Draft. This page is a draft and is not legal advice. Text in [BRACKETS] is still to be filled in. Only this English version exists for now; a Japanese version will follow.

Privacy Policy

Last updated 17 October 2026

This policy explains what personal information Moso collects, why, who can see it, who helps us run Moso, and the rights you have. It covers the Moso app and website. How we use cookies is in the Cookie Policy, and the rules for using Moso are in the Terms of Service.

The short version

  • We store what you put into Moso so we can run it for you. We don't sell your data and there are no ads.
  • Your personal memory is private: only you can read it. Organization memory is shared with that organization's members.
  • When you use Moso's AI, or connect your own Claude, the content needed for each request goes to Anthropic, which makes Claude.
  • Our only service providers are Supabase (database), Vercel (hosting) and Anthropic (AI).
  • You can export your notes, delete your content, and ask us to delete your account at [CONTACT EMAIL].

1. Who we are

Moso is run by [LEGAL ENTITY NAME] ("we", "us"), [POSTAL ADDRESS], Japan. Representative: [REPRESENTATIVE NAME]. We decide how your personal information is used, so we are its controller (under GDPR) and the business handling it (under Japan's Act on the Protection of Personal Information, APPI).

Contact for anything about your data: [CONTACT EMAIL].

2. What we collect

Your account

  • Your email address and a password (stored only as a secure hash by Supabase Auth, never in readable form).
  • If you sign in with Google: the name, email address and profile picture Google shares with us. We never see your Google password.
  • Your profile: display name, and anything you choose to add, such as a photo, pronouns, headline, bio, status, links, banner, colours and pinned notes.
  • Your time zone, which Moso reads from your browser so due dates and streaks match your day.
  • Your settings: for example task sorting, notification choices and the AI model you pick.

What you put into Moso

  • Workspaces: your personal workspace, and any organizations, teams and projects you create or join, with your role in each. Invitations hold the email address of the person invited.
  • Checklists, tasks (titles, notes, due dates, priorities, assignees, repeats), goals and milestones.
  • Memory: your notes, with their folders, tags and links.
  • Chats with Moso's AI, including files you attach (images, PDFs and text files), and the messages, reports and progress updates that Claude sends to Moso for you.
  • Images you upload as your avatar or as an organization icon.

What Moso records as you use it

  • Activity history: who created, changed, assigned or finished each task, and whether a person or Claude did it.
  • The days you finish tasks (for your bamboo streak) and badges.
  • When you were last online. Whether you're online right now is shown live and not stored.
  • AI usage: for each AI request, the model, the amount of text processed (tokens) and the cost. Moso's AI also keeps a short record of which of your personal notes it read, deleted after one day, so it can stop them being copied anywhere shared.
  • Connected Claude apps: which Claude app connected to your account, and when it was first and last used.
  • If you turn on notifications: your browser's push address and keys, and its user agent (browser and device type), so we can send notifications to that device.
  • If you connect a Claude Code routine: its address and its token. We encrypt the token before storing it, and your browser can never read it back.
  • Technical logs: like most websites, our providers keep short-term server logs (for example IP address, browser and the page requested) to keep Moso secure and running.

We don't collect payment details. Moso is free during early access and has no payment system yet.

3. Why we use it

  • To run Moso for you: sign you in, store and sync your work, show it to the people you share it with, and let your Claude read and update it. (GDPR: performance of our contract with you.)
  • To run the AI features you use, and to measure their cost. (Contract; and our legitimate interest in keeping Moso affordable.)
  • To send notifications you turned on, and the emails needed for your account (confirming your email, resetting your password). (Contract; consent for push notifications.)
  • To keep Moso safe: prevent abuse, fix bugs, and protect accounts. (Legitimate interests.)
  • To meet legal duties when the law requires it. (Legal obligation.)

We don't use your content for advertising, we don't build advertising profiles, and we don't sell or rent your personal information. We use it only for the purposes above; if we ever want to use it for something new, we'll tell you first and ask for your consent where the law requires it.

4. Who can see what

  • Your personal workspace and personal memory are private. Only you can read them. The database enforces this, so not even organization owners can see them. Moso's AI and your Claude can read your personal memory to help you, but they can only copy a personal note into an organization's notes, tasks, goals or chats after you approve that specific note.
  • Organization content is shared. Checklists, tasks, goals and memory in an organization are visible to its members. Team memory is visible to that team (and the organization's owners and admins), and a project's content to that project's members (and the owners and admins).
  • Your chats are private to you, except shared "Collaborate" chats, which everyone in that chat can read.
  • People you share an organization with can see your profile, avatar, streak and badges, whether you're online, and when you were last online.
  • Organization owners and admins can see how much each member used Moso's AI in that organization, and what it cost. They can't see your private chats.
  • Us: a small number of people who run Moso can see AI usage and cost across all workspaces, to run and pay for the service. We have technical access to the database for running and fixing Moso, but we only look at your content when you ask us for help, to investigate abuse or a security problem, or when the law requires it.

