Privacy Policy

This Privacy Policy applies to moonlight.photo, including our website, AI image and video studio, and related services (collectively, the “Service”). In this policy, “Moonlight,” “we,” “us,” and “our” refer to the operator of moonlight.photo.

By using the Service, you acknowledge the practices described in this policy. If you do not agree with them, do not use the Service.

We collect information you choose to give us, including:

• Media and creative content: source images, reference images, prompts, reference names and descriptions, edits, generated images and videos, and related file metadata.
• Purchase information: plan selection, credit activity, subscription status, and transaction identifiers. Our payment processor handles full payment-card details; Moonlight does not store them.
• Communications: information you send when you contact us for support, report content, or otherwise communicate with us.

Photos may contain embedded metadata or information about people and places. Please upload only content you have the right and consent to use.

Moonlight uses Google OAuth only to let you create and access your account. We request the openid, email, and profile scopes. Depending on what is present in your Google account, this gives us your Google account identifier, name, email address, profile image, and email-verification status.

We use that information to authenticate you, create and secure your Moonlight account, display your basic profile, communicate about the Service, and prevent fraud or abuse. We do not request access to your Google Drive, Google Photos, Gmail, contacts, or calendar.

We may store your Google account identifier and OAuth tokens as part of the account connection. We do not use Google user data for advertising, credit decisions, or AI-model training; sell it; or allow humans to read it except when necessary for support you request, security, legal compliance, or internal operations permitted by law.

Moonlight's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. You can review or revoke Moonlight's access from your Google Account connections.

When you use the Service, we collect technical and activity information needed to operate and protect it. This may include IP address, browser and device information, user agent, session records, timestamps, requested pages, generation status, error details, and security events.

We use essential cookies or similar technologies to keep you signed in and preserve Service security. We do not currently use advertising cookies.

We use information to:

• provide, personalize, maintain, and improve the Service;
• process image edits, generations, and animations you request and organize your private reference library;
• authenticate users, maintain sessions, and protect accounts;
• process purchases, administer subscriptions and credits, and keep transaction records;
• respond to support requests and send important Service or policy notices;
• detect, investigate, and prevent fraud, abuse, security incidents, and violations of our policies; and
• comply with law and enforce our agreements.

To complete an edit, generation, or animation, Moonlight sends your prompt and the photos needed for that request to our creative processing infrastructure. Source and reference photos may be made available to image or video processors through short-lived, signed links. Processors may temporarily handle those materials and return job status or result information to Moonlight.

We do not use your Google user data or creative content to train general-purpose AI models. If we ever offer an optional program that uses content to improve or train models, we will explain it separately and ask for your affirmative consent before including your content.

We share information only as needed with:

• Service providers: Google for authentication; Stripe for payments; configured image- and video-processing services for generation; Netlify for hosting; and cloud database, storage, monitoring, and security providers.
• Professional advisers: lawyers, accountants, insurers, and auditors when reasonably necessary.
• Authorities and affected parties: when we reasonably believe disclosure is required by law, necessary to protect rights or safety, or needed to investigate fraud, abuse, or a security incident.
• Business successors:in connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to this policy and any consent required by law or Google's policies.

We do not sell personal information, and we do not share personal information for cross-context behavioral or targeted advertising.

We retain account information while your account is active and as reasonably necessary to provide the Service. Photos, prompts, and results remain associated with your account until you delete them using available controls or ask us to delete them. We may retain limited records for security, fraud prevention, dispute resolution, accounting, or legal compliance.

To request access, correction, export, or deletion of your account and personal information, email hello@moonlight.photo from the address associated with your account. We may verify your identity before completing a request. Revoking Google access does not automatically delete information already stored in your Moonlight account, so contact us if you also want the account deleted.

Deletion from active systems may take time to propagate to backups and service providers. Residual copies are isolated from ordinary use and removed on the applicable backup cycle unless retention is required by law.

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of personal information; object to or restrict certain processing; or appeal a denied privacy request. You may also have the right to complain to a local data protection authority.

You can stop using the Service at any time, revoke the Google connection through Google, and opt out of non-essential email by following the instructions in that message. Transactional and security notices may still be sent while your account remains active.

We use administrative, technical, and organizational safeguards designed to protect personal information, including private object storage and short-lived upload or processing links. No method of storage or transmission is completely secure, so we cannot guarantee absolute security. Please protect your Google account and notify us if you believe your Moonlight account has been compromised.

Moonlight and its service providers may process information in the United States and other countries where they operate. Those locations may have different data-protection laws than your home country. Where required, we use legally recognized safeguards for cross-border transfers.

The Service is intended only for people who are at least 18 years old. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided information to us, contact us so we can investigate and delete it.

We may update this policy as the Service or law changes. We will post the revised policy here, update its effective date, and provide additional notice when required.

Questions or privacy requests can be sent to hello@moonlight.photo.