Privacy Policy

Last updated: July 21, 2026

1. Who We Are (Data Controller)

Moraine is operated by “Hypeform” Ltd(„Хайпформ” ЕООД), a company registered in Bulgaria under UIC/EIK 206467190, with registered seat at Mladost 4, bl. 480, entr. 1, fl. 1, apt. 3, 1715 Sofia, Bulgaria (the “controller” under the EU General Data Protection Regulation).

For anything related to your personal data, contact us at support@usemoraine.com.

2. Information We Collect

Account information — name, email address, and profile picture, received from your sign-in provider (Google or Apple) via our authentication service.
Health and journal data you enter — meals, exercise, sleep, hydration, weight, goals, medical conditions, medications, uploaded documents (e.g. lab results), and what you write to the AI coach.
Health data you choose to import — if you connect Apple Health (HealthKit) or Health Connect on Android, we import sleep, steps, workouts, heart-rate metrics, blood oxygen, respiratory rate, hydration and weight, depending on platform and the permissions you grant. See section 4.
Usage data — per-day counts of app activity and AI usage (for cost control, abuse prevention, and product improvement), and technical error events. We do not use third-party analytics or advertising trackers.

3. How We Use Your Information & Legal Bases

To provide the service — storing your journal, generating your dashboard, trends and weekly recaps (legal basis: performance of our contract with you).
To power the AI coach — your messages and relevant journal context are processed by an AI model to produce responses, extractions, and summaries (legal basis for health data: your explicit consent, Art. 9(2)(a) GDPR, given when you use these features; you can stop at any time).
To keep the service safe and affordable — rate limiting, abuse prevention, and aggregated cost telemetry (legal basis: our legitimate interests).
To respond to you — support requests and technical notices (legal basis: contract / legitimate interests).

We never use your data for advertising, and we never sell it. Health data imported from Apple Health or Health Connect is never used for advertising or marketing of any kind and is never shared with third parties beyond the processors listed in section 5.

4. Apple Health & Health Connect Imports

Importing is off by default — it starts only when you explicitly connect it in Account settings and grant the platform permission prompts.
Imported data is stored in your journal alongside what you log yourself, marked with its source. Anything you enter or edit yourself always takes precedence — imports never overwrite your own entries, and data you delete stays deleted.
We only read from Apple Health / Health Connect. We never write to them.
You can disconnect at any time in Account settings (stops all future imports; already-imported entries remain editable and deletable like any journal data), and revoke access in your device’s system settings.
Imported health data is used solely to provide Moraine’s features to you — never for advertising, marketing, or sale, and never disclosed to data brokers.

5. Processors We Use

Your data is processed by the following service providers (processors), each bound by data-processing agreements and limited to what the service needs:

Convex — application database and file storage (your journal, health data, and uploaded documents live here, encrypted in transit and at rest).
Clerk — authentication (your sign-in identity: email, name, profile picture).
Google (Gemini API) — AI processing. Your chat messages and relevant health/journal context are transmitted to Google to generate the coach’s responses and structured extractions. We use the paid API tier, under terms which do not permit Google to use this data to train its models.
Vercel — web hosting and content delivery.
Cloudflare — DNS and email routing for our support address.

6. International Transfers

Some of the processors above are based in the United States. Where personal data leaves the EU/EEA, the transfer is protected by an adequacy mechanism — the EU–US Data Privacy Framework where the provider is certified, and/or the European Commission’s Standard Contractual Clauses.

7. Data Retention

Journal, health, goals, and medical data — kept until you delete it (individual entries in-app, or everything via account deletion).
Chat conversation — a rolling 7-day window; older messages are deleted automatically (everything you logged stays in your journal).
Chat routing metadata (no message content by default) — 30 days.
Usage/cost rollups and weekly recap summaries — for the life of your account.
Account deletion — deletes all of the above, including uploaded files, immediately and permanently. Residual copies in encrypted backups expire within 30 days.

8. Your Rights

Under the GDPR you have the right to:

Access and export your data — self-serve in Account → Data & privacy (JSON export).
Correct inaccurate data — edit any entry in-app.
Erase your data — delete entries in-app, or delete your entire account self-serve.
Data portability, restriction of processing, and objection.
Withdraw consent at any time (e.g. disconnect health imports, stop using AI features) — without affecting prior processing.
Lodge a complaint with a supervisory authority — in Bulgaria, the Commission for Personal Data Protection (CPDP, cpdp.bg), or your local EU authority.

