Privacy Policy

Last updated: 25 October 2026 · Version 1.15

1. Who We Are

Moogoose is an Android communication accessibility keyboard for adults aged 18 and over. It helps you understand text on your screen, use voice dictation, and write replies in your own style. You review each draft and decide whether to use or send it. Moogoose never sends messages automatically.

Moogoose Limited is responsible for how personal information is used to provide Moogoose. It is the data controller under UK data protection law. This policy applies wherever Moogoose is available. Your rights can also depend on the laws where you live.

Moogoose Limited
Registered in England and Wales - Company number 17333615
Registered office: 75 Charlton Close, Bournemouth, BH9 3PS, United Kingdom
Email: hello@moogoose.com

2. What This Policy Covers

This policy explains what information the app uses, why it uses it, who receives it, and how you can control it. Information can relate to you or to other people whose details appear in messages, emails, documents, profiles, websites, or other content you ask Moogoose to use.

That content can include sensitive information, such as health, disability, beliefs, sexuality, or ethnicity. Moogoose does not use it for advertising, intentionally infer diagnoses, or create advertising profiles.

3. Information We Use

Screen content: visible text from the app you are using, including messages, emails, documents, web pages, social posts, and names or contact details shown with them.
Voice recordings: audio you record for dictation, instructions, or profile setup.
Writing Profile: facts, preferences, and writing style that you enter or create through Manual Profile Setup or Quick Profile Setup. You have one local Writing Profile across the apps where you use Moogoose.
Quick Profile information: your setup conversation, information you approve for a public search, possible business matches, public findings and sources, proposed profile changes, and your review choices.
AI requests and results: your instructions, the relevant context sent to the AI service, transcriptions, summaries, explanations, and draft replies.
Account and security information: the Google account you choose, account identifiers and profile information received by Firebase Authentication, and information used to check the app and device. Google can also process IP addresses and information about the software making a request.
Credits and purchases: your balance, credit grants and use, purchase details and verification references, charges, refunds, payment reversals, and records needed for recovery, accounting, and fraud prevention. Moogoose does not receive or store your payment-card or bank details.
Settings: language, feature choices, and conversations or apps you have paused.
AI reports: a response you choose to report, your reason and optional note, the technical details shown before submission, and identifiers and records used to receive and review the report.
Diagnostic information: technical records that help explain faults. Some contain no message or profile content. Others can contain private content, as explained in section 11. Detailed diagnostic logging is off by default.

This information comes from you, your device, supported apps, your saved profile, your selected Google account, Google Play, public information returned by Perplexity, and results returned by Google Gemini.

4. Why We Use Information

We use information to:

provide the communication and accessibility features you request;
keep conversation context and personalise drafts;
sign you in, verify the app, and protect the service from misuse;
provide credits, verify purchases, charge for completed actions once, and show your balance and activity;
recover interrupted purchases, handle refunds and payment reversals, prevent fraud, and meet accounting and legal duties;
provide spoken summaries using Android's on-device speech engine;
diagnose faults and provide support; and
review AI responses you report for safety, quality, and possible further action.

Cloud features send requests through Moogoose's protected service. It checks the signed-in account and app before contacting Google Gemini or, for the public research described in section 7, Perplexity Sonar. Your local profile and conversation history are not backed up or synchronised to your Moogoose account. Relevant parts are sent when needed for an AI request.

Your Moogoose account provides access to cloud features and holds your credits and related server records. Your Writing Profile is stored on your device and tells Moogoose how to write for you. Changing the account selected in Gmail, a social app, or another app does not change either of these.

Reporting an AI response

When you select Report AI response, you can review the response, reason, optional note, app and prompt versions, output type, time, and report ID before sending it. The report does not automatically include conversation history, screen context, voice recordings, your Writing Profile, or diagnostic logs.

After you confirm, Moogoose stores the reviewed report against your signed-in account. It also stores a support reference, submission and review details, and information that prevents duplicate reports. Your sign-in email is not copied into the report. Each account can submit up to 20 new reports in a rolling 24-hour period. Retrying the same unchanged report does not create another copy.

Authorised support staff can access a selected report for review. Reports help us assess potentially harmful, offensive, inaccurate, or misleading output. Submission does not guarantee a personal reply.

