Privacy policy

“We” means Iris Labs, the maker of Moonbox. [Legal entity pending.]

Moonbox is a creative studio that runs on your Mac. This policy explains what information Moonbox and this website collect, why, and what we never collect.

The short version

• Nothing you create is uploaded. Your prompts, pictures, video, audio, 3D models, recordings, transcripts, chats with the assistant and the files you open in Moonbox stay on your Mac. The tools run on your Mac’s own chip.
• We know your email address and which Macs you use Moonbox on, so you can sign in and download tools.
• Signing in with Google gives us your email address, name, profile picture address and Google account id, and nothing else from your Google account: no Gmail, Drive, Calendar or contacts. We use them only to sign you in.
• Crash reports carry no prompts, no file paths and no keys, and you can turn them off.
• Usage stats, when the app has them, will be off unless you turn them on.
• The AI label inside your files says only that Moonbox made them with AI: no prompt, no name, no model.
• The assistant’s browser is a fresh one each time, never your own browser profile.
• Feedback and diagnostics reach us only when you send them, by email.
• This website has no trackers, no advertising cookies and no third-party analytics.

What stays on your Mac

Everything you make or bring into Moonbox: what you type, the files you add, everything the tools produce, your Assets, your projects and your assistant chats. None of it is sent to us or to anyone else. You can delete any of it in the app or in Finder.

What Moonbox sends us, and why

Your account. When you sign in with Google or with an email link, we receive your email address and an account id. We use them to let you sign in, to deliver your downloads and to email you about your account (for example, a sign-in link). If you sign in with Google, Google also shares your Google account id, name and profile picture address with our sign-in provider, which keeps them with your sign-in; Moonbox doesn’t use the name or picture, and never receives your Google password or contacts. See Google user data.

Your invite. During the private beta, using Moonbox needs an invite. When you enter your code in the app, we record that your account used it and when.

Your Macs. Each Mac you sign in on is registered to your account so the app can download tools for it and keep working offline. A registration contains: a device key created on that Mac (the private part never leaves it), the name you’ve given the Mac, its model and chip, its memory, the memory tier Moonbox uses, the macOS version, the Moonbox version and when the Mac last checked in. You can see and remove your Macs in the app.

Downloads and updates. When Moonbox downloads a tool or an update, our download service sees the Mac’s IP address, which files it asks for and when. We use this to deliver the files, to stop abuse and to know how much capacity we need.

Crash reports. If Moonbox crashes, it sends a report the next time it runs so we can fix the problem. A report contains only: the kind of crash, where in Moonbox’s own code it happened (function names, file names and line numbers inside the app), the Moonbox version, build and update channel, the memory tier, the macOS version and the Mac model. It never contains your prompts or anything you typed, your creations or other files, file names or paths outside the app (your home folder is replaced with ~ before anything is sent), passwords, keys or sign-in tokens, or assistant messages. Crash reports are on unless you turn them off with a switch in Settings › Privacy. Our crash-report service sees the Mac’s IP address when a report arrives, and is set not to store it. [Pending: the founders switch on Sentry’s “Prevent Storing of IP Addresses”.]

When you write to us. Help › Send Feedback opens an email to us in your own mail app, filled in with the Moonbox version and channel, your macOS version, chip and memory tier, and the versions of the tools you’ve installed; never your files, prompts or creations. Help › Save Diagnostics saves a zip of Moonbox’s recent logs on your Mac, with your home folder, the folders holding your creations and data, and any tokens or keys taken out, plus your Mac’s model, chip, memory and macOS version. Nothing is sent unless you send it: the email when you press Send, the zip only if you attach it. Your email and anything you attach reach our support inbox (Help Scout), where we keep them to help you.

Usage stats (not in the app yet). If we add usage stats, such as anonymous counts of which tools are used and how long jobs take, they will be off until you turn them on, never include your content, and this policy will list them before they arrive.

What our cloud keeps

This is everything Moonbox’s servers keep about you, and for how long. You can download all of it, or delete your account and with it everything below that identifies you: see delete your account or download your data.

