Privacy Policy

This Privacy Policy applies to moonlight.photo, including our website, AI image and video studio, and related services (collectively, the “Service”). In this policy, “Moonlight,” “we,” “us,” and “our” refer to the operator of moonlight.photo.

By using the Service, you acknowledge the practices described in this policy. If you do not agree with them, do not use the Service.

We collect information you choose to give us, including:

• Account information: your email address and sign-in verification records. We send one-time sign-in codes through our email provider and store a hash of each short-lived code to verify it. Sign-in emails are not marketing emails.
• Media and creative content: source images, reference images, prompts, reference names and descriptions, edits, generated images and videos, and related file metadata.
• Purchase information: plan selection, credit activity, subscription status, and transaction identifiers. Our payment processor handles full payment-card details; Moonlight does not store them.
• Communications: information you send when you contact us for support, report content, or otherwise communicate with us.

Photos may contain embedded metadata or information about people and places. Please upload only content you have the right and consent to use.

Moonlight uses Google OAuth only to let you create and access your account. We request the openid, email, and profile scopes. Depending on what is present in your Google account, this gives us your Google account identifier, name, email address, profile image, and email-verification status.

We use that information to authenticate you, create and secure your Moonlight account, display your basic profile, communicate about the Service, and prevent fraud or abuse. We do not request access to your Google Drive, Google Photos, Gmail, contacts, or calendar.

We may store your Google account identifier and OAuth tokens as part of the account connection. We do not use Google user data for advertising, credit decisions, or AI-model training; sell it; or allow humans to read it except when necessary for support you request, security, legal compliance, or internal operations permitted by law.

Moonlight's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. You can review or revoke Moonlight's access from your Google Account connections.

When you use the Service, we collect technical and activity information needed to operate and protect it. This may include IP address, browser and device information, user agent, session records, timestamps, requested pages, generation status, error details, and security events.

If you arrive through a supported marketing link and open the studio for the first time, we may save the campaign and creative identifiers with your welcome-credit record to measure campaign performance. We do not save advertising click identifiers or send your photos, prompts, or account data to an advertising pixel.

We use essential cookies or similar technologies to keep you signed in and preserve Service security. We do not currently use advertising cookies.

To investigate repeated free-credit claims, we set a random browser cookie that lasts up to 180 days. When welcome credits are first granted, we store keyed hashes of this identifier and the IP address, when available, with the credit record. This lets us compare claims without storing the raw identifier or IP in that record. Free creation is limited to one account per browser and two welcome-credit claims per IP address in any 24-hour period. Additional accounts can sign in and keep their credits, but must purchase credits, make a subscription payment, or receive approval after a manual review before creating. Eligibility is based on the original claim, so waiting or changing networks does not remove a restriction. Contact hello@moonlight.photo if you share a network and need a review.

We use information to:

• provide, personalize, maintain, and improve the Service;
• process image edits, generations, and animations you request and organize your private reference library;
• authenticate users, maintain sessions, and protect accounts;
• process purchases, administer subscriptions and credits, and keep transaction records;
• respond to support requests and send important Service or policy notices;
• detect, investigate, and prevent fraud, abuse, security incidents, and violations of our policies; and
• comply with law and enforce our agreements.

To complete an edit, generation, or animation, Moonlight sends your prompt and the photos needed for that request to our creative processing infrastructure. Source and reference photos may be made available to image or video processors through short-lived, signed links. Processors may temporarily handle those materials and return job status or result information to Moonlight.

We do not use your Google user data or creative content to train general-purpose AI models. If we ever offer an optional program that uses content to improve or train models, we will explain it separately and ask for your affirmative consent before including your content.

We share information only as needed with:

• Service providers: Google for authentication; Resend for sign-in emails; Stripe for payments; configured image- and video-processing services for generation; Netlify for hosting; and cloud database, storage, monitoring, and security providers.
• Professional advisers: lawyers, accountants, insurers, and auditors when reasonably necessary.
• Authorities and affected parties: when we reasonably believe disclosure is required by law, necessary to protect rights or safety, or needed to investigate fraud, abuse, or a security incident.
• Business successors: in connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to this policy and any consent required by law or Google's policies.

We do not sell personal information, and we do not share personal information for cross-context behavioral or targeted advertising.

We retain account information while your account is active and as reasonably necessary to provide the Service. Deleting an image or video in the studio removes it from your account, including access to downloads and reuse. There is no trash folder or restore option. Copies of deleted media and related prompts, references, and job records remain in a restricted archive accessible only to authorized administrators for internal review. Deleting from the studio does not permanently erase that archive.

You can permanently delete your uploads, creations, references, prompt history, and archived media yourself in Credits & account → Danger zone. Choose to keep your account and billing settings, or delete your data and close your account. Closing your account cancels subscriptions, disables automatic top-ups, and removes any remaining credits. For access, correction, export, or help with deletion, email hello@moonlight.photo from the address associated with your account. We may verify your identity before completing a request. Revoking Google access does not automatically delete information already stored in your Moonlight account; use the Danger zone to close it.

Permanent deletion may take time to propagate to backups and service providers. We may retain records where needed for security, fraud prevention, dispute resolution, accounting, or legal compliance. Residual backup copies are isolated from ordinary use and removed on the applicable backup cycle unless retention is required by law.

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of personal information; object to or restrict certain processing; or appeal a denied privacy request. You may also have the right to complain to a local data protection authority.

You can stop using the Service at any time, revoke the Google connection through Google, and opt out of non-essential email by following the instructions in that message. Transactional and security notices may still be sent while your account remains active.

We use administrative, technical, and organizational safeguards designed to protect personal information, including private object storage and short-lived upload or processing links. No method of storage or transmission is completely secure, so we cannot guarantee absolute security. Please protect your Google account and notify us if you believe your Moonlight account has been compromised.

Moonlight and its service providers may process information in the United States and other countries where they operate. Those locations may have different data-protection laws than your home country. Where required, we use legally recognized safeguards for cross-border transfers.

The Service is intended only for people who are at least 18 years old. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided information to us, contact us so we can investigate and delete it.

We may update this policy as the Service or law changes. We will post the revised policy here, update its effective date, and provide additional notice when required.

Questions or privacy requests can be sent to hello@moonlight.photo.