Privacy
Policy.

Account data

When you create an account we collect your email address, a Supabase user identifier, and, if you sign in with Google, your Google account identifier, name and profile avatar URL. You can also set a display name in your account settings. We need this to authenticate you and link your subscription. We never store your password in plain text; Supabase handles credential hashing.

Lawful basis (GDPR): Performance of a contract. You can't have an account without it.

Subscription data

If you subscribe to Mosey Pro, we store your Stripe customer ID, subscription ID, status, billing interval, and current billing period dates. Your card number, CVC, and billing address are collected directly by Stripe and never pass through our servers.

Lawful basis (GDPR): Performance of a contract.

Credit ledger

We maintain an append-only credit transaction ledger recording each credit grant, purchase, usage, and refund. Each row stores: your user ID, which bucket (subscription or purchased) was affected, the amount, the transaction type (e.g. monthly_grant, purchase, usage, refund), optionally which AI feature was used, and a timestamp. No image content is stored in this ledger.

This ledger is visible to you in your account and is used for billing transparency, fraud prevention, and customer support. All ledger rows are deleted when your account is deleted.

Lawful basis (GDPR): Legitimate interests. Credit accounting and fraud prevention are necessary to operate a fair and sustainable service.

Saved mosaics

When you explicitly click Save in the studio, we upload and store the following to Supabase Storage and our database on your behalf: your source photo (or, for an imported 3D model, a voxelized version of it rather than the original file), an optional painted mask, the depth image from 3D depth (only if you used 3D depth on that photo), any custom tile photos you added to an image palette, a small thumbnail image, and your mosaic configuration (tile type, layout, palette settings). This data is retained until you delete the mosaic or your account. You can manage your saved mosaics at any time from your library page.

By default, saved mosaics are private. If you toggle a mosaic to shared, it becomes accessible to anyone who has the link, including the source photo, mask, and any custom tile photos you uploaded. Shared mosaics are unlisted: we never publish links to your shared mosaics or include them in our sitemap, and they tell search engines not to index the page or its images. Anyone you send the link to can still pass it on. You can revert to private or delete the mosaic at any time. Shared assets are served via Supabase's CDN; Supabase may cache them at edge nodes.

Lawful basis (GDPR): Performance of a contract. The save feature only works by storing your data.

Support messages

If you contact us via the FAQ support form, we collect your name (optional), email address (optional), the subject category, and your message. This is sent to our support inbox via Resend, and if you give your email address, Resend also sends you a confirmation that we received it.

Lawful basis (GDPR): Legitimate interests, to respond to support requests.

Feedback

After an export, the editor asks how it turned out; while you're working it may ask, at most once a day, how your mosaic is looking; and you can send feedback from the Help menu at any time. If you answer, we store your thumbs up or down, any reasons you pick, any comment you write, and the settings of the mosaic at the time (such as tile type, layout and export format). If you're signed in, it is linked to your account and deleted with it; otherwise it isn't linked to you. Your photo is never included. We're notified in a private team chat when feedback arrives, with your rating, reasons, the mosaic settings and the first 300 characters of your comment, after email addresses, phone numbers and links are removed. Please don't include personal details in comments. Feedback is stored in Supabase until we no longer need it to improve Mosey or you delete your account. So the in-editor question isn't repeated, your browser remembers when it last asked (mosey_feedback_prompted_at).

Lawful basis (GDPR): Legitimate interests, to improve Mosey based on what you tell us. Giving feedback is always optional.

IP addresses (rate limiting)

To prevent abuse, our servers temporarily process your IP address for rate limiting purposes. For unauthenticated requests (e.g. the support form, image search, and guest checkout), your IP address is used as the rate-limit key. For authenticated API requests to our Edge Functions (e.g. checkout session creation), your Supabase user identifier is used instead of your IP address where possible.

IP addresses passed to Edge Functions are forwarded to Upstash (our rate-limiting provider) as part of the rate-limit key. Each key expires automatically within about 20 minutes, once its rate-limit window has passed. IP addresses used for rate limiting within the application server are held in process memory only and are never written to disk or sent to a third party.

Lawful basis (GDPR): Legitimate interests, to protect the service from abuse, spam, and denial-of-service attacks.

Strictly necessary (no consent required)

We store a limited amount of information in your browser that is essential to providing the service. This includes your authentication session, the email address entered during guest checkout (retained until payment is complete or the tab is closed), your workspace preferences, cached application files that support offline use, and drafts of unsaved mosaics, which are deleted when the mosaic is closed or saved to your account. This information is not used for analytics and can be removed at any time by clearing this site's data in your browser settings.

Analytics

PostHog sets ph_* cookies and localStorage entries to maintain a distinct visitor ID across sessions, only when full analytics apply (see Analytics above). Anonymous analytics store nothing on your device. Once you make a choice, it is remembered in localStorage (mosey_cookie_consent) so the banner doesn't reappear. You can change your choice or withdraw consent at any time in Cookie settings.

GDPR / UK GDPR rights

If you are located in the European Economic Area or the United Kingdom, you have the right to: access a copy of the personal data we hold about you; request correction of inaccurate data; request erasure (the "right to be forgotten"); request restriction of processing; obtain a portable copy of your data; object to processing based on legitimate interests; and withdraw consent at any time (this does not affect the lawfulness of processing prior to withdrawal). You also have the right to lodge a complaint with your local supervisory authority.

CCPA / CPRA rights (California)

California residents have the right to know what personal information we collect, to request deletion, to correct inaccurate information, to opt out of any sale or sharing (we do not sell or share; see Section 6), and to non-discrimination for exercising these rights.

New Zealand Privacy Act 2020

As a New Zealand-based operator, we are bound by the New Zealand Privacy Act 2020. If you are located in New Zealand (or anywhere else), you have the right to request access to personal information we hold about you, and to request correction of that information if it is inaccurate, out of date, incomplete, or misleading. We will respond to such requests within 20 working days as required by the Act.

If you believe we have breached the Privacy Act 2020 and are unsatisfied with our response to your complaint, you have the right to make a complaint to the Office of the Privacy Commissioner (privacy.org.nz).