A report becomes unavailable to support after 90 days and is then scheduled for deletion. Physical deletion can occur later. Account deletion removes reports sooner. Clear Logs removes any local diagnostic copy; it does not withdraw a submitted report. See section 14 if you need help with a report or a data request.

Google sign-in is requested before your first cloud feature. You can use manual profile setup and inspect local app settings without signing in.

When you choose Continue with Google, Google and Firebase Authentication process the selected account. Firebase creates an account identifier and can retain your email address, name, and other profile information provided by Google. We use this for authentication, account management, security, and misuse prevention, not advertising.

Google's Firebase App Check and Play Integrity services check that requests come from a legitimate app installation. Moogoose does not use the Android advertising ID for these checks.

Moogoose keeps a small server account record with an account identifier, sign-in provider, creation and last-use times, record version, and account status. It does not copy your name, email, photo, Writing Profile, conversations, audio, or AI content into that record.

Our service normally holds AI request content only while processing the request. It does not save ordinary audio, screen content, instructions, or profiles to its database or application logs. The specific exceptions are submitted AI reports and the short-lived encrypted Quick Profile recovery copy described in section 7. Technical request records do not contain your message or profile content. Sections 11 and 12 explain these records and their retention.

Firebase processes authentication information in the United States. Google states that authentication IP addresses are normally kept for a few weeks, and deleted account information can take up to 180 days to leave its live and backup systems. Firebase App Check does not itself retain the information submitted for app verification. Its verification tokens currently last one hour. Google's underlying Play Integrity service follows Google's terms.

Account deletion is explained in section 12. Deleting a Moogoose account does not delete your Google Account.

6. Screen Content, Voice, and AI Processing

When Context Reader is enabled, Moogoose uses Android's accessibility service to read visible text in the current app. This can include text you are editing. It skips fields marked as passwords and content that Android 14 or later marks as accessibility-sensitive, including content within those protected areas. This protection depends on how Android and the other app identify those fields.

Context Reader is required to complete full Moogoose setup. You can decline its disclosure or turn it off in Android settings. Declining sends no screen content and leaves setup incomplete. Turning it off later shows Action needed. Dictate still works without screen context. Other AI features can use your instruction, profile, and previously stored context, but cannot read the current screen.

Moogoose checks that captured content belongs to the current app. It limits how much it reads and discards a capture if it cannot complete it safely.

Recognised conversations can be saved in the app's private storage to keep context between uses. Other screens are not saved as conversation history. For most of them, Moogoose uses only the latest readable text in memory. In Outlook, it also keeps in memory the emails it has read in the conversation you have open, so it can find the email you are replying to when Outlook hides it. It forgets those emails when you leave Outlook, pause Outlook, sign out, change account, or clear all data. Optional detailed diagnostics can separately record screen content.

The keyboard's eye control shows whether screen context is available. You can pause a recognised conversation or an app. Pausing a conversation deletes its stored context. Pausing an app clears its current screen context and stops further reading there until you resume. You can also use Clear Conversation History or turn off Context Reader.

Screen content is not sent to an AI provider just because Context Reader is enabled. When you request an AI feature, the relevant instruction, screen or conversation context, profile information, and audio are sent through our protected service to Google Gemini over an encrypted connection. Dictate sends voice audio without screen context or profile information. Results return to your device for review. A service failure does not cause the app to bypass Moogoose and send the request directly to the provider.

Voice recordings use temporary files. These are deleted after processing succeeds or fails, or if recording is cancelled, too short, or fails to start. An unsubmitted recording is also cancelled and deleted if its text field, keyboard session, or signed-in account changes or ends.

Quick Profile can keep a submitted recording privately for up to 30 minutes from first submission to recover an interrupted call. It deletes the recording sooner when the call finishes, is cancelled, or its session or local data is removed. If the app is closed when the recording expires, deletion happens at the next app start or Quick Profile entry. Voice-audio bytes are not included in diagnostic exports.

If a result arrives after its original text field changes, Moogoose does not insert it into a different field. It can keep up to three such results in memory for the same signed-in account. Only Copy previous result puts one on Android's clipboard. Signing out, changing account, clearing all data, a newer result replacing it, or the keyboard service ending removes the in-memory copy. A copy you put on the clipboard remains subject to your device's clipboard controls.

