Who is responsible
Julien El-Bahy
Badstraße 19/3
2340 Mödling
Österreich
What this is about
moj is a family planner. What you send it lands sorted in your shared space: shopping, tasks, appointments, receipts, ideas, people and goals. That data belongs to your family, not to us. A family can be several households, say parents and grandparents; what one household adds, the others see only when it is meant for everyone.
What we process
- Account: your email address and display name. Signing in uses a code of 6 digits sent by email; there is no password.
- Content: everything you write, say, photograph, share from another app, forward by email or have providers send to the moj address you keep for bills, and what moj makes of it.
- Files: photos, PDFs and voice messages you send.
- People in your family: name, relation, birthday and clothing sizes, as far as you enter them.
- Subscribed calendars: the address you enter, such as the nursery’s calendar, and the dates moj fetches from it every few hours.
- Contacts: only if you take birthdays over from your address book, and then only the name and birthday of the contacts you pick. Otherwise the address book stays unread, and it is never uploaded.
- Technical: device identifiers for notifications and, if you link it, your WhatsApp number.
About a child without an account of their own, moj stores only what you enter. A child with an account gets onto its phone with a code from you, without an email address. Otherwise the same applies to that account as to yours.
Where the data sits
- The database is with Neon in Frankfurt, stored encrypted.
- Files are in private Cloudflare R2 storage bound to the EU, reachable only through short-lived signed links.
- The application logic runs on Cloudflare at the nearest location. Your content, your files and your accounts sit in the EU. What leaves it is the sending of our emails; who delivers them is below.
Who else is involved
- OpenAI understands your messages, reads receipts and turns speech into text. So that a message can be understood at all, a short context travels with it: the people in your family, your lists, the names of your appointment categories and subscribed calendars, your open entries and the sender’s last few messages. OpenAI is a processor under contract, the request is not stored there, and it is not used for training.
- Meta carries messages if you link WhatsApp. Without that link Meta is not involved.
- Expo, Apple and Google deliver notifications. Those carry the family name and one line with a title and a time, so they can be read on a lock screen. Amounts, notes and attachments are never part of them.
- Resend delivers our emails: the sign-in code, the confirmation and the launch mail for the waitlist, the reply to a piece of feedback and the contact form. Resend sees the recipient address and the content of those mails. Its own documentation, checked on 12 September 2026, says that metadata, logs and API records are stored in the United States. That holds whichever region a mail is sent from.
- Neon and Cloudflare run the database, the storage and the application logic.
What we do not do
moj has no analytics services, no usage tracking and no error reports to third parties. There is no advertising, and your data is neither sold nor passed on.
Numbers and feedback
Once a week moj counts how many families there are and how many messages arrived, and sends us those sums. They contain no names and no content, and no profile comes out of them. If you start a message with "Feedback:", it does not land in your family space but comes to us as an email, together with the email address of your account, so we can reply. The same goes for the contact form on this site: what you write there becomes an email to us, with your address as the way back. Nothing is stored in the process, and no account is needed.
Waitlist
On heymoj.app you can leave an email address so we can tell you when moj is out. The form itself stores nothing: a mail with a confirmation link goes to the address, and only the click on that link creates an entry. What is then stored is the address, the language of the page, the page the signup came from and the date. The page that link opens also asks whether you carry an iPhone or an Android device; if you answer, that is stored too. Anybody who never clicks the link is recorded nowhere. After that we write exactly once, at launch. Every one of those mails carries an unsubscribe link, and one click on it deletes the entry at once and completely. The basis is your consent, which you can withdraw that way at any time. These addresses go to nobody else and are used for nothing else.
How long
As long as you use moj. If you delete your account or your family, the data is made unreadable at once and deleted for good after 30 days. That period exists so a deletion by mistake can be taken back. An entry on the waitlist stays until you unsubscribe; once the app is out we delete the list, because it then has nothing left to do.
Your rights
You can ask what we hold, have it corrected, have it deleted or take it with you, at any time. The app carries two exports for exactly this — one for your account across every family space, one for the single space — and the deletion of your account. For anything else, write to us.
If you believe we handle your data wrongly, you can complain to a data protection authority. For moj that is the Austrian Data Protection Authority in Vienna, because that is where we are.