5. Who helps us run Moso

We share personal information only with these service providers, who process it for us under contract and only to provide their service:

  • Supabase (Supabase, Inc., USA): our database, sign-in, live updates and file storage. Moso's data is stored in Supabase's data centre in the United States (Oregon). Supabase also sends Moso's account emails.
  • Vercel (Vercel Inc., USA): hosts the Moso website and app and runs its servers, with a global network.
  • Anthropic (Anthropic PBC, USA): provides the Claude AI models behind Moso's AI. See the next section.

Two more parties are involved only if you use the feature:

  • Your browser's push service (for example Google, Apple or Mozilla) delivers notifications to your device. A notification can include a task title or the start of a Claude report.
  • Google, if you sign in with Google. Your Google profile picture is then loaded from Google's servers when Moso shows it.

We may also share information if the law requires it (for example a valid court order), to protect people's safety or our rights, or as part of a merger or sale of Moso, in which case this policy continues to apply.

6. Moso's AI and your own Claude

Moso's AI

Moso's built-in AI (in chats, "Break it down" and "What's missing?" on goals, and the check of which tasks Claude can do) runs on Anthropic's Claude API. Each time you use it, Moso sends Anthropic what Claude needs to answer: your message and the chat so far; your display name, time zone and workspace names; the page you're looking at; and the tasks, goals, members and notes it looks up for you, which can include your personal memory. Moso also sends your Moso user ID (a random code, not your name or email) so Anthropic can spot abuse.

  • Files you attach to a chat are uploaded to Anthropic so Claude can read them.
  • Claude can search the web and open web pages for you. The search words and addresses are chosen by Claude from your request and go through Anthropic.
  • Claude can run code in a sandbox at Anthropic, which has no internet access. Anthropic keeps a chat's sandbox for up to 30 days.
  • Under Anthropic's Commercial Terms, Anthropic may not train its models on this data, and it keeps it only for a limited time. See also Anthropic's Privacy Policy.

Connecting your own Claude

You can connect your own Claude (Claude.ai, Claude Desktop, Claude Code or Cowork) to Moso. You approve the connection on a Moso consent screen. Your Claude can then read and change what your account can, using the permissions you have, and what it reads goes to your Claude account. That account is between you and Anthropic and follows Anthropic's own terms and privacy policy, not this one. You can disconnect Moso from Claude at any time in Claude's settings.

7. How long we keep it, and how to delete it

We keep your information while your account exists, and delete it when you delete it or close your account:

  • Notes, tasks, checklists, goals and milestones: delete them in the app at any time. In an organization, the activity history of who did what stays with that organization.
  • Organizations: owners can delete an organization with everything in it. Members can leave an organization; what they added stays with it.
  • Avatar, notification devices and Claude Code routines: remove them in your settings.
  • Chats and attached files: you can archive chats in the app. To delete chats or files for good, email us.
  • Your account: email [CONTACT EMAIL] from the address you signed up with. We'll delete your account and your personal workspace within 30 days and tell you when it's done. Content you added to organizations stays there unless you ask us to remove it.
  • Short-lived records expire on their own: the AI's note-read record after 1 day, invitations after 7 days, and provider logs and backups on their normal cycle.

8. Your rights

Wherever you live, you can ask us to:

  • tell you what personal information we hold about you and give you a copy (access);
  • correct it if it's wrong (you can also edit most of it yourself in Moso);
  • delete it, or stop using it;
  • give it to you in a format you can take elsewhere (portability);
  • stop sharing it with third parties.

Export your notes yourself: in Memory, choose Export to download your notes as a zip of Markdown files that open in Obsidian or any text editor. For anything else, email [CONTACT EMAIL]. We'll check it's really you and reply within 30 days. It's free.

If you're in Japan (APPI)

You have the right to request disclosure of the personal data we hold about you (including records of providing it to third parties), its correction, addition or deletion, and that we stop using it or stop providing it to third parties, as set out in the APPI. Our service providers above are in the United States. We use them under contracts that require them to protect personal information to the standard the APPI requires, and on request we'll tell you more about these measures and about the US system for protecting personal information. You can also contact Japan's Personal Information Protection Commission (個人情報保護委員会).

If you're in the EU, the EEA or the UK (GDPR)

You also have the right to object to processing based on our legitimate interests, to restrict processing, and to withdraw consent at any time (for example by turning off notifications). Transfers of your data to the United States are protected by our providers' data processing terms, including the European Commission's standard contractual clauses or the EU-US Data Privacy Framework where the provider takes part. You can complain to your local data protection authority.

9. Security

Moso is served only over encrypted connections (HTTPS). Every request to the database runs as the signed-in person, and database rules check that you're allowed to see or change each item. Secrets you give Moso, such as a Claude Code routine token, are encrypted before they're stored. No system is perfectly secure, so please use a strong password. If a breach affects your personal information, we'll tell you and the authorities as the law requires.

10. Children

Moso isn't meant for children. You must be at least [MINIMUM AGE, suggested 16] to create an account. If you think a child has given us personal information, contact us and we'll delete it.

11. Changes to this policy

When Moso changes what it collects or who it shares data with, we'll update this policy and the date at the top. For important changes, we'll tell you in Moso or by email before they apply.

12. Contact

[LEGAL ENTITY NAME], [POSTAL ADDRESS], Japan. Email: [CONTACT EMAIL].