9. Security

Data is encrypted in transit and at rest; access is authenticated and scoped to your account server-side; AI API keys never leave our servers. Moraine is not a HIPAA-covered entity, but we treat your health data with the sensitivity it deserves — it is the core of the product, not a by-product.

10. Children’s Privacy

Moraine is not intended for children under 16, and we do not knowingly collect their data. If we learn that we have, we will delete it immediately.

11. Changes to This Policy

We will post any changes on this page and update the date above; for material changes we will notify you in the app. Your continued use after changes take effect constitutes acceptance.

12. Contact

Questions about this policy or your data: support@usemoraine.com — or by post to the controller address in section 1.

By using Moraine, you acknowledge that you have read and understood this Privacy Policy.

1. Who We Are (Data Controller)

For anything related to your personal data, contact us at support@usemoraine.com.

2. Information We Collect

Account information — name, email address, and profile picture, received from your sign-in provider (Google or Apple) via our authentication service.

Health and journal data you enter — meals, exercise, sleep, hydration, weight, goals, medical conditions, medications, uploaded documents (e.g. lab results), and what you write to the AI coach.

Health data you choose to import — if you connect Apple Health (HealthKit) or Health Connect on Android, we import sleep, steps, workouts, heart-rate metrics, blood oxygen, respiratory rate, hydration and weight, depending on platform and the permissions you grant. See section 4.

Usage data — per-day counts of app activity and AI usage (for cost control, abuse prevention, and product improvement), and technical error events. We do not use third-party analytics or advertising trackers.

3. How We Use Your Information & Legal Bases

To provide the service — storing your journal, generating your dashboard, trends and weekly recaps (legal basis: performance of our contract with you).

To power the AI coach — your messages and relevant journal context are processed by an AI model to produce responses, extractions, and summaries (legal basis for health data: your explicit consent, Art. 9(2)(a) GDPR, given when you use these features; you can stop at any time).

To keep the service safe and affordable — rate limiting, abuse prevention, and aggregated cost telemetry (legal basis: our legitimate interests).

To respond to you — support requests and technical notices (legal basis: contract / legitimate interests).

4. Apple Health & Health Connect Imports

Importing is off by default — it starts only when you explicitly connect it in Account settings and grant the platform permission prompts.

Imported data is stored in your journal alongside what you log yourself, marked with its source. Anything you enter or edit yourself always takes precedence — imports never overwrite your own entries, and data you delete stays deleted.

We only read from Apple Health / Health Connect. We never write to them.

You can disconnect at any time in Account settings (stops all future imports; already-imported entries remain editable and deletable like any journal data), and revoke access in your device’s system settings.

Imported health data is used solely to provide Moraine’s features to you — never for advertising, marketing, or sale, and never disclosed to data brokers.

5. Processors We Use

Your data is processed by the following service providers (processors), each bound by data-processing agreements and limited to what the service needs:

Convex — application database and file storage (your journal, health data, and uploaded documents live here, encrypted in transit and at rest).

Clerk — authentication (your sign-in identity: email, name, profile picture).

Google (Gemini API) — AI processing. Your chat messages and relevant health/journal context are transmitted to Google to generate the coach’s responses and structured extractions. We use the paid API tier, under terms which do not permit Google to use this data to train its models.

Vercel — web hosting and content delivery.

Cloudflare — DNS and email routing for our support address.

7. Data Retention

Journal, health, goals, and medical data — kept until you delete it (individual entries in-app, or everything via account deletion).

Chat conversation — a rolling 7-day window; older messages are deleted automatically (everything you logged stays in your journal).

Chat routing metadata (no message content by default) — 30 days.

Usage/cost rollups and weekly recap summaries — for the life of your account.

Account deletion — deletes all of the above, including uploaded files, immediately and permanently. Residual copies in encrypted backups expire within 30 days.

8. Your Rights

Under the GDPR you have the right to:

Access and export your data — self-serve in Account → Data & privacy (JSON export).

Correct inaccurate data — edit any entry in-app.

Erase your data — delete entries in-app, or delete your entire account self-serve.

Data portability, restriction of processing, and objection.

Withdraw consent at any time (e.g. disconnect health imports, stop using AI features) — without affecting prior processing.

Lodge a complaint with a supervisory authority — in Bulgaria, the Commission for Personal Data Protection (CPDP, cpdp.bg), or your local EU authority.