Privacy Policy

Moonpeko · Last updated October 10, 2026

Moonpeko is an AI companion app operated by Vunpeko ("we"). This policy explains what we collect, why, and the control you have. Your conversations are some of the most personal data there is, and we treat them that way.

What we collect

• Conversations: the messages and voice messages you send, and your companion's replies, voice notes and photos. Voice messages and calls are transcribed so he can answer them.
• Photos you share: photos you send in the chat, and, if you add one, a photo of yourself used to create pictures of the two of you (and a short description of how you look in it, so your companion knows you). You can remove your photo (and the pictures made from it) anytime under You.
• Memories: facts your companion saves about you (for example your pet's name or an upcoming interview). You can see, edit and delete every memory in the app under You → What he remembers.
• Profile and preferences: the name you give, how you'd like to be addressed, relationship settings, time zone.
• Account: a pseudonymous account identifier. If you use Sign in with Apple we receive a stable Apple user identifier and, if you choose to share it, an email address (which may be an Apple private relay address). Email or Google sign-in also supplies the corresponding address or provider identifier when used.
• Waitlist: if you confirm you are 18 or older and explicitly request a launch email, we save your email address, language, a coarse source category, and the time/version of that agreement. We do not need a birth date or a full referring URL. Use the unsubscribe link shown after joining or contact support to remove this entry. It is separate from account sign-in and is not consent to unrelated promotional emails.
• Purchases: subscription status from Apple via our payments provider (RevenueCat). We never see your card details.
• Safety signals: counts of safety events (for example, that crisis resources were shown). Transcripts are not added to these counts.
• Diagnostics: error reports and diagnostic logs from the app and our servers (what failed and where, error codes, and the steps around it such as a purchase being confirmed, a call ending or a photo failing, with counts and timings), used to keep the app working and fix bugs, and essential app/device verification diagnostics used to protect the service. Diagnostic logs carry your account identifier in pseudonymised form and never include what you or he write or say, your photos or voice, or payment details. Verification diagnostics include the stage, outcome, fixed failure category, app identifier/build, timings and temporary request/attempt identifiers. They do not include attestation proofs, private keys, device-grant tokens or conversation content.
• App and device verification: Apple's App Attest or Google's Play Integrity checks help verify that the official app is running on a supported device. We receive verification results and keep an app-installation public key, a replay-protection counter and its last verification time for security, not advertising or profiling. The private key stays on your phone. Unused public-key records expire after 90 days; one-time challenges expire after two minutes and device-verification tokens after five minutes. Apple and Google process the platform verification under their own service terms.
• Product analytics: which screens and features you use (for example that you opened a date, sent a message or viewed the subscription page), with your account identifier, device information (device type and model, operating system version, app version, and a random identifier for your installation of the app that is not a hardware or advertising identifier and is replaced when you start over or delete your account), and account usage totals (such as your plan, gem balance and spending, and how many messages you have sent). These events never include the content of your messages, voice, photos, memories or anything you type. We use them to improve the app, with our own analytics and error-tracking service (GoodLogs), hosted on our Cloudflare account. They are not used for advertising or shared with anyone else.
• Gems: a history of what you spent and received, which you can see in the gem store.
• Feedback you send us: if you rate the app or write to us from it, your rating and words, with your account identifier, app version and how long you've used it. Only our team reads it, to improve the app. It is never shown publicly and never shared with your companion.

What we don't do

• We do not sell your data or share it for advertising. There are no third-party ad trackers in the app.
• We do not use your conversations to train AI models.
• Staff do not read conversations, except to investigate a message you report or a safety issue, under strict access controls.

How your data is processed

To generate replies, voice notes and photos, relevant conversation context (your messages, voice messages, photos you share and what he remembers) is processed by our third-party AI and speech providers. We ask for your permission in the app before AI processing. Under their service terms, our AI providers do not use your prompts or responses to train their models; their processing and retention are governed by those terms. Your account, conversations and media are hosted by Cloudflare, which provides encryption in transit and at rest. This is not end-to-end encryption: our service and its processors need access to content to provide replies and media. Some memories may concern health, sexuality, religion or other sensitive topics. Sensitive memories are marked so the companion is instructed not to bring them up unless you do; AI can make mistakes. Avoid sharing information you do not want processed.