Speaking a summary uses Android's on-device speech engine. That speech step does not send the text to Moogoose or Google. A summary does not reproduce every word of the draft; review the actual written text before sending.

7. Quick Profile and Public Research

Quick Profile sends your guided conversation, relevant profile information, and setup progress to Google Gemini to help prepare your Writing Profile. It uses Perplexity Sonar for separate public business checks and research. Gemini does not search the web directly in this flow.

Before private details are sent to Perplexity, the app shows you the exact details, the purpose, and the recipient. Your approval applies to one check and expires after 30 minutes. Choosing Do not send these details sends none of the listed details to Perplexity. An approved check sends those details and the public context needed for that check. It does not send your full interview, unrelated private profile information, or other unapproved private records. A later check needs fresh approval to send private details again.

Perplexity can return possible business matches, public findings, source links, and supporting information. You select or decline a proposed business match. Gemini receives the research results to guide the remaining setup and propose profile information. A search result is not automatically treated as an accepted profile fact.

To recover an interrupted Quick Profile request, our service stores an encrypted copy of the completed response for that same account and request. This can include AI text, public findings, business matches, source links, charge records, and detailed diagnostic information if you enabled it for the call. Both successful and failed responses can be stored. The copy cannot be retrieved after 30 minutes and is then scheduled for deletion; physical deletion can occur later. It is not copied into ordinary service logs or diagnostic exports. Recovering it does not make another provider call or charge you twice. Account deletion removes it sooner.

Unfinished setup is saved in private device storage so you can return to it. It includes your conversation, approved disclosures, research, sources, progress, and pending profile choices. After 30 days without Quick Profile activity, it expires and is deleted when the app next starts or you enter Quick Profile. Completing setup saves the smaller profile-review record and removes the full setup session. You can also remove an unfinished session by confirming a fresh start, clearing all data, deleting your account, or uninstalling.

Reviewing profile suggestions

After setup, Review profile suggestions shows proposed changes and available sources. It stores the previous and proposed values, source and retrieval details, your decisions, and whether a suggestion is already in use.

Facts you supply can be used provisionally before review. Basic business names, services, or products found on an official website can also fill an empty field or add information safely. They cannot replace a fact you supplied without review. Findings from other websites, and researched prices, hours, policies, qualifications, contact details, uncertain findings, or conflicts remain inactive until you accept or edit them.

You can accept, edit, or reject each suggestion. Rejecting one already in use restores its earlier value unless you have since changed that field yourself. In that case, Moogoose shows a conflict instead of overwriting your change. The review record is removed when all choices are applied, or when you clear all data or uninstall. The resulting profile stays on your device and is used in relevant AI requests.

You can continue setup using your own information if research is declined, skipped, cancelled, unavailable, or finds no suitable match.

8. AI Providers and International Processing

Google Gemini

Moogoose uses Google's paid Gemini service for its AI features. Under Google's Paid Services terms, Google does not use your AI requests or responses to improve its products. Google may retain requests and responses for a limited period to detect misuse, protect the service, or meet legal and regulatory duties.

Moogoose has disabled Google's optional project logging feature that can store complete AI requests and responses. This does not remove Google's separate security and legal retention. Quick Profile does not use Google's Search Grounding or URL Context tools.

Perplexity Sonar

Perplexity provides the public research described in section 7. It states that Sonar API request and response content is not retained by default and is not used for model training. It can retain technical and billing information such as model, usage, time, duration, and the identifier for Moogoose's provider access. Perplexity states that its API computing services are hosted through Amazon Web Services in North America.

Where information is processed

Your information may be processed outside the country where you live. Firebase Authentication processes information in the United States. Google may process or temporarily store AI information in countries where it or its service providers operate. Perplexity's processing is described above.

The providers' data-processing agreements describe their security responsibilities and safeguards for international transfers. Contact us if you need more information about the safeguards applicable to your information.

9. Legal Reasons for Using Information

Where UK data protection law applies, we rely on the following grounds, depending on the purpose:

Providing our contract with you: information needed to provide the AI features, credit account, and purchases you request.
Legitimate interests: proportionate security, service reliability, fraud and duplicate prevention, purchase recovery, support, and diagnostic records needed to keep the service working. We limit the records, restrict access, and apply the retention periods below.
Consent: optional detailed diagnostic logging. You can turn it off at any time. Turning it off stops new detailed records. Use Clear Logs or Clear All Data to delete existing local records. A server recovery copy already created follows its separate 30-minute access limit.
Legal obligations: financial, tax, accounting, dispute, and other records we must keep or disclose by law.

