Moment Savvy

Privacy Policy

This Policy explains how Moment Savvy handles personal information when you use our mobile application, website, hosted content, PLUS waitlist, and support channels (the “Service”). We provide general wellness content and guided practices. We are not a healthcare provider or a service for storing medical records.

Acknowledging this Policy confirms that it was presented to you. It does not give blanket consent, waive your privacy rights, or replace any separate permission required by law.

1. Who is responsible

The proposed operator and data controller is Moment Savvy AB, Sweden. Our privacy, support, and security contact is support@momentsavvy.com.

Publication details to complete: confirm the registered company name, registration number, business address, and other legally required contact details. Confirm whether a UK representative or data protection officer is required and add their details if applicable. The mailbox must be working and monitored before publication.

2. Information and its sources

Accounts and sign-in

When you choose Continue with Apple or Continue with Google, those providers and Firebase Authentication supply or manage information needed to authenticate you. This includes email address (which may be an Apple private-relay address), display name where supplied, sign-in provider, Firebase account identifier, account-creation and sign-in records, and authentication/session information. Authentication infrastructure also processes IP address, user-agent, and related technical information for security and abuse prevention.

Moment Savvy does not receive your Apple or Google password. Our application database does not store provider identity tokens, access tokens, refresh tokens, or authorization codes. The providers, Firebase, and authentication SDKs still handle credentials needed to operate your session.

Profile and requested features

We store your chosen display name, saved favorites, Free/PLUS access status, onboarding and technical account state, and account-specific in-app-message dismissal history. We record timestamps for minimum-age self-attestation, Terms acceptance, and Privacy Policy acknowledgement. This information comes from your account actions and the app.

PLUS waitlist

If you join the optional waitlist, we store email address, account identifier, sign-in provider, the practice and wellness-area identifiers associated with the join, source, join/update timestamps, and notification preference. Joining is not a purchase and does not guarantee a launch, price, priority, or access.

The current app has no separate self-service leave-waitlist action. Successful account deletion removes the record. You may also contact us to request removal, subject to verification and applicable rights. We do not currently send PLUS or general marketing email. Such messages must not begin until the provider, required permissions, sender information, and a working email-only unsubscribe mechanism are in place.

Support, privacy, and security communications

When you contact us, we receive your email address, message, request type, correspondence history, and any troubleshooting information or country/region you provide. We may request limited information to verify account ownership or investigate a problem.

Do not send medical records, diagnoses, passwords, verification codes, tokens, payment information, or identity documents through ordinary email. If additional verification is necessary, we will explain what is needed and how to provide it securely.

Wellness interests and information we do not request

Practices you view, save, or express interest in may reveal wellness interests. Depending on context and applicable law, this can be sensitive information or consumer health data even though we do not request diagnoses. We do not use it to diagnose or treat you, assess insurance or employment eligibility, or create advertising profiles.

The current app does not request Apple Health/HealthKit information, medical records, precise GPS location, contacts, camera or microphone access, photos, payment-card information, or the advertising identifier (IDFA). Information voluntarily put in a display name or support message may nevertheless contain sensitive details; please avoid doing so.

3. App analytics and diagnostics

Google Analytics for Firebase

Analytics is enabled in the native iOS app. It records app launches and foreground activity, screen views, practices and areas viewed (including locked PLUS previews), active viewing time for accessible practices, favorite changes, successful waitlist joins, news and in-app-message interactions, content-refresh outcomes, and account-deletion outcomes. Events may include allowlisted content identifiers, source/outcome categories, timezone, UTC offset, local hour, and weekday. Firebase also collects app/device, operating-system, installation, session, and other technical information.

After sign-in, we send the exact Firebase account identifier through Analytics' designated User-ID field. This permits activity to be associated with the account and across signed-in devices. Signed-out events may remain linked to app-instance or installation identifiers. This is pseudonymous, user-linked information; excluding your name does not make it anonymous.

Our custom events exclude email address, display name, authentication tokens, free text, raw URLs, and practice instructions. We use analytics for product statistics and improvement, not advertising or tracking across other companies' apps and websites. The app's web/PWA version does not emit native app analytics events; the public website has separate analytics described below.

Firebase Crashlytics

Crashlytics is enabled in the native iOS app to investigate crashes and qualifying technical failures. Reports may include native/JavaScript stack information, sanitized error classifications and logs, device model, operating-system and app versions, application state, installation/session identifiers, and existing Analytics breadcrumbs containing allowlisted practice, area, news, or message identifiers.

After sign-in, the exact Firebase account identifier is set only in Crashlytics' designated User-ID field. Reports may therefore be account-linked. Our reporting layer is designed to exclude email addresses, display names, authentication secrets, free text, raw URLs, and the account identifier outside that field. Web/PWA builds do not use this native diagnostic reporting.

The current iOS app has no in-app switch to disable Analytics or Crashlytics. Signing out clears the account identifier for future events/reports, but does not stop installation-level collection or erase previously transmitted data. Account deletion does not automatically erase historical Analytics or Crashlytics records.

