MSSY

Who's responsible

What we collect

• Your email - used to sign you in via magic link. Nothing more.
• What you put into Mossy - tasks, subtasks, notes, focus sessions, day records, debrief timestamps. That's the product. We keep it so you can come back to it tomorrow.
• Conversations with the companion - what you type to Mossy in chat, plus the task context that rides along (current task title, time elapsed, etc.). Same purpose: so the companion can be useful in the next message.
• Request logs - your user id and the path you hit, kept for around 30 days for debugging. No message bodies, no task content.

Legal basis: we process this data because you've signed up to use Mossy and we couldn't run the product without it (Article 6(1)(b) of the GDPR - performance of a contract).

Where it lives

We don't run our own servers. Mossy uses a small number of sub-processors:

• Supabase (US company, data hosted in Dublin, Ireland) - your account and everything you put into Mossy lives here.
• Anthropic (United States) - Claude is the model behind the companion. When you talk to Mossy or ask for a task breakdown, that text is sent to Anthropic for inference. Their API terms forbid using your prompts for model training. Transfers to the US happen under standard contractual clauses.
• Vercel (United States) - hosts the frontend and provides our analytics + speed insights. For analytics: counts page views and a few named events (sign-in, focus session completed, AI breakdown used) so we can tell whether Mossy is helping people. For speed insights: collects anonymous performance metrics (page load time, interaction latency) sampled from real users. Neither uses cookies, neither identifies you personally, neither does cross-site tracking. Transfers to the US happen under standard contractual clauses.
• Railway (United States) - hosts the backend API. Requests pass through but nothing is persisted on Railway itself; persistence happens in Supabase.
• Lemon Squeezy (United States) - handles paid subscriptions as our merchant of record. When you upgrade to Pro, your billing details (card, address, email) live with Lemon Squeezy and never touch our servers - we only see the resulting subscription state (which tier you're on, when it renews). They handle VAT / sales tax globally on our behalf.
• Resend (United States) - sends the small handful of transactional emails we generate ourselves: a welcome note when you sign up, a thank-you when you upgrade to Pro, and a heads-up before the beta-thank-you period ends. Only your email address travels through Resend. Magic-link sign-in emails are sent separately by Supabase.

What Mossy sends to Claude

Cookies and local storage

We use one localStorage entry to keep you signed in (an auth token from Supabase) and a handful more to remember your theme preference, captured thoughts during focus sessions, and whether you've dismissed certain banners. Nothing is shared across sites.

Our analytics (Vercel Web Analytics + Speed Insights) uses no cookies at all. No third-party cookies, no advertising trackers anywhere on the site.

Your rights

Under the GDPR, you can ask us to:

• Show you everything we have about you (right of access)
• Fix anything that's wrong (rectification)
• Delete your account and everything tied to it (erasure / "right to be forgotten")
• Export your data in a machine-readable format (data portability)
• Stop processing it for a while (restriction)
• Object to processing in some cases

Email hello@mossyfocus.com and we'll handle it. No questions asked, no hoops to jump through.

You also have the right to lodge a complaint with your local data protection supervisory authority - every EU country has one, and a quick search for "data protection authority" plus your country's name will turn it up.

If you're in California

Under the CCPA and CPRA, California residents have the right to know what personal information we collect, request that we delete it, and not be discriminated against for exercising those rights. We don't sell or share personal information for cross-context behavioural advertising - we don't do advertising at all. To exercise any of these rights, email hello@mossyfocus.com and we'll respond within 45 days.

How long we keep things

Your data sticks around as long as you have an account. When you ask us to delete it, we remove your account and everything we have stored in Supabase within 30 days. Request logs at our hosting providers may persist a little longer per their own retention windows, but contain no message content.

Automated decisions

Mossy uses an AI to suggest steps and reply to messages, but it doesn't make any decision that has a legal effect on you or significantly affects you. It's a thinking companion, not an authority.

Changes to this policy

If we change anything material, we'll email you before it takes effect and update the "Last updated" date at the top of this page.