Privacy policy

In short

Moody (moody.no) brings small everyday tools together behind one login. We only store what the service needs to work. We do no marketing or advertising, we do not sell data, and we use no tracking or analytics. What you add is yours, and you can download or delete it at any time.

Who is responsible

Developia AS is the controller for personal data in Moody.

• Developia AS, org. no. 929 523 695
• Vestlisvingen 80, 0969 Oslo, Norway
• Email: kontakt@moody.no

What data we process

Account

• Email address, password (stored only as a hash, never in plain text), first name and last name.
• Language, when the account was created, when you last signed in, and when your email address was confirmed.
• When you accepted the terms, and which versions of the terms and privacy policy you have accepted or seen.
• Account status (pending, approved, rejected or deactivated), whether you are an admin, and which projects you can access.

Login protection

To stop password-guessing attempts, we store a one-way hash of the email address together with the number of failed attempts. The address itself is not stored here. The counter is reset when you sign in.

Email log

When we send you an email, we log the time, the type of email, the language, the recipient address, the delivery status and any error message. We do not store the contents of the email.

Invitations

If someone is invited, we store the invitee's email address, language, which projects the invitation covers, who sent it, and timestamps.

Clothes

In Clothes (wardrobe) we store what you enter yourself. This may be name, category, colours, size, season, brand, price (including approximate), purchase date, where the garment was bought, material, care, condition, notes and similar. The "gift from" field may contain another person's name. We also store outfits, the dates garments and outfits were worn, collections, storage locations, settings, and the time of each AI suggestion you request.

Photos are stored as an original and a thumbnail. They may show things like labels or receipts. Before upload, photos are resized and re-encoded in your browser. This normally removes metadata such as location. Photos are stored privately per user and shown only through links that expire after 30 minutes. While a photo waits to be uploaded, it may be kept in the browser's own storage (IndexedDB), so the upload completes even if you close the app.

Why we process the data

• Providing the service and your account. The legal basis is our contract with you (GDPR Art. 6(1)(b)).
• Security and abuse prevention. Captcha, limits on login attempts and bot checks. The legal basis is our legitimate interest in protecting the service and its users (Art. 6(1)(f)).
• Service emails, such as confirmation, approval and password reset. The legal basis is the contract.
• AI suggestions in Clothes. This is part of a feature you choose to use. The legal basis is the contract. You can turn it off.

Who can see the data

You see your own data. Moody admins see your name, email, status, language, when the account was created, last sign-in, when your email was confirmed, when you accepted the terms, and which projects you can access. From Clothes, admins only see how many garments you have registered. They never see the garments themselves or the photos. Admins also see the email log.

When someone registers, admins receive an email with the new user's name and email address, so the account can be reviewed.

AI suggestions in Clothes

Clothes can suggest details about a garment based on its photos. The feature is on by default for users with access to Clothes, and you can turn it off in the Clothes settings. Suggestions are never filled in unless you confirm them. There is a limit of 300 suggestions per 24 hours.

When you ask for a suggestion, the garment's photos (up to 10) are sent to Anthropic with a fixed instruction. We do not send your name, email or user ID. The photos are used only to create the suggestion. Avoid photographing other people or sensitive documents.

Providers we use

We use these processors. They process data on our behalf and follow our instructions.

• Supabase – database, authentication and file storage. Data is stored in the EU (Ireland, AWS eu-west-1).
• Vercel – hosting. Functions run in Dublin, Ireland. Vercel's global network may process IP addresses and request data.
• Resend – sends email from noreply@moody.no. EU region (eu-west-1).
• Anthropic – AI suggestions in Clothes, as described above. Anthropic is a US company. The transfer to the US is based on the EU standard contractual clauses or the EU–US Data Privacy Framework.
• Cloudflare – Turnstile captcha on registration, sign-in and forgot password. Processes IP address and browser signals to tell humans from bots.

Supabase, Vercel and Cloudflare process IP addresses for technical reasons. Moody itself does not store IP addresses.

Cookies and browser storage

We only use what is strictly necessary for the service to work. That is why we do not need to ask for consent.

• Supabase login cookies (sb-…), shared between moody.no and its subdomains.
• NEXT_LOCALE remembers the language you chose.
• moody_delt is a technical marker showing that the login cookies have been moved to the shared domain. Lasts 400 days.
• Cloudflare Turnstile may use its own technical storage for the security check.
• IndexedDB is used as a queue for photos waiting to be uploaded.

We use no cookies for analytics or advertising.

How long we keep data

• Your account and content are kept until you delete your account.
• Accounts whose email address is never confirmed are deleted after 48 hours.
• Rejected registrations are deleted 30 days after rejection.
• Invitations are deleted 30 days after they are used, expire or are revoked.
• Email log entries are deleted after 12 months, and immediately if the account is deleted.

You delete your account under Account. This requires your password. The account, all project data and all photos are deleted immediately, and you receive an email confirming the deletion. Backups at Supabase may contain data for a limited period afterwards.

Your rights

You have the right to:

• access the data we hold about you
• get a copy of your data. Under Account → "Download your data" you get a ZIP file with all data as JSON and all photos
• correct your data. You do this yourself under Account or in the project
• have your data erased, by deleting your account
• ask us to restrict processing
• object to processing based on legitimate interest
• data portability, meaning you can take your data with you

Email kontakt@moody.no if you want to use your rights. We reply within 30 days. You can also complain to the Norwegian Data Protection Authority, Datatilsynet.

Changes

When we change this privacy policy, we publish the new version here with a version number and date. If you are signed in, you are told in the app when a new version is published.

Contact

Questions about privacy? Write to kontakt@moody.no.