Information about health, disability, and other sensitive matters may appear in the content you ask Moogoose to process. We use that content for the requested feature, not to target advertising or infer a diagnosis. Applicable law may give this information additional protection. Section 14 explains how to ask about its use or exercise your rights.

These grounds describe our UK obligations. They do not limit consent requirements or other protections that apply under the laws of your country, state, or province.

10. Credits, Purchases, and Financial Records

Google Play handles payment and shows the product and price in your local currency before you buy. Moogoose receives purchase information and a verification token, but not your card or bank details. We use this information to deliver credits once, recover interrupted purchases, and process refunds and payment reversals.

Your account records include your balance, welcome and promotional credits, purchased credits, amounts reserved for actions in progress, and completed credit activity. We also record AI usage and pricing needed to calculate and check charges. These records support accounting, fraud prevention, and customer support. You see one available balance in Account & Credits.

Failed actions, cancellations before completion, safety blocks, and unusable actions do not use credits. If an action completes successfully on our service but your phone loses the response, it is charged once. Where recovery is available, retrieving that result does not create another charge.

If credits have not been delivered, Moogoose does not mark the purchase as used and does not retain its purchase token. If credits have been delivered but the final Google Play confirmation is incomplete, we keep the token encrypted until that confirmation finishes, then remove it. Payment tokens and account identifiers are not included in operational logs or diagnostic exports.

While your Moogoose account exists, a protected identifier derived from your Google sign-in records whether that account has received its welcome offer. It prevents duplicate grants during that account's lifetime. It is removed when you delete the account and is not used for advertising or profiling.

Limited purchase, refund, payment-reversal, accounting, and fraud records can remain after account deletion. We remove your Firebase account identifier and Play account identifier from these retained records. They use coded references instead of your email, profile, messages, screen content, or audio. They become eligible for automatic deletion seven calendar years after the relevant financial event. Coded records are not necessarily anonymous. Section 12 explains deletion and recovery copies.

11. Diagnostics and Support Files

Diagnostics help us understand faults. The app does not automatically upload its diagnostic files.

Basic technical records

Moogoose keeps a limited local timeline of setup, permissions, operations, timings, outcomes, and technical failures. It uses random request references to connect a phone fault with the corresponding service request. It does not contain messages, profile content, instructions, AI responses, sign-in details, credentials, or raw provider error text. Its two rolling files hold approximately 8 MB in total.

When you prepare a support file, the app also records technical details such as app and Android versions, device model, language, time zone, display size, installation source, permission settings, whether you are signed in, and the service configuration in use. This does not include a hardware identifier, network name, or Google account details.

Moogoose's entries in Android's temporary system log also use technical values without user content. Android can add its own crash information. These logs are not uploaded automatically.

Records that can contain private content

The app keeps a limited in-memory Session Journal and Merge Trace to explain the current interaction and how conversation context was assembled. They can contain screen text, instructions, AI requests and responses, and message excerpts even when detailed logging is off. Merge Trace keeps up to 500 entries of up to 2,000 characters each.

Detailed diagnostic logging is off by default. You can enable it in Advanced Diagnostics after reading its warning. While enabled, it can save screen captures as text, messages, profile information, instructions, AI requests and responses, public research, report content and notes, and technical crash locations. Password fields and areas marked by Android as accessibility-sensitive are excluded from screen captures.

Detailed logs do not retain voice-audio bytes, authentication credentials, account identifiers, email addresses copied from sign-in, unrestricted crash reports, or private file paths. Names and email addresses can still appear if they are part of a message, profile, page, or AI request being diagnosed.

New detailed files use private device storage excluded from backup and device transfer. They share a rolling 10 MB limit, with each screen-text capture limited to 1 MB. Older diagnostic cache files can remain available until you clear them or Android removes them. The update that adds sensitive-field protection removes older screen captures and prepared complete exports once, while keeping other diagnostic records.

