Who is responsible
Julien El-Bahy
Badstraße 19/3
2340 Mödling
Österreich
What this is about
moj is a family planner. What you send it lands sorted in your shared space: shopping, tasks, appointments, receipts, ideas, people and goals. That data belongs to your family, not to us. A family can be several households, say parents and grandparents; what one household adds, the others see only when it is meant for everyone.
What we process
- Account: your email address and display name. Signing in uses a code of 6 digits sent by email; there is no password.
- Content: everything you write, say, photograph, share from another app, forward by email or have providers send to the moj address you keep for bills, and what moj makes of it.
- Files: photos, PDFs and voice messages you send.
- People in your family: name, relation, birthday and clothing sizes, as far as you enter them. For a child there is also the timetable, meaning subjects and times.
- Subscribed calendars: the address you enter, such as the nursery’s calendar or your own, and the dates moj fetches from it every hour. For a calendar set to “Busy only”, moj stores only the times of its dates, not their titles or places.
- Contacts: only if you take birthdays over from your address book, and then only the name and birthday of the contacts you pick. Otherwise the address book stays unread, and it is never uploaded.
- Technical: device identifiers for notifications and, if you link it, your WhatsApp number.
- moj Plus: whether your family space has Plus, until when, through which store and which member bought it. We do not see payment details. Payment happens in the store, and all that reaches us is whether and until when a subscription runs.
About a child without an account of their own, moj stores only what you enter. A child with an account gets onto its phone with a code from you, without an email address. Otherwise the same applies to that account as to yours.
Where the data sits
- The database is with Neon in Frankfurt, stored encrypted.
- Files are in private Cloudflare R2 storage bound to the EU, reachable only through short-lived signed links.
- The application logic runs on Cloudflare at the nearest location. Your content, your files and your accounts sit in the EU. What you send goes to OpenAI to be understood, and that processing is not limited to the EU. The sending of our emails and the state of a subscription leave it as well. Who is involved is below.
Who else is involved
- OpenAI understands your messages, reads receipts and turns speech into text. So that a message can be understood at all, a short context travels with it: the people in your family, your lists, the names of your appointment categories and subscribed calendars, the children’s timetables, your open entries and the sender’s last few messages. OpenAI is a processor under contract. OpenAI offers processing in Europe only, and moj does not use it yet. According to OpenAI’s own documentation, checked on 7 October 2026, API requests are not used for training. Logs for detecting abuse are kept there for up to 30 days.
- Meta carries messages if you link WhatsApp. Without that link Meta is not involved.
- Expo, Apple and Google deliver notifications. Those carry the family name and one line with a title and a time, so they can be read on a lock screen. Amounts, notes and attachments are never part of them.
- Resend delivers our emails: the sign-in code, the confirmation and the launch mail for the waitlist, the reply to a piece of feedback and the contact form. Resend sees the recipient address and the content of those mails. Its own documentation, checked on 12 September 2026, says that metadata, logs and API records are stored in the United States. That holds whichever region a mail is sent from.
- RevenueCat manages moj Plus between the store and moj. RevenueCat learns your family space’s identifier, the device type and the operating system. After a purchase the store’s receipts are added. RevenueCat learns no names and no content. Its privacy policy, checked on 4 October 2026, says this data is kept with Amazon Web Services in the United States. As long as nobody opens the “moj Plus” page in the app, RevenueCat is not involved.
- Neon and Cloudflare run the database, the storage and the application logic.
What we do not do
moj has no analytics services, no usage tracking and no error reports to third parties. There is no advertising, and your data is neither sold nor passed on.
Numbers and feedback
Once a week moj counts how many families there are and how many messages arrived, and sends us those sums. They contain no names and no content, and no profile comes out of them. If you start a message with "Feedback:", it does not land in your family space but comes to us as an email, together with the email address of your account, so we can reply. The same goes for the contact form on this site: what you write there becomes an email to us, with your address as the way back. Nothing is stored in the process, and no account is needed.
On heymoj.app the server keeps its own count. It counts how often a page is opened, how often somebody presses a store button and how often a sample message on the front page is tapped. All that is stored is the total per day and page. Your IP address and your browser are not stored for this. Of the page you were just on, only its path on heymoj.app is kept. The site sets no cookies, and no script runs for this. The totals are deleted after 400 days. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR: we want to know whether the site does its job.
Questions to the AI on the help page
On the help page you can ask an AI a question. It only goes out once you tick the box for your consent and send it. The legal basis is that consent under Art. 6(1)(a) GDPR, and it covers that one question. No account is needed.
The question goes to OpenAI together with the text of our help pages. The contracting party is OpenAI Ireland Ltd., as a processor. The processing is not limited to the EU, and transfers to other countries rest on standard contractual clauses. The request goes out with the instruction not to store it. According to OpenAI’s own documentation, checked on 8 October 2026, OpenAI does not use it for training and keeps logs for abuse monitoring for up to 30 days.
We store neither the question nor the answer. All that is logged is how large the request was and what it cost. To stop the feature being abused, the server counts for ten minutes how often your IP address has asked. That happens in memory and is not stored.
Waitlist
On heymoj.app you can leave an email address so we can tell you when moj is out. The form itself stores nothing: a mail with a confirmation link goes to the address, and only the click on that link creates an entry. What is then stored is the address, the language of the page, the page the signup came from and the date. The page that link opens also asks whether you carry an iPhone or an Android device; if you answer, that is stored too. Anybody who never clicks the link is recorded nowhere. After that we write exactly once, at launch. Every one of those mails carries an unsubscribe link, and one click on it deletes the entry at once and completely. The basis is your consent, which you can withdraw that way at any time. These addresses go to nobody else and are used for nothing else.
How long
As long as you use moj. If you delete your account or your family, the data is made unreadable at once and deleted for good after 30 days. That period exists so a deletion by mistake can be taken back. A family space takes its photos, PDFs and voice messages with it. What you entered for the family belongs to the family space. If you delete only your account, it stays for the others, with your name on it. What you kept to yourself with “Only me” is deleted with the account. An entry on the waitlist stays until you unsubscribe; once the app is out we delete the list, because it then has nothing left to do.
Your rights
You can ask what we hold, have it corrected, have it deleted or take it with you, at any time. The app carries two exports for exactly this — one for your account across every family space, one for the single space — and the deletion of your account. For anything else, write to us.
If you believe we handle your data wrongly, you can complain to a data protection authority, including the one of your own country. The authority responsible for moj is the Austrian Data Protection Authority in Vienna, because that is where we are. In the United Kingdom it is the Information Commissioner’s Office.