• Your account. Email address, account id, when you joined and were last seen, and when and with which invite you joined the beta.
  Why: signing in, the Mac limit, the beta, support. Kept: until you delete your account.
• Your Macs. For each Mac: its public device key, the name you gave it, model, chip, memory, memory tier, macOS and Moonbox versions, when it was added and last seen.
  Why: the three-Mac limit, offline passes and downloads, letting you recognise and remove a Mac. Kept: until you remove the Mac, sign out on it, or delete your account.
• Waitlist. Your email address, the page you signed up on and when.
  Why: inviting you when there’s a place. Kept: until you ask us to remove it, or delete an account with the same email.
• Invite codes. A one-way fingerprint of each code (never the code itself), how often it can be used, when it expires.
  Why: the private beta. Kept: until we delete the invite; it holds nothing about you.
• History. When your Macs were added or removed, offline passes were issued, an invite was used or your data was exported.
  Why: security, support, and your own export. Kept: 12 months; when you delete your account, the entries no longer name you.

Elsewhere in our cloud:

• Our sign-in provider keeps your email address, the details Google shares if you use it, your sign-in times and sessions, and its own security log, which includes IP addresses. Deleting your account deletes them, apart from that security log, which the provider keeps for its own retention period.
• Our API’s request logs record the time, which kind of request, the result and how long it took, with a one-way scrambled account tag; no IP address, email or content. They are kept for a few days.
• Our download service’s logs record the IP address, time and file of each tool or update download, for the provider’s retention period.
• Our email sender handles your address and the sign-in emails it delivers.

Never kept in our cloud: anything you make or type, IP addresses in our own database, sign-in or download tokens and offline passes (they are signed and handed to your Mac, not stored), your Macs’ private keys, and payment details (version 1 is free).

On your Mac, the macOS Keychain holds your session, your offline pass and the Mac’s private key. Signing out or deleting your account removes them. Your models, creations and settings are in Moonbox’s folder in your Library.

Google user data

You can sign in to Moonbox with your Google account. This section says exactly what Moonbox gets from Google and what it does with it.

What we receive. Moonbox asks Google only for the basic sign-in permissions (the openid, email and profile scopes). With your consent on Google’s screen, Google shares your email address, your name, the address of your profile picture and your Google account id. Moonbox asks for nothing else: it can’t read your Gmail, Drive, Calendar, contacts or any other Google data, and it never sees your Google password.

How we use it. Your email address and Google account id are used only to sign you in, to recognise your account when you come back, to show you which account you’re signed in with, and to email you about your account (for example, a sign-in link or a notice about this policy). Your name and profile picture address are kept by our sign-in provider with your sign-in, because Google sends them, but Moonbox doesn’t use or show them. We don’t use any of it for advertising, we don’t sell it, and we don’t use it to train or improve AI models.

Where it’s kept and who handles it. Our sign-in provider, Supabase, receives these details from Google and keeps them with your account; the Moonbox API (run by Render) reads your email address and account id from it, and our email sender (Resend) uses your email address to send sign-in emails. It isn’t shared with anyone else, except where the law requires it. The people who run Moonbox see it only to help you when you ask, to keep the service secure, or to comply with the law. It travels encrypted (TLS), is stored encrypted by our providers, and on your Mac your session is kept in the macOS Keychain.

How long, and how to delete it. We keep it until you delete your account. Deleting your account (in Moonbox, Settings › Account › Delete account, or by writing to us at the address under Contact) deletes it from our sign-in provider and our database. You can also remove Moonbox’s access at any time in your Google account, at myaccount.google.com/permissions; you will then need to sign in again.

Limited Use. Moonbox’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Labels inside your files

Every picture, video, audio file and 3D model Moonbox makes carries an AI label: a signed content credential (the C2PA standard) and, where the format has one, a metadata field. The label is added on your Mac and nothing is sent to us. It says the file was made, edited or processed with AI in Moonbox, and names Moonbox and its version. It never contains your prompt, your name, email address or account, the AI model used, the files you started from or your location. Anyone you share the file with can read it. More about AI labels.

When the assistant uses the internet

The assistant runs on your Mac. It goes online only for what you ask it to do, and then it connects from your Mac, not through us:

• Web search. When it searches the web for you, your search words go to DuckDuckGo, and the sites it opens see your Mac’s IP address, as they would in any browser.
• Pictures for pages it builds. Only when the assistant builds a web page for you and looks for openly licensed pictures, it searches Openverse (api.openverse.org) and Wikimedia Commons (commons.wikimedia.org) with the search words it chose for the page, then downloads the pictures it picks from the sites that host them. Those services see the search words and your Mac’s IP address, as with any web request; they get no account details and none of your files.
• Its browser. When it needs a browser, it uses a fresh, empty profile that Moonbox creates for that session and deletes afterwards. It never uses your own browser profile, cookies, saved passwords, history or extensions. It runs your Mac’s Google Chrome only if macOS confirms it is Google’s unmodified app; otherwise Moonbox downloads a separate copy of Chrome for that purpose, checked against our signed list of files.
• Other apps you connect. If you let another app use Moonbox’s tools (MCP, off unless you turn it on), that app decides what happens to the requests it sends and the files it gets back. How MCP works.

