Privacy Policy
Last updated: November 15, 2026
The short version
- We collect what Mochi needs to work: your account, your tasks and notes, your settings, and your purchase status.
- We do not sell your data. There are no ads and no ad tracking in Mochi.
- The tasks and notes you share go to the one partner you linked with, and nobody else.
- Two optional features send text you typed to an outside AI service. They are described below.
- You can delete your account, and everything in it, from inside the app at any time.
1. Who we are
Mochi is a todo app for iPhone, run by [company legal name] ("we", "us"). We are the controller of the personal data described here. This policy covers the Mochi app and this website.
To reach us about privacy: [support email], or by post at [company postal address].
2. What we collect
Things you give us
| What | Details |
|---|---|
| Account | If you sign up with email: your email address and a password (stored only in scrambled form). If you use Sign in with Apple: the account identifier Apple gives us and the email Apple shares, which can be a private relay address if you chose "Hide My Email". A guest account has no email at all, only a random ID. |
| Your tasks | The text of your todos, the days they are on, whether they repeat, and whether they are done. This includes tasks in your Backlog. |
| Things you share with your partner | Shared tasks, love notes, and task suggestions you send to or get from your linked partner. |
| Your partner link | The link code you made or used, who you are linked with, and when. We keep a log of link and unlink events for safety. |
| Settings and progress | Your chosen pal and skin, your in-app choices (for example moving unfinished tasks, reminders, auto-distribute), your hearts, your Mochi Bucks balance, and the skins you own. |
| Codes and invites | Skin unlock codes you redeem, your "refer a friend" code, which account invited which, and free skins claimed. We also count wrong code guesses to stop abuse. |
| Access requests | If you ask for access on our website, the email address you type in. |
| Messages to us | Anything you send when you email support or report content. |
Things we get automatically
- Purchase status. If you subscribe to Mochi Pro, Apple tells us that your subscription is active, when it ends, and the transaction IDs. We never see your card or payment details. Apple handles the payment.
- Technical data. When the app talks to our servers, the companies that host them log basic connection data such as your IP address, the time, and your app and device version. We use this to keep the service running and safe.
- AI use counts. We count how many AI requests each account makes so we can limit overuse. We do not keep the text.
Things that stay on your phone
Task reminders are scheduled on your device, not sent from our servers. Downloaded skin art, which notes you have opened, and similar small settings are also kept on your device. Deleting the app removes them.
Things we do not collect
Mochi does not ask for or collect your location, contacts, photos, camera, microphone, or health data. It has no advertising and no analytics or tracking tools from other companies, and it does not track you across other apps or websites. If you chose to share analytics with app developers in your iPhone settings, Apple may show us crash and usage totals that do not identify you.
3. How we use it
- To run the app: save your tasks, keep them in sync across your devices, and bring them back if you reinstall.
- To share with your partner the tasks, notes and suggestions you chose to share.
- To give you what you bought or earned: Mochi Pro, skins, Mochi Bucks, codes and referral rewards.
- To keep the service safe: stop abuse, limit guessing of codes, and act on reports.
- To answer you when you contact us.
- To meet legal duties.
We do not use your tasks or notes to show you ads, and we do not use them to train AI models.
4. AI features
Two features send text to an outside AI service. Both are optional.
- Improve Love Note. When you tap Improve, the note text you typed is sent to OpenRouter, an AI service, which passes it to an AI model (Meta's Llama) to suggest a nicer version. Before the first use, the app asks for your consent. The text is also checked by an AI safety filter, on the way in and on the way out, to block harmful content.
- Auto-distribute. When you use auto-distribute, the text of the tasks in your Backlog is sent to the same service so it can judge how big each task is and spread them across your week.
Only the text is sent. We do not send your name, email or account ID with it. The request goes through our own server, so the AI service does not get your IP address from us. We do not store the text or the AI's reply on our servers. OpenRouter and the model hosts it uses handle the text under their own privacy terms. Do not put sensitive information, such as health or financial details, into text you send to these features.
To stop: do not use Improve, and turn auto-distribute off in the app.
5. Who we share it with
Your partner. When you link with a partner, they can see the tasks you share with them, the love notes and suggestions you send them, and your display name if one is set. Either of you can unlink at any time. Blocking a partner unlinks you.