4. Website analytics, cookies, and hosting

The public website uses Google Analytics 4 to measure visits, general browser/device and regional information, referrals, named Reel landing-page visits, and App Store link clicks. It may use cookies and browser/device identifiers to distinguish visits and sessions. We do not send app account identifiers, account email addresses, display names, or in-app wellness activity to website analytics.

The website filters URL query parameters sent in the page address to allowed campaign labels. Google may also process technical request and referrer information when its script runs. Do not put personal or health information in URLs or campaign labels.

Current draft behavior: analytics loads automatically on momentsavvy.com. Proposed accept/reject controls are disabled, so no functioning site analytics choice is available. Clearing or blocking browser cookies may limit cookie storage but does not replace a working site choice. Review this behavior and implement any legally required prior choice before publication.

Firebase Hosting serves the website and app images. Page/file requests involve IP addresses, requested resources, request times, and related technical information used for delivery, security, and abuse prevention. Hosting requests are separate from analytics.

5. Information on your device

The app keeps downloaded content/images, cache and version information, first-launch state, access-verification timestamps, device-global message-dismissal state, and pending account-specific synchronization state. Authentication SDKs also maintain session information.

Some content caches and message-dismissal state are shared across accounts on an installation. Signing out does not clear all local data. Account deletion clears account-specific state through the deletion flow, but non-personal content caches and device-global dismissal state can remain until the app or operating system clears them or app data is removed.

6. Purposes and legal bases

Where EU/EEA or UK data-protection law applies, each purpose needs an appropriate legal basis. Our draft allocation is:

• Contract: authenticate and operate an account, provide requested content/favorites, maintain profile/access information, operate a requested waitlist feature, and carry out account operations, where objectively necessary for that feature.
• Legitimate interests: protect the Service, prevent abuse, keep necessary security records, and handle ordinary support enquiries, where these interests are not overridden by your rights. The interests are secure operation and responding to users' requests.
• Legal obligation: comply with applicable legal duties and required responses or records.
• Consent where required: optional marketing, non-essential cookies/device access, and sensitive-data processing requiring consent. Required permission must be obtained separately before processing.

Unresolved publication item: the lawful bases for current always-enabled iOS Analytics/Crashlytics and automatically loaded website analytics have not been established by this draft. Confirm the bases, cookie/device-access rules, any additional sensitive-data condition, and required opt-in/withdrawal controls before release. Terms acceptance and Privacy acknowledgement do not resolve this issue.

We may use information to establish, exercise, or defend legal claims where necessary and lawful. We do not make automated decisions with legal or similarly significant effects about you. Free/PLUS access reflects account access status, rather than a health assessment.

7. Required information and choices

An account needs information for authentication, profile operation, security, and requested features. Without this core information, we cannot create or operate an account. Favorites and waitlist participation are optional; remove favorites in the app or request waitlist removal.

Where processing relies on consent, you may withdraw it. Withdrawal does not affect earlier lawful processing or processing based on another valid legal basis. Contact us about applicable objections or withdrawal requests. The absence of an analytics switch does not remove legal rights.

We do not sell personal information or use it for targeted or cross-context behavioral advertising. We do not currently run a general marketing-email program. Any future program needs updated disclosures and required permissions/unsubscribe controls before sending.

8. Recipients and disclosures

Information is available to people and providers who need it for the described purposes, including:

• Google/Firebase: Authentication, Cloud Firestore storage, Remote Config configuration, Hosting, Analytics, and Crashlytics. Google Analytics has separate terms from other Firebase services. See Firebase privacy information and Google's Privacy Policy.
• Apple and Google sign-in: your chosen provider authenticates you and conducts independent processing under its own notice and terms.
• Authorized operator personnel and advisers: support, technical administration, security, privacy requests, and professional advice, with appropriate access/confidentiality restrictions.
• Email/support providers: services used to receive/reply to correspondence. Identify the actual mailbox provider and verify its processing before publication. No PLUS email delivery provider is selected in this draft.
• Legal/safety recipients: authorities or other parties where disclosure is legally required or lawfully necessary to address abuse, protect rights/safety, or establish/defend claims.
• Business-transfer recipients: potential/actual parties and advisers in a genuine reorganization, acquisition, financing, insolvency, or Service transfer, with appropriate protections and notice where required.

Independent linked sites have their own privacy practices. We remain responsible for duties that law places on us when using providers.

9. International processing

Providers may process information in the United States and other countries where they operate. Firebase Authentication operates from US data centers; other Firebase services may use global infrastructure or configured regions. Countries may have different privacy protections and government-access rules.

Google publishes data-processing terms, standard contractual clauses, and information about its EU-US Data Privacy Framework participation and UK extension. These are potential mechanisms; this draft does not confirm which applies to each Moment Savvy transfer.

Before publication: verify provider entities, configured locations, applicable adequacy decisions or contractual safeguards, and additional UK requirements. Replace this review note with the actual mechanisms and explain how to obtain information or copies of applicable safeguards from our privacy contact.