Your choices and rights

• Export: You → Export our story downloads a ZIP with your profile, linked sign-in methods, plan, consents, chats, memories, moments, gifts, gems, purchases, feedback, reports and media.
• Delete: You → Delete everything or the web deletion page removes your account, chats, memories, custom boyfriends, feedback and reports from the active service and queues erasure of media, exported files, weekly backups and data held by our analytics and payment processors. Failed cleanup is retried; these copies may remain until cleanup completes or their retention period ends. We request revocation of Apple access when applicable. Billing records are kept for tax and anti-fraud with the account id replaced by “deleted”. Crash reports and server logs use a short hashed account tag, not your raw account id. Deletion does not cancel a store subscription.
• Optional analytics: product analytics are off by default everywhere, including when your country is unknown. Turn them on or off under You → Settings → Account → Privacy & data. Your choice is recorded with its notice version. Essential error and security diagnostics remain separate, use approved technical fields, and do not use optional analytics consent as permission to collect conversation content.
• Withdraw AI permission: use Withdraw AI processing consent in the same Privacy & data section. This stops new AI requests, ongoing microphone forwarding and proactive messages. Existing history remains available for export or deletion. Content already sent to a processor may remain subject to its monitoring or legal-retention rules. Withdrawal does not cancel a subscription.
• Forget: delete or edit any single memory, or clear your chat while keeping your memories.
• Depending on your jurisdiction, you may have rights to access, correct, erase, restrict or object to processing, obtain portability, withdraw consent, appeal a decision, or complain to a regulator. See Privacy requests. The in-app export is not necessarily a complete statutory access response for data held by processors or in security records.

Adults only

Moonpeko is for people 18 and over. If an automated safety check locks an account as possibly under 18, romantic features are disabled. You can ask for human review by emailing support@moonpeko.vunpeko.com.

Retention

• Chats, memories, moments, photos, voice notes, custom boyfriends, selfie and feedback: kept until you delete them or delete the account.
• Purchases and billing events: limited records may be retained for accounting, fraud prevention and legal obligations. Removing your app account id does not necessarily anonymise a retained store transaction reference.
• Backups: database recovery history and encrypted weekly copies are normally retained for up to 30 days. Account deletion queues erasure of weekly copies; recovery history expires under its retention period. Deleted accounts must not be reintroduced during a restore. Media files are not separately backed up. A data export you ask for is kept for one day.
• Inactive guest accounts with no linked sign-in method and no purchases are purged after 24 months.

Technical diagnostics and optional usage data are subject to the configured processor retention and cleanup schedule. Contact support for the applicable schedule or to request erasure.

Purposes and processing grounds

Where GDPR or UK GDPR applies, requested core features are assessed under contract necessity; processing of sensitive health, sexuality, religion or similar information additionally requires an applicable special-category condition. We ask for separate explicit sensitive-data permission. Optional analytics and requested launch emails use their separate consent choices. Proportionate security, service diagnostics, rights handling and safety administration are assessed under the applicable legitimate-interest or legal-obligation grounds, with additional safeguards where sensitive data is involved. Necessary accounting or legal records may be retained under the applicable legal requirements. A device's microphone or photo permission is not a replacement for these choices.

Locations, international transfers and provider monitoring

EU-jurisdiction application storage does not mean all processing stays in the EU. Cloudflare network processing, diagnostics, administrative access, delivery providers and our AI providers' global deployments can involve other locations. Our AI providers may process flagged prompts or responses for abuse monitoring, with authorized review and applicable retention; stateless chat requests do not eliminate this monitoring. We do not claim modified abuse monitoring or end-to-end encryption.

Contact us for information about the applicable processing locations, vendor data-processing terms and international-transfer safeguards, including copies of relevant safeguards where available.

Sub-processors

We use Cloudflare (hosting, database and media storage, image transformations, the web app, and our own GoodLogs telemetry), third-party AI providers (AI and speech services for replies, voice, photos, photo checks and transcription), RevenueCat (subscriptions and purchases), Apple/Google (sign-in, store services, device verification and notification delivery), Expo (app updates and push delivery), and our configured email provider for sign-in codes. You can ask us which AI providers process your data. Notification previews can pass through Expo and Apple/Google delivery services; discreet previews are available. Uploaded photos are sent to our AI processor for safety checking and, where applicable, descriptions and the images you request. They are not posted for other users.

AI-generated content

Your companion is AI, not a real person. Generated JPEG/PNG images and generated WebP stickers receive AI-source metadata; resized AI thumbnails retain it. Saved generated MP3 and WAV audio receives container metadata, and live-call audio is disclosed as generated. User-uploaded original photos and voice are not relabeled as AI merely because they are uploaded. Metadata and visible labels are not a certification that every recipient preserves provenance or that all AI Act requirements are satisfied.

Website storage and cookies

See our cookie and local-storage policy. The public landing page does not load advertising trackers, session replay, or remote Google Fonts. The native app uses local storage for requested features and permissions. We do not record keystrokes.

Contact

Vunpeko · support@moonpeko.vunpeko.com