Companies that run the service for us. They may only use your data to provide their service to us, and they must protect it at least as well as this policy does.
| Company | What it does for us | What it handles |
|---|---|---|
| Supabase | Database, sign-in, and server code. Hosted in the United States. | Everything in section 2 that is stored on our servers. |
| Bunny.net | Delivers skin art and animations to your phone. | Your IP address and which files were requested. |
| OpenRouter (and the AI model hosts it uses) | The optional AI features in section 4. | The text you send to those features. |
| Apple | Sign in with Apple, App Store payments and subscriptions. | What Apple needs for those, under Apple's own privacy policy. |
When the law requires it. We may share data if we must to follow the law, a court order, or to protect someone's safety or our rights.
If the business changes hands. If Mochi is sold or merged, your data may move to the new owner, who must keep following this policy or tell you before changing it.
We do not sell your personal data, and we do not share it for advertising.
6. Where your data is kept
Our servers are in the United States. If you use Mochi from another country, your data is moved to and stored in the United States, where privacy laws may differ from yours. Where the law requires it, we rely on approved safeguards such as standard contractual clauses with our service providers.
7. How long we keep it
- We keep your account data for as long as you have an account.
- When you delete a task, it disappears from your devices. Our servers keep a record marked as deleted, so the deletion can reach your other devices, until you delete your account.
- When you delete your account, we delete your account, tasks, Backlog, shared tasks and love notes you created, partner link, settings, Mochi Bucks, owned skins, codes and referral records. Link and unlink log entries are kept without your identity.
- Copies in routine backups and provider logs are removed on their normal schedule, a short time later.
- We may keep some records longer where the law requires it, for example to handle a dispute.
8. Your choices and rights
- Delete your account. In the app: Settings, then Delete Account. See how to delete your account. This cannot be undone.
- Unlink or block your partner. Unlink on the partner link screen, or block in the app's Settings.
- Turn off reminders. In the app's Settings or in your iPhone's notification settings.
- Withdraw AI consent. Stop using the AI features (section 4). Withdrawing does not undo requests already made.
- See, fix, or get a copy of your data, or object to how we use it. Email us at [support email]. We answer within 30 days. We may need to check that the request really comes from you.
Depending on where you live, you may have more rights by law.
If you live in the EU, the UK, or Switzerland
We use your data on these legal grounds: to provide the service you asked for (our contract with you); your consent, for the AI features; our legitimate interest in keeping the service safe and preventing abuse; and legal duties. You have the right to access, correct, delete, restrict, and move your data, and to object to our use of it. You can also complain to your local data protection authority.
If you live in California or another US state with a privacy law
In the last 12 months we collected these kinds of personal information: identifiers (email, account ID, IP address), content you created (tasks, notes), purchase status, and app activity (settings and progress). We collected them from you and from Apple, for the purposes in section 3, and disclosed them only to the service providers in section 5. We do not sell or share personal information as those laws define it, and we do not use sensitive personal information for anything beyond running the service. You have the right to know, delete, and correct your information, and we will not treat you differently for using these rights.
9. Children
Mochi is not for children under 13, or under the age at which you can agree to data use in your country (up to 16 in parts of Europe). We do not knowingly collect data from them. If you believe a child has given us personal data, email us and we will delete it.
10. Security
Data is encrypted in transit. Access to stored data is limited by account, so one account cannot read another's tasks or notes, and shared items can only be reached by the two linked partners. No system is perfectly secure, so we cannot promise absolute security. If a breach affects you, we will tell you as the law requires.
11. This website
This website uses no cookies and no trackers. To choose which character to show on the home page, the page looks at the time zone and language your device is set to. That happens inside your browser and is not sent to us or anyone else. Like any website, the company hosting it logs basic connection data such as IP address. The friend invite page reads the invite code from the link in your browser. It does not send the code to us. If you tap its copy button, the invite link is placed on your clipboard so the app can read it when you paste.
If you ask for access, the email you type is sent to our server and kept on a list until we invite you, or until you ask us to remove it. We use it only to send your TestFlight invite and to tell you when Mochi is ready. We do not store your IP address with it: to stop floods of fake requests we keep a scrambled, one-way fingerprint of the sender for one day. Your browser also remembers, on your device only, that you asked, so the form is not shown again.
12. Changes to this policy
If we change this policy, we will update the date at the top. If the change is important, we will tell you in the app or by email before it takes effect.
13. Contact
[company legal name]
[company postal address]
Email: [support email]