1. Who we are
Moonstreak is operated by Mánahöll ehf., a private limited company registered in Kópavogur, Iceland. For anything in this policy, Mánahöll ehf. is the data controller. You can reach us at privacy@moonstreak.app.
2. What we collect
Account data: your name and email address. You sign in with Google, GitHub, or an email magic link — Moonstreak never sets or stores a password.
Product data: time entries, projects, clients, tags, notes, invoices, and the gamification state they produce (XP, streaks, quest progress).
Billing data: if you subscribe, our payment processor handles your card. We only store the subscription status and invoice history — never card numbers.
Technical data: basic server logs (IP, browser, timestamps) kept for 30 days for security and debugging.
3. What we deliberately don't collect
No advertising identifiers, no cross-site trackers, and no marketing cookies — the marketing site you're reading now sets none. The only analytics and masked session-replay diagnostics we run are optional and load solely if you accept them in the cookie banner. We are a one-person company, not an ad network.
4. How we use your data
To run the product: syncing entries, computing XP and streaks, generating invoices and reports you ask for.
To communicate: transactional email (receipts, streak-warning notifications you opt into) and, if you choose, a weekly recap.
Legal bases under GDPR: performance of contract (running Moonstreak for you), legitimate interest (keeping it secure), and consent (optional emails — every one has an unsubscribe link).
6. Retention & deletion
Your data stays as long as your account does. Delete your account and everything is erased from production within 30 days, and from encrypted backups within 30 days after that. You can export a full copy (JSON + CSV) from Settings first — no email to support required.
7. Your rights
Access, rectification, erasure, portability, restriction, and objection — the full GDPR set. Exercise most of them directly in the app; for the rest, email privacy@moonstreak.app and a human (there is exactly one) answers within a few days. You may also complain to the Icelandic Data Protection Authority (Persónuvernd).
8. Changes to this policy
If this policy changes in any meaningful way, we'll email account holders and post the change in the blog changelog before it takes effect. No silent edits.
Questions about any of this? Email hello@moonstreak.app — you'll get Ásgeir, because there is no one else to get.