Privacy Policy

Effective: January 23, 2026 | Updated: September 18, 2026

Protomansion, Inc. ("the Company") takes care to protect the personal information of people who use the services provided through the Moonlight Story application ("the App"). This policy explains what personal information we collect, why, how long we keep it, when it is shared with third parties, and what rights you have.

The support board stores request titles, messages, replies and status. Member requests are linked to an account; guest requests use a secret access code. Deleting a request deletes its conversation. Spam prevention uses a protected identifier derived from the IP address and request counts; quota records are cleaned up after seven days. Guest submissions and follow-up messages use Cloudflare Turnstile. Verification tokens and IP addresses are sent to Cloudflare to check for automated submissions.

1. Why we process personal information

We process personal information for the purposes below. It is not used for anything else, and if a purpose changes we will ask for your consent first.

• Creating and managing accounts, including social sign-in
• Providing AI diary analysis, dream interpretation and emotional insights
• Providing paid subscriptions and processing payment
• Improving the service, diagnosing errors and developing new features

2. What we collect, and how

We collect the minimum personal information needed to provide the service.

• We process account identifiers (email or social ID) and device details needed to operate the service. Birth date, birth time and MBTI are profile details supplied for selected features, not mandatory for every registration. Device details include the last reported operating system (Android/iOS) and the device’s country/region setting. This setting is not location tracking or verified residence.
• With social sign-in: the unique identifier, email address and profile name passed to us by the provider
• Server copies of diary and dream AI results are deleted after the device acknowledges receipt. Check-ins and saved responses stay on your device. Some results, including saju readings, and profile details are retained on our server to provide the service. Inputs needed for AI features are sent to our server and AI providers for processing.
• Payment: subscriptions are processed through the Apple App Store or Google Play. We never collect card numbers or other payment details ourselves. Only your subscription status and expiry are managed, through RevenueCat.

With calendar consent, times, importance and summaries of density and free time from allowed calendars are sent to our server and AI provider for Today. Title sharing is off by default and optional. A separate raw event list is not stored, but rhythm summaries and generated readings are stored on the server; shared titles may appear in readings. Disconnecting stops calendar input for future generation and does not retroactively delete saved readings.

Website store links count requests by campaign category, button position and platform. These counts do not log IP addresses, user agents, cookies, accounts or arbitrary URL values and do not identify people or installs. Counting logs are kept for up to 30 days. Ordinary web access logs for security are processed separately.

From version 1.3.1, voice input uses the device speech service, preferring on-device recognition where supported. Depending on the device and language, Apple or Google may process speech. The app does not save recordings or send them to Moonlight servers, Gemini, or Whisper. Text you review and add is handled like other diary or dream entries.

Optional. We collect account-linked Today screen openings, text displays, failures, app version and elapsed time. No writing, birth details or calendar content. Events are kept for up to 90 days plus an hourly cleanup interval. Stopping deletes these server records.

3. How long we keep it

As a rule we destroy personal information without delay once the purpose it was collected for has been met. Where the law requires us to keep records, we keep them for the period required.

• Act on Consumer Protection in Electronic Commerce: records of payment and supply of goods — 5 years
• Act on Consumer Protection in Electronic Commerce: records of consumer complaints and dispute resolution — 3 years
• Protection of Communications Secrets Act: access logs — 3 months

4. Sharing and processing on our behalf

As a rule we do not provide your personal information to anyone outside the Company. To run the service, we do entrust processing to the following.

• Google (Gemini): AI analysis provider. Its policies govern processing and retention of inputs and responses; immediate deletion of every provider-side copy after analysis is not guaranteed.
• OpenAI: AI analysis provider. Its policies govern processing and retention of inputs and responses; immediate deletion of every provider-side copy after analysis is not guaranteed.
• RevenueCat: managing subscription status
• Amazon Web Services: server and database hosting (Seoul region)

5. Transfer outside Korea

Inputs needed for AI analysis may be processed on Google or OpenAI servers outside your country, including the United States. Transfers use encrypted connections and provider-specific processing and retention terms apply.

6. Your rights and how to exercise them

You (or your legal representative) may exercise the following rights at any time.

• Request access to, correction of, or deletion of your personal information
• Request that processing be suspended
• Choose MY → Settings and account → Delete account.

You can make these requests from the settings menu in the app, or by writing to support@moondiary.app.

7. How we destroy personal information

Account deletion also removes records on this device. If cleanup fails, the app offers a retry. Manage exported files yourself and cancel store subscriptions separately.

8. Children under 14

We do not collect personal information from children under 14. If we find that a child under 14 has used the service, we destroy that child's personal information immediately and delete the account.

9. Data protection officer

• Company: Protomansion, Inc.
• Representative: Minjung Kang
• Address: 5F, Room J393, 105 Wausan-ro, Mapo-gu, Seoul, Republic of Korea
• Business registration number: 520-87-03889
• Email: support@moondiary.app

For reports or advice about privacy infringement, you may also contact the bodies below.

• Korea Internet & Security Agency, Privacy Infringement Report Centre (privacy.kisa.or.kr / 118)
• Personal Information Dispute Mediation Committee (www.kopico.go.kr / 1833-6972)

10. Changes to this policy

This policy may be revised as laws and our practices change. We will announce any change through a notice or pop-up in the app.