Privacy Policy

Moonlist ("we", "our", or "us") operates the Moonlist mobile application, website (https://moonlist.app), and agentic intent layer services. This Privacy Policy governs our data handling practices and explains how we handle information across all platforms.

We believe privacy is a fundamental human right. Our architecture minimizes personal data collection to only what is essential for portfolio synchronization, notification delivery, and user account management.

To provide portfolio tracking and multi-chain execution, we collect the following limited data types:

What We NEVER Collect:

• Private keys, recovery mnemonic seed phrases, or wallet passwords.
• Government identifiers, Social Security Numbers, or passport scans.
• Credit card numbers, bank routing numbers, or fiat account credentials.
• Biometric authentication data (FaceID/Fingerprint remains strictly isolated on your device operating system).

We process your data strictly for legitimate business and operational purposes:

• Service Operation: Syncing your portfolio watchlist, showing real-time token valuations, and updating Moon Points rewards.
• Notifications: Sending optional price alerts and security updates if enabled.
• Security & Anti-Fraud: Preventing abuse, bot spam, and verifying legitimate referral reward claims using Firebase App Check and reCAPTCHA Enterprise.
• App Performance: Monitoring latency and fixing application crashes.

No Commercial Sale of Data: We do NOT sell, rent, or monetize your personal data or public wallet queries to third-party data brokers or advertisers.

We retain personal information only as long as your account remains active. Upon requesting account deletion, all account identifiers, linked public wallet trackers, and point balances are permanently erased from active production databases immediately.

Aggregated, non-identifiable diagnostic metrics (such as crash telemetry logs in Firebase Crashlytics) are automatically purged on a 30-day to 90-day rolling cycle.

Our infrastructure relies on industry-standard cloud providers adhering to rigorous data security frameworks:

• Google Firebase (Alphabet Inc.): Manages user authentication, Firestore database, App Check security, and cloud hosting infrastructure. Privacy Shield / DPA compliant.
• CoinGecko & On-Chain DEX Proxies (OpenOcean, 0x): Supplies real-time cryptocurrency price feeds and DEX liquidity quote routing. Requests pass through our serverless proxy without broadcasting user identity.
• Blockchain RPC Providers (Alchemy, Infura, Solana Foundation): Processes public blockchain read calls for wallet token balances. Calls contain only public wallet addresses.

Moonlist employs end-to-end transport layer security (TLS 1.3 / HTTPS) for all network requests. Database records stored in Google Cloud / Firebase are encrypted at rest using AES-256 standard.

Firebase App Check with reCAPTCHA Enterprise safeguards API endpoints against automated bot attacks, relay attacks, and unauthorized payload modifications.

Regardless of your geographic location, Moonlist grants full control over your personal data:

In full compliance with Google Play’s Data Safety and Account Deletion policy, you can initiate account and data deletion at any time without requiring the mobile app to be installed.

Visit our dedicated Account Deletion Portal to execute instant 1-click self-serve deletion or submit a manual erasure request.

Moonlist services are not directed to or intended for individuals under the age of 18 (or 13 depending on jurisdiction). We do not knowingly collect personal data from children. If we become aware that a minor has submitted personal information, we will take immediate steps to delete such data.

Our cloud infrastructure is hosted in secure Google Cloud data centers located primarily in the United States and Europe. Standard Contractual Clauses (SCCs) approved by the European Commission are incorporated into our cloud processing agreements to guarantee safe cross-border data transfers.

We do NOT use invasive advertising tracking cookies or third-party ad networks. We use essential local storage key-value pairs (e.g. moonlist-theme) strictly for UI state persistence (such as dark theme preferences and local session tokens).