Privacy Policy

Overview

Moonstone is a browser-based Markdown vault and personal knowledge management workspace. This policy explains what information Moonstone collects, how it uses that information, and how Bridge Mode works when you connect Dropbox, OneDrive, or Google Drive.

This policy applies to Moonstone at https://moonstone.soffwolf.com and related Moonstone app services.

Information Moonstone collects

When you create or use a Moonstone account, Moonstone collects account and profile details provided through Clerk, such as your user ID, email address, name, and avatar URL when available.

Moonstone stores app settings and workspace preferences needed to operate the product, such as editor, theme, template, hotkey, and vault selection settings.

When you use Moonstone Cloud, Moonstone stores your vault metadata, folders, note titles, note paths, note content, attachment metadata, and uploaded attachment files in Supabase-backed infrastructure.

When you use Bridge Mode, Moonstone stores provider connection metadata, selected vault root metadata, provider account labels such as email or display name when the provider returns them, and encrypted provider refresh tokens needed to keep the connection working after you authorize it.

Moonstone may also process operational logs, diagnostics, support messages, and security-related records needed to run, debug, protect, and support the service.

Google Drive Bridge data

If you connect Google Drive through Bridge Mode, Moonstone requests Google account profile/email access and Google Drive access so you can open, browse, sync, save, export, and manage a Markdown vault stored in your Google Drive account.

Moonstone currently requests the Google Drive scope https://www.googleapis.com/auth/drive. Google describes this as permission to view and manage all of your Drive files. Moonstone uses that authorization only for the Bridge Mode features you choose to use, including selecting a vault folder, listing folders and files, reading Markdown files and attachments, creating new files or folders, updating file contents and metadata, moving or renaming files, downloading files for display or export, detecting Drive changes, and deleting files or folders when you delete them from the connected vault in Moonstone.

The Google user data Moonstone may access includes Google Drive file and folder IDs, names, parent folder relationships, MIME types, timestamps, checksums, change/page tokens, Markdown file contents, attachment file contents, and the Google profile or email information used to label the connected account.

Moonstone does not use Google Drive data for advertising, retargeting, selling data, determining creditworthiness, or training AI models. Moonstone does not allow humans to read your Google Drive files unless you ask for support involving specific files, it is necessary to investigate abuse or security issues, or Moonstone is legally required to do so.

Moonstone's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we use information

Moonstone uses your information to authenticate your account, operate the editor and vault experience, sync and save notes, display files and attachments, support import and export, maintain provider connections, prevent abuse, troubleshoot issues, and respond to support requests.

Moonstone uses Google Drive data only to provide or improve user-facing Bridge Mode features that are visible in the Moonstone app, such as vault browsing, note editing, attachment display, sync, export, and provider connection management.

Moonstone does not treat your notes, attachments, or provider files as marketing assets.

How information is shared

Moonstone does not sell your personal information or Google user data.

Moonstone shares information only with service providers needed to operate the app, such as Clerk for authentication and account management and Supabase for database, storage, and backend functions. These providers process information on Moonstone's behalf so the service can work.

Moonstone may disclose information when required by law, to protect the security or integrity of the service, to prevent abuse, or as part of a merger, acquisition, or sale of assets with appropriate user notice or consent where required.

Moonstone does not transfer Google user data to advertising platforms, data brokers, information resellers, or AI model training providers.

Where data is stored

Moonstone account records, Moonstone Cloud vault data, attachment records, Bridge connection metadata, selected provider vault roots, and encrypted provider refresh tokens are stored using Supabase-backed infrastructure.

In Bridge Mode, your note content and attachments should remain in your connected provider account when possible. Moonstone may access, read, create, update, download, delete, and sync files in that provider account as authorized by you. Moonstone servers do not intentionally keep a separate copy of Bridge Mode vault content just because you connect a provider.

If you import provider-backed files into Moonstone Cloud, export a vault, upload local attachments, or otherwise move content between storage modes, the content may be stored or processed according to the storage mode you choose.

Retention and deletion

Moonstone keeps account, vault, and connection information for as long as needed to provide the service, comply with legal obligations, resolve disputes, protect the service, or until you delete it.

You can disconnect a Bridge Mode provider from Moonstone. For Google Drive, Moonstone attempts to revoke the saved Google refresh token and deletes the Moonstone bridge connection record. You can also revoke Moonstone's access from your Google Account security settings.

You can export your vault as plain Markdown. The app provides account deletion for Moonstone Cloud workspace data in supported contexts, and you may contact Moonstone to request help exporting or deleting Moonstone-managed account, vault, and connection records.

Deleting a Moonstone account or disconnecting Bridge Mode does not delete files that remain in your Dropbox, OneDrive, or Google Drive account unless you separately delete those files.

Security

Moonstone uses reasonable technical and organizational safeguards for a small web application, including HTTPS for data in transit, account-scoped access controls, Supabase row-level security for user-owned records, and encrypted storage for provider refresh tokens.

No online service can guarantee perfect security. If you believe you have found a security issue, contact Moonstone using the email below.

Your choices and third-party services

You control whether to use Moonstone Cloud or connect a third-party storage provider through Bridge Mode. You can use export features to keep portable Markdown copies of your vault.

Clerk, Supabase, Google Drive, Dropbox, and OneDrive may process information under their own privacy policies and terms when you use those services with Moonstone.

Changes to this policy

Moonstone may update this policy as the product changes. When the policy changes, Moonstone will update the date at the top of this page.

Contact

For privacy questions, contact [email protected].