Turning logging off stops new detailed records but does not delete existing files. Clear Logs removes both diagnostic layers, older files, prepared exports, and the Android log buffer where available. It does not delete an already-created server recovery copy or copies you have shared elsewhere.

Prepare Content-Free Summary creates a file containing only the basic timeline and technical device and service details. It does not read private content, detailed captures, the Session Journal, Merge Trace, or Android's system log.

Prepare Complete Diagnostic Review creates a file containing both the basic records and all retained contextual diagnostic sections, including relevant Android log entries. It can contain private information. You can review it before sharing. Sharing sends the whole file, including pages you did not open. The review screen blocks screenshots and recent-app previews.

Nothing is shared until you confirm the chosen share action and select a destination. The recipient then controls that copy under its own terms. Clear Logs cannot remove a copy already shared.

Technical records on our service

Our service keeps account-linked request records to prevent duplicates, measure AI use, recover interrupted work, and diagnose failures. They contain identifiers, operation and status, request size, model, usage and cost, timings, retry counts, and fixed error categories. Public-research records can also contain result counts. Quick Profile keeps related progress and action-control records. These records do not contain your conversation, profile, audio, instructions, AI response, business clues, or source URLs. The separate encrypted recovery copy in section 7 can contain content.

Service logs record request references, technical stages, timing, and outcomes without deliberately including your account identifier, email, user content, or credentials. Google's hosting service can also record normal network information, such as an IP address and the software making the request. These records are used for service operation, security, fraud prevention, usage measurement, and diagnosis, not advertising.

12. How Long We Keep Information and How to Delete It

For records scheduled for automatic server deletion, the stated access limit can end before physical removal finishes. Restricted recovery history can also retain an earlier copy for the separate period below.

Information	Retention and deletion
Moogoose sign-in and account records	Kept while your account exists. Delete Moogoose Account starts server deletion. Google's authentication-system deletion timing is explained in section 5.
Current credit balance and activity	Kept while your account exists. Account deletion permanently removes all unused credits, current credit records, reservations, and account-linked credit activity.
Purchase verification and recovery	Purchase details support fulfilment, refunds, and financial records. An encrypted purchase token is kept only while a delivered purchase needs its final Google Play confirmation.
Welcome-offer eligibility	Kept while your account exists and deleted with it. Reinstalling or updating the app does not remove this record.
Limited financial records	Coded purchase, refund, payment-reversal, accounting, and fraud records become eligible for automatic deletion seven calendar years after the financial event. See section 10.
AI and public-research request records	Pending records expire after ten minutes. Completed or failed records expire after seven days. They contain technical information, not request or response content. Account deletion removes them sooner.
Quick Profile progress and action-control records on our service	Technical records without conversation or profile content expire after seven days. Account deletion removes them sooner.
Encrypted Quick Profile recovery result	Available only to recover the same request for up to 30 minutes, then scheduled for deletion. Account deletion removes it sooner.
Submitted AI reports	Available to authorised support for 90 days, then scheduled for deletion. Account deletion removes reports and their submission-count records sooner.
Temporary account-deletion records	Account references and deletion progress are kept only while needed to finish or safely review deletion, then removed.
Saved conversations	Six months of inactivity by default on new installations. You can choose 90 days or 30 days. Updates preserve your saved limit. Existing users without a saved choice keep six months until they choose. A shorter limit deletes older history after confirmation. Clear Conversation History or Clear All Data removes it sooner. Clear All Data restores the six-month default.
Voice recordings	Normally deleted when processing or recording ends. Submitted Quick Profile audio can remain usable for interrupted-call recovery for up to 30 minutes. Expired audio is deleted when the app next starts or Quick Profile opens. Completion, cancellation, session removal, clearing all data, account deletion, or uninstall removes it sooner.
Results waiting for you to copy	Up to three results in keyboard memory. Removed after copying, replacement by newer results, account change, clearing all data, or the keyboard service ending. Clipboard copies follow Android's controls.
Writing Profile	Stored locally until Clear All Data, accepted in-app account deletion, or uninstall. You can edit its information in the app.
Unfinished Quick Profile setup	Expires after 30 days without Quick Profile activity and is deleted at the next app start or Quick Profile entry. Completion removes the full session after saving the review record. Confirming a fresh start, clearing all data, account deletion, or uninstall removes it sooner.
Profile suggestions awaiting review	Kept locally until all review choices are applied, Clear All Data, accepted in-app account deletion, or uninstall. Accepted and provisionally active facts also form part of your Writing Profile.
Local diagnostics	Limited by the storage bounds in section 11. Clear Logs, Clear All Data, accepted in-app account deletion, or uninstall removes them. Turning detailed logging off alone does not delete them.
Prepared support files	Kept in private temporary storage until Clear Logs, Clear All Data, accepted in-app account deletion, uninstall, or Android clears that storage. Shared copies are controlled by their recipients.
Service and hosting logs	Ordinary service and request logs are retained for 30 days. Google's required administrative and system audit records are retained for 400 days.
Restricted database recovery history	Earlier versions of changed or deleted records can remain for up to seven days for disaster recovery. This history expires automatically and is not used for ordinary account access, AI processing, marketing, or support. Deleted accounts and expired records are excluded before recovered data returns to active use.