10. Retention

We retain information for its purpose, subject to legal duties, security needs, and provider deletion processes. The draft schedule is:

• Account/profile, favorites, access, and account message history: while the account operates; removal through successful deletion, subject to necessary legal/security records and provider processing.
• Waitlist: until deletion, verified removal, the waitlist ends, or information is no longer needed. Lack of a leave button does not justify indefinite retention.
• Support: proposed ordinary retention of 12 months after closure, longer only when necessary for security, a dispute, or a legal duty. Confirm this operational schedule before publication.
• Privacy/legal requests: for the period necessary to verify requests, demonstrate compliance, and resolve claims. Confirm the final operational schedule.
• Analytics: app setup specifies 14 months for event/user exploration data; verify actual app and website property settings. New activity may extend user-level retention. This setting does not remove standard aggregated reports on the same schedule.
• Crashlytics: Firebase states that crash traces and associated identifiers are retained for 90 days before removal from live/backup systems begins.
• Hosting/Authentication: Firebase states that Hosting IP data is retained for a few months and logged Authentication IP addresses for a few weeks. After account-deletion initiation, other Authentication information is removed from live/backup systems within 180 days under its published process.
• Device information: until cleared by the app, operating system, or removal of app data, depending on type.

Backup/deletion cycles and limited records needed for legal duties or claims may outlast active account removal. We do not promise immediate erasure from every provider system. Properly de-identified or aggregate information may be kept where lawful.

11. Account deletion

Open Settings → Delete account, confirm, and reauthenticate with Apple or Google. Successful deletion removes the Firebase Authentication account, profile, favorites, account-specific message history, waitlist record, and account-specific access/pending-sync state on that device. For Apple accounts, the app also attempts to revoke relevant authorization.

The flow does not automatically erase Analytics or Crashlytics information already sent to Google. Clearing the account identifier affects future collection. Contact us to exercise rights over historical information; provider retention is not a reason to disregard a legally required deletion request.

If deletion fails or you cannot sign in, contact support. We must verify ownership and may need to finish a partially completed request. Uninstalling alone does not delete the server-side account.

12. Rights and complaints

Depending on applicable law and exceptions, you may have rights to access/copy, correct, delete, restrict processing, receive portable information, object (including to relevant legitimate-interest processing), withdraw consent, appeal a refused request, or use an authorized agent. We will not unlawfully discriminate against you for exercising privacy rights.

Email with the subject “Privacy Request”, country/region, request type, and enough account information for verification. We will not ask for your Apple or Google password. We may request proportionate additional verification, explain applicable exceptions, and respond within legally required time limits.

EU/EEA and United Kingdom

You may complain to your supervisory authority: for Sweden, Integritetsskyddsmyndigheten (IMY); for the UK, the Information Commissioner's Office (ICO). You may contact us first, but need not do so before exercising the right to complain.

United States

Applicable state laws may provide access, correction, deletion, portability, appeal, and rights about sale, targeted advertising, or sensitive information. We do not sell information or use it for targeted advertising. Particular rights depend on the law and its applicability.

Publication review: assess whether wellness interests and related analytics constitute consumer health data, including under Washington and other applicable state laws. Implement any required distinct health-data notice, affirmative consent, separate sharing permission, or additional deletion process before offering affected processing. This Policy alone does not establish compliance.

Canada

Applicable laws may provide access, correction, withdrawal, and complaint rights. You may contact the Office of the Privacy Commissioner of Canada or a relevant provincial regulator. Review sensitive-information and meaningful-consent requirements. Canadian distribution, especially Québec, needs privacy and French-language review before the English-only drafts are treated as ready.

Australia

Where applicable Australian law provides access, correction, and complaint rights, contact us to investigate and respond. You may also contact the Office of the Australian Information Commissioner. This draft does not determine whether every provision of that regime applies to the operator.

13. Security

We use safeguards designed to protect information, including authentication, encrypted connections, restricted database access, data minimization, and sanitized diagnostics. Review access and provider arrangements as the Service changes.

No system guarantees complete security. We will investigate incidents and provide notifications required by law. Contact our security/support address about suspected unauthorized access; do not send credentials or disclose other users' information.

14. Age requirements

Accounts are for people aged 16 and older. If local law requires permission from a parent or legal guardian, you must obtain it before using Moment Savvy. The app records your self-attestation that you meet the minimum age; it does not verify your identity or date of birth. App Store content ratings do not verify age.

If you believe someone under 16 has created an account or provided personal information, contact us using the support contact above. We will investigate and take appropriate action, including restricting the account or deleting information where required, subject to legal preservation duties.

15. Changes and contact

We may update this Policy as the Service, providers, or law change. We will show the revised date and give required notice of material changes. New purposes need an appropriate basis and any required choice before processing; changing this page alone does not authorize them.

Privacy, support, and security: support@momentsavvy.com. See the Terms of Use and Support page.

This Privacy Policy may be updated at any time to reflect changes to the Service, our providers, or applicable law. Please review this page periodically. Updates will show a revised effective date. We will provide any legally required notice and obtain any required consent before new processing begins; an update does not waive your privacy rights.