Privacy Policy

1. Who we are

Pedro Conchas Burelo, Boulevard Santillana 11, Zapopan, Jalisco 45019, México, is responsible for your personal data in Mora: we decide what is done with it and answer for it.

For anything about privacy, including requests about your data, write to privacy@mora.day. This policy covers the Mora app and the mora.day website.

2. What we collect

• Your account: your email, your Apple or Google identifier if you link them, and the name that provider gives us. We use no passwords.
• Your profile: your name, username and profile photo.
• What you keep: photos, videos with their audio, words, notes, titles, albums and their covers, the date of each moment and, when it comes from your library, the date it was taken.
• Your close people: who you are connected with, the labels and circles you create (only you see them), who you share each moment with, your link for adding people, and the invitations you created in earlier versions of the app, with the optional note of who they are for.
• Your Echos: the sent moment, who it is for and the date it should arrive.
• Reports and blocks: the moments you report, with the reason and the date, so we can review them, and the people you block, so they cannot connect with you again. Each block reaches us as a notice, so we can review possible abuse.
• Notifications: the token Apple provides to notify you, your phone type (iOS or Android), the language of your notifications and which ones you want.
• App usage and errors: what you do in Mora, such as publishing a moment, saving a draft, sending an Echo or creating a circle, with details like its type or how many people you share it with, never its content; when you open the app; your phone model and system and the app version; and a technical report when something fails. They are stored with your account identifier and your email.

Location. Mora does not ask for your location. Photos and videos are prepared on your phone before upload, and the copy we store leaves out the location your camera may have saved in the file. To know which country and city the app is used from, our analytics provider derives an approximate location from your connection's IP address; the IP is not stored.

We do not ask for your phone number, we do not read your contacts and we do not track you for advertising.

3. How we use it

To provide and improve the service:

• create your account and keep you signed in
• store, prepare and show you your moments, albums and Echos
• show your close people what you choose to share with them
• notify you about requests, shared moments and arriving Echos
• answer your messages and requests, and comply with the law
• understand how Mora is used and find errors, to fix them and improve the app

We do not use your data for advertising, we do not sell or share it for cross-context advertising, and we do not use it to train artificial intelligence.

4. Service providers

We use providers that process data on our behalf, only to run the service:

• Supabase: database, file storage and sign-in. Its servers are in the United States (Virginia).
• Expo and Apple: deliver notifications to your phone. A notification's text includes the name of the person who triggered it. Expo also delivers app updates; when checking for them, your phone sends it technical data (model, version and an installation identifier), never your content.
• Apple and Google: verify your identity if you sign in with them. If you delete your account, we revoke Apple's access.
• Resend: sends sign-in and security emails (your address and the code).
• PostHog: measures app usage and receives error reports: your account identifier, your email, the actions and technical data in section 2, and the approximate country and city. On the mora.day website it counts visits without cookies (section 8). Its servers are in the United States.
• Vercel: hosts the mora.day website.

We share nothing with anyone else, unless a competent authority requires it under the law.

5. What other people can see

• Your moments are private by default. Only the people or circles you pick for each moment see it, or all your close people if you choose that; a moment in your private folder is yours alone.
• Your close people see your name and profile photo, and the moments you share with them. If you add someone to a circle, they also see what you had already shared with that circle. Anyone who connects with you later also sees what you shared with all your close people.
• Your link shows your name to whoever opens it, even without an account, and also your photo to whoever opens it with a Mora account. You can change it at any time and the old one stops working. Requests expire after 30 days. The page for your link copies that link to the phone of whoever taps Download Mora. The first time someone enters Mora on a phone, the app checks whether a link is copied without reading it, and reads it only if that person answers yes and allows it in iOS. One-use invitations from earlier versions show your name and photo to whoever opens them with an account and expire after 7 days.
• An Echo for someone else is seen by that person when it arrives, with your name and photo; if you deleted your account before then, it reaches them without your name or photo. No one can see it before that date. When it arrives, we notify you both and you can see it again too, but you will not know whether they opened it.
• Your labels and circles are yours alone: no one knows what you call them or which circle they are in.

If you remove someone from your people, they stop seeing what you shared directly with them.

If you block someone, neither of you sees what the other shared and they cannot connect with you again; we do not tell them. If you report a moment, you stop seeing it and we do not tell its author who reported it.

6. Retention and deletion

We keep your data while your account exists. When you delete a moment, we delete its files and its record.

Deleting your account. In Settings › your name › Delete my account, we first delete your files and then your profile, moments, albums, Echos, connections, circles, labels, your link, invitations and notification tokens. There is no grace period and no recovery. If you signed in with Apple, we also revoke that access. One exception is Echos for someone else: they stay with that person, without your name or any other data of yours, and those that have not arrived are sent on their date.

Usage data. App usage records (what you did in Mora, never its content) are kept after you delete your account, without your email and tied to an identifier that no longer belongs to any account, so we can understand why people leave Mora.

Backups. Daily platform backups and technical logs keep a copy until they rotate, within 7 days at most.

On your phone. Photo and video drafts live only on your phone until you publish. Your session is kept in the device's secure storage. Face ID is handled by iOS: Mora never receives your biometric data.

7. Your rights

You can access, correct, delete or get a copy of your data, object to a use of it and withdraw your consent. You can edit your name, username and photo in Edit profile and delete your account in Settings. For anything else, write to privacy@mora.day. We may ask you to confirm your identity, we answer within 20 business days, and it is free. We will not treat you differently for exercising these rights.

Usage data. Understanding how Mora is used (section 3) is optional for you. If you do not want us to use your data for it, write to privacy@mora.day: we stop keeping your usage data and delete what we have. Saying no does not change the service.

If you live in the European Economic Area or the United Kingdom. The GDPR also applies. We process your data to provide the service you signed up for (contract), to understand how Mora is used, find errors and keep it secure (our legitimate interest in an app that works and is safe), and to comply with the law. Besides the rights above, you can ask us to restrict a use of your data and complain to the data protection authority in your country. Your data is processed in the United States; for that transfer we rely on the safeguards in our providers' data processing agreements, such as the European Commission's standard contractual clauses.

8. Cookies and automatic data

The app uses PostHog to measure its use and find errors (sections 2 and 4); it uses no advertising tools and does not track you across other apps or websites. The mora.day website also uses PostHog to count visits: which pages you view, how far down you scroll, whether you tap the link to get the app, which site you came from, and technical data such as your browser and device. It does this without cookies and without storing anything in your browser: PostHog counts visitors with a code that changes every day and does not keep your IP address, so it cannot recognize you from one day to the next or link your visits to your account. The website also stores a single cookie with the language you chose and reads your browser's language to show the right version. We use no tracking cookies.

9. Security

Your data is encrypted in transit and at rest. Your moments are kept in private storage, and the database decides who can see each one, not just the app.

To be clear about the limit: Mora is not end-to-end encrypted. We could technically access your content; we would only do so if you ask us to solve a problem or the law requires it.

10. Children

Mora is not directed at children under 13. If we learn that someone under 13 has an account, we delete it. If you are a minor, we process your data with the permission of your parent or guardian, who can write to us to exercise your rights or ask us to delete your account. If you believe a child under 13 has an account, write to us.

11. Changes

If we change how we handle your data, we update this page and, when the change is significant, tell you in the app or by email before it applies. The date above matches the version you are reading.

12. Contact

Pedro Conchas Burelo

Boulevard Santillana 11, Zapopan, Jalisco 45019, México

Privacy requests: privacy@mora.day.