Clearing data on your device

Clear All Data removes your local profile, conversations, settings, paused-conversation choices, setup information, diagnostics, prepared support files, and temporary audio. It does not delete your server account, credits, Google Play purchases, or Google Account. Uninstalling also removes app-owned local data, but does not request server-account deletion.

Moogoose app data is excluded from Android cloud backup and device-to-device transfer.

Deleting your Moogoose account

Use Delete Moogoose Account in the app, or request deletion through hello@moogoose.com. See Delete your Moogoose account for instructions and verification.

When our service accepts an in-app request, it disables the account. The app clears its local data and signs out. Server deletion continues even if you close or uninstall the app. If the request is not accepted, the app does not assume deletion has started or clear local data as though it had succeeded.

Deletion removes your account, reports, request records, welcome-offer eligibility, and current credit records. All unused credits are permanently deleted. Checks needed to finish deletion safely can delay completion. Temporary account references prevent the account being recreated during this process and are removed when deletion completes.

Deletion does not delete your Google Account, cancel or refund a Google Play purchase, or remove statutory refund rights. Limited financial records, restricted recovery history, and Google's own retention follow the periods described above. An email request cannot directly erase files held only on your device; use the app's local controls or uninstall to remove them.

13. Advertising and Tracking

Moogoose does not use advertising or tracking software, product-usage analytics software, Firebase Analytics, or an automatic crash-reporting service. It does not automatically upload Android diagnostic files. The account, payment, security, and technical service records described in this policy support the service and are not used for advertising.

14. Your Rights and Complaints

Depending on the law where you live and the circumstances, you may have rights to access or receive a copy of your information, correct it, request deletion, restrict or object to its use, or transfer it to another service. Where we rely on consent, you can withdraw it. Legal exceptions can apply.

You can view, change, or delete much of your app information on your device. For a request or complaint, contact hello@moogoose.com. We may ask for enough information to verify your identity and understand the request. We will respond within the period required by applicable law.

You may also contact the relevant authority. Its jurisdiction and complaint rules determine which matters it can handle:

United Kingdom: Information Commissioner's Office.
United States: privacy rights vary by state and applicable law. Your state attorney general may handle privacy complaints. You can also report suspected unfair or deceptive practices to the Federal Trade Commission. The FTC does not resolve individual complaints.
Canada: Office of the Privacy Commissioner of Canada, or the relevant provincial privacy authority where provincial law applies.
Australia: Office of the Australian Information Commissioner, where the Privacy Act applies.
New Zealand: Office of the Privacy Commissioner.

Elsewhere, you may contact the relevant privacy or data protection authority where you live, where applicable.

These routes do not limit other rights or remedies available under local law.

15. Adults Only

Moogoose is intended only for people aged 18 and over. We do not knowingly provide the app to children.

16. Security

Connections to our service and AI providers are encrypted in transit. Local information is held in the app's private Android storage and protected by your device's security. Access to server records is restricted. No system is completely secure. Use your device's lock and other access controls, and enable detailed logging only when needed.

17. Changes to This Policy

We will update the date when this policy changes. Where required, we will tell you about material changes before new processing begins and ask for consent rather than relying on continued use alone.

18. Contact

Moogoose Limited
Company number: 17333615
Registered office: 75 Charlton Close, Bournemouth, BH9 3PS, United Kingdom
Email: hello@moogoose.com
Website: moogoose.com