Beta privacy policy

1. What we collect

Your account

• Sign in with Apple: the name you share with Apple the first time you sign in, your email address (your usual one, or the relay address Apple creates if you choose Hide My Email), and a scrambled (hashed) version of the identifier Apple gives us. We don’t keep the identifier itself.
• Email sign-in links: if you sign in with a link sent to your email, we keep your email address, a scrambled copy of the link’s code, and a rough description of the device that asked for it.
• Staying signed in: scrambled sign-in tokens, when they were last used, and a short description of the app and device that used them.
• Your profile: your display name, and your profile photo if you add one.

Your trips

• Trip name, destination (the words you type, plus the map coordinates and time zone your iPhone works out from them), dates, and how the organizer described the trip.
• Group details: for example, whether the group has a car, a budget, and any accessibility notes.
• Ideas: the place, its address and map location, any link, and the text that was entered.
• Your reactions (In, Could, Pass), when you made them, and any changes.
• Whether you’ve opened the trip and finished reacting.
• How you’re taking part: your pace, which days you’re there, and similar trip settings.
• Flight and lodging details, if they’re added to a trip.

People you invite

The email address of each person you invite, whether you type it or pick it from your contacts. We use it to send them an invite and to add them to the trip when they sign in.

Your device

If you allow notifications, your device’s notification token, along with which version of the app it belongs to.

Usage analytics

When you use the app, we record which screens you open and some actions you take, along with the app version and build. This is pseudonymous: it’s tied to a random account ID, not to your name or email address.

Our servers also record events about what happens in a trip, such as a trip moving to its next stage. Those events are tied to the trip’s ID, not your account ID. They carry counts and scrambled (hashed) identifiers, never your name, email address, or account ID.

Screen recordings (TestFlight builds only)

On some beta builds we turn on screen recording to see where people get stuck. While it’s on, the app shows “Diagnostics recording is on for this beta build.” on the sign-in screen and in Settings. Text you type is hidden from recordings. Other things on screen, like trip names and people’s names, can be captured. Recording is never turned on in an App Store version.

Crash reports

When the app or our server hits an error, we collect technical details about it, along with your device and app version and your account ID.

Beta requests, feedback, and email

• When you ask to join the beta, the email address you write from. We give it to Apple’s TestFlight so Apple can send you the invite.
• Feedback you send through TestFlight, which Apple passes on to us with any screenshot and note.
• Any email you send to support@moosequest.net.

Technical records

• A record of actions taken on a trip (which account did what, stored as IDs).
• How much AI processing each trip used (counts and cost, not the text).
• Copies of server responses, used to avoid doing the same action twice.
• When your device connects to our servers, or to our analytics and crash-reporting providers, they receive its IP address and may keep it. Our network and hosting providers use it to deliver traffic and to limit abuse.

What stays on your iPhone

• Calendar: if you add your plan to your calendar, iOS asks you to allow full access to your calendar. That is the level of access the app asks for in this beta. The app creates its own “Avenue” calendar and adds, changes, and removes events only on that calendar. Nothing from your calendar is sent to us.
• Contacts: if you pick someone to invite, only the email address you picked is sent to us.
• Location: the app may ask to use your location while you’re using it, to work out how far you are from a place. It reads your location once, on your iPhone, and doesn’t send it to us.
• Reminders the app sets are stored on your iPhone.

What the beta doesn’t collect

• Diet, allergy, or health preferences. The beta doesn’t ask for them. If that changes, we’ll update this policy first.
• Payment details. There are no payments in the app.
• Your advertising identifier. We don’t track you across other companies’ apps or websites.

2. How we use it

• To run the app: signing you in, saving your trips, sending invites, and building plans.
• To suggest ideas and build plans with AI (see section 4).
• To send the emails the app needs (see section 6).
• To find and fix bugs and crashes.
• To understand how the beta is used and what to improve.
• To keep the service secure and prevent abuse.
• To answer you when you write to us.