This website

The website is a set of static pages. It sets no cookies and loads no trackers, advertising or analytics scripts. Fonts and images are served from this site. A theme you pick is remembered in your own browser only. (The testers’ version of the site, behind a passcode, sets one cookie that remembers you entered it, for 30 days.)

If you join the waitlist, we keep your email address and which page you signed up on, only to email you when there’s a place in the beta.

When you download Moonbox, the download comes from our download service, which sees your IP address, the file and the time, as for any download.

Like any website, our hosting provider handles your IP address and browser details to deliver pages and to protect the site from attacks. The waitlist form uses your IP address briefly to limit repeated attempts.

Who processes data for us

We use a small number of service providers, each only for the purpose listed and under their data processing terms, which let them use the data only to provide their service to us:

Provider	What for	Where
Supabase	Sign-in and the account database	[Region pending]
Render	Runs the Moonbox API	United States
Cloudflare	This website, tool and update downloads	Worldwide network
Sentry	Scrubbed crash reports, unless you turn them off	European Union
Resend	Sign-in emails	European Union
Loops	Update emails about Moonbox	[Pending]
Help Scout	Support emails you send us	United States
Google	Sign in with Google, if you choose it	United States

We don’t sell your information and we don’t share it for advertising. We may disclose information if the law requires it, to protect people’s safety or our rights, or as part of a merger or sale of the business, in which case this policy keeps applying to it.

Where your data is processed

Our providers are in the United States and the European Union. When information about you leaves the country you live in, we rely on the safeguards the law provides for that, such as the European Commission’s Standard Contractual Clauses. [Pending counsel: the transfer mechanisms per provider.]

Security

Everything between Moonbox, this website and our services travels over HTTPS. Our providers store data encrypted. Moonbox keeps your session, your offline pass and your Mac’s private key in the macOS Keychain. Access to our cloud is limited to the people who run it. [Pending: confirm two-factor sign-in on every provider account.] No system is perfectly secure; if a breach affects your information, we’ll tell you and the authorities as the law requires.

How long we keep it

• Your account: until you delete it. Your Macs: until you remove one, sign out on it, or delete your account.
• History: 12 months, and anonymised when you delete your account.
• API request logs: a few days. [Pending: confirm the API host’s log retention.]
• Download logs: the download provider’s retention period. [Exact period pending.]
• Crash reports: up to 90 days.
• Support emails and their attachments: as long as we need them to help you. [Exact period pending.]
• Waitlist: until you ask us to remove you, or delete an account with the same email.

Why we may use it (legal bases)

Where the law asks for one (for example the GDPR in the EU and UK), we rely on: performing our agreement with you to provide Moonbox (your account, your Macs, downloads, sign-in emails); our legitimate interests in keeping Moonbox working and secure (crash reports, request and download logs, the account history), which you can object to; your consent for anything optional (usage stats, if we add them, and update emails), which you can withdraw at any time; and legal obligations where they apply.

Your choices and rights

In Moonbox’s settings you can remove a Mac, turn crash reports off (Settings › Privacy), download your data (everything in “What our cloud keeps”, as a file) and delete your account (Settings › Account; how). Depending on where you live, you may also have the right to access, correct or delete your personal data, to restrict or object to how we use it, to take it elsewhere, and to complain to your data protection authority. To ask, or if you can’t use the app, write to us at the address under Contact below; we answer within 30 days. We don’t sell or share personal information as California law defines those words.

Children

Moonbox isn’t meant for children under 13 (or the minimum age where you live, 16 in some countries), and we don’t knowingly collect their information. If you think a child has given us information, write to us and we’ll delete it.

Changes

If we change this policy, we’ll update the date at the top, and for important changes we’ll tell you in the app or by email before they take effect.

Contact

Iris Labs, [address pending].
Email: [email protected]