the date at the top of this page.

Contact

Andrei Onel
Email: support@mooseos.com