3. Who sees what in the app

• Your reactions: nobody else. Not other members, and not the organizer. One caveat: on a trip for two, the plan can hint at what the other person chose.
• The organizer sees each member’s name and where they are in the process (invited, opened the trip, reacting, finished, or opted out). Not their choices. The organizer also sees the email addresses they typed for invites that haven’t been accepted yet. On a trip of three or more, the plan can also show the organizer how many people are going to an optional stop. Sitting a stop out lowers that count, but the organizer isn’t told who sat out.
• Everyone on a trip sees members’ names and profile photos, the plan, and the group details, including accessibility notes. Don’t put anything in the group details you wouldn’t tell the whole group.
• Email addresses of members aren’t shown to other members.
• Profile photos are stored at a web address that doesn’t require signing in. Anyone who has that address can view the photo. Removing your photo hides it in the app but doesn’t delete it: the same address keeps showing it until we erase it. To have it erased, email us.
• Share links: if an organizer creates a share link, anyone with the link can see the trip’s name, destination, dates, stops, notes, and links. It doesn’t show members’ names or email addresses.

4. AI processing

We use Claude, an AI model made by Anthropic, through Amazon Bedrock, processed in the United States.

What we send: the destination and dates, how many people are going, how the organizer described the trip, pace and style settings, any instructions given to adjust a day, the group’s combined likes and limits where those are set (never who set them), and the text of a web page if someone adds a link.

What we don’t send: your name, email address, account ID, or the group’s accessibility notes.

Amazon states that Bedrock doesn’t use these inputs to train models and doesn’t share them with the model’s maker.

AI-generated ideas can be wrong or out of date. Check hours and availability before you go.

5. Who handles your information for us

We use these service providers to run the beta. They handle information on our behalf.

Maps, place search, and turning a destination into map coordinates use Apple Maps. Apple handles those searches under its own privacy policy.

We don’t sell your personal information and we don’t use it for advertising. There are no advertising tools in the app.

6. Emails we send

Emails come from Project Avenue <hello@notify.moosequest.net>. Replies go to support@moosequest.net.

• Sign-in links, when you ask for one.
• Trip invites, to each person an organizer invites, whether or not they have an account.
• A notice when a trip you’re on is deleted.

7. How we protect it

Information is encrypted in transit and when stored on our servers. Sign-in tokens are stored only in scrambled form, and on your iPhone your sign-in is kept in the iOS Keychain. No system is perfectly secure, and the beta runs on a test server, so please don’t enter anything sensitive, like health details or passport numbers.

8. How long we keep it

9. Deleting your information

During the beta, we handle deletion by email. The Delete account button in Settings doesn’t complete the deletion in this build yet.

Email support@moosequest.net and tell us the email address on your account (if you used Hide My Email, include that relay address). We’ll confirm with you, then delete your account and the personal information tied to it. You can also ask us to erase a trip you deleted or a profile photo you removed.

Some copies last a little longer after deletion: server backups for up to 7 days, server logs for up to 30 days, and copies held by our providers for the periods in section 8. Feedback you sent through TestFlight is also held by Apple.

10. Your choices

• Permissions: you can turn notifications, calendar, location, and contacts access on or off at any time in your iPhone’s Settings.
• Your profile: you can change your display name and photo in the app’s Settings.
• A copy, a correction, or deletion: email support@moosequest.net.
• Analytics: the beta doesn’t have an in-app switch to turn analytics off yet. If you email us, we’ll delete the analytics data tied to your account.

11. Children

The beta isn’t meant for children. You must be at least 18 to join. If you think a child has given us information, email support@moosequest.net and we’ll delete it.

12. Where your information is processed

Our servers, database, file storage, and AI processing run in the United States, on Amazon Web Services. PostHog also handles analytics in the United States. Some providers work across many countries: Cloudflare handles traffic at locations around the world, and Apple processes information under its own policy. Sentry and Postmark may also process information outside the United States. So your information may be processed outside the United States.

13. This website

This website doesn’t use cookies or analytics. Our hosting provider handles your IP address to deliver the pages.

14. Changes to this policy

If we change this policy, we’ll update the effective date at the top. If a change affects how we use information you’ve already given us, we’ll tell beta testers by email or in the TestFlight notes before it takes effect.

15. Contact

Email support@moosequest.net.

MooseQuest LLC, United States