Privacy Policy

Mochi Privacy Policy

Last updated: September 23, 2026

This policy explains what data the Mochi app (iOS and Android) collects, why, who we share it with, and what your rights are. It supplements our Terms and Conditions.

1. Data controller

The data controller is Thomas Janski, a French sole trader (entrepreneur individuel) trading as MOSAIK.

For any question or request about your data, write to agency.mosaik@gmail.com. We are not required to appoint a Data Protection Officer (DPO); this contact handles your requests directly.

2. Data we collect

Account data (provided by you, or by Apple, Google, or via email and password): email address, display name, profile photo URL, phone number if the sign-in provider shares it, user ID, account creation date.

Onboarding data (provided by you): nickname, selected goals, breathing test score. The test score is stored on your device.

Onboarding answers (provided by you): the statements you select (for example “I stress a lot”, “I sleep badly”, “I feel lonely”) and, if you choose, free text describing your struggles and goals. These answers may reveal information about your health, including your mental health (see section 5).

Personalized program (AI-generated): the program's themes, reasons and summary, stored on your account.

App activity (generated by your use): history of meditations, audio sessions and breathing exercises, favorites, preferred voice, level, experience points (XP), streaks, progress through chapters.

Virtual items: coin balance, cosmetic items owned and equipped.

Usage data (collected automatically): app sessions, screens visited, session progress, pauses, skips and durations, mood rating after a session, in-app events.

Device state (collected automatically): notification permission status, whether the home-screen widget is installed, app version, device type.

Push notification token: a Firebase Cloud Messaging identifier used to send notifications to your device.

Subscription (provided by Apple, Google and RevenueCat): subscription status, product purchased, purchase, trial and renewal dates. We never receive your payment card details.

Technical data (collected automatically): IP address, device identifiers (identifier for vendor, IDFV, on iOS; Android Advertising ID only with your consent), app performance data. We do not use Apple's advertising identifier (IDFA).

Offline files: audio you download stays on your device and is not sent back to us.

Mochi does not access your location, camera or contacts.

3. Why we use your data and our legal basis

Purpose

Legal basis (GDPR)

Create and manage your account, provide the service

Performance of a contract (Art. 6(1)(b))

Generate your personalized program with AI from your onboarding answers

Explicit consent (Art. 9(2)(a))

Store your progress, history, favorites and cosmetic items

Performance of a contract (Art. 6(1)(b))

Manage your subscription and restore purchases

Performance of a contract (Art. 6(1)(b))

Send notifications and reminders

Consent (Art. 6(1)(a)), given through your device permission and revocable in its settings

Measure app usage with Mixpanel to improve the app

Consent (Art. 6(1)(a)), requested in the app

Measure our advertising with TikTok

Consent (Art. 6(1)(a)) and, on iOS, App Tracking Transparency permission

Security, abuse prevention, performance monitoring

Legitimate interest (Art. 6(1)(f)) in protecting the service and its users

4. Who we share your data with

We do not sell your personal data. We share it only with the following providers, for the purposes described.

Provider

Role

Data involved

Location

Google Firebase / Google Cloud (Google Ireland Ltd, Google LLC)

Authentication, database, cloud functions, storage, push notifications, performance monitoring

Account, activity and usage data, push token, technical data

EU and United States

OpenAI (OpenAI Ireland Ltd, OpenAI OpCo LLC)

Generating the personalized program

Selected statements, free text, goals, nickname

United States

RevenueCat, Inc.

Subscription management

User ID, purchase status and history

United States

Apple and Google

Sign-in, payments, app distribution

Data needed for sign-in and purchases, under their own policies

EU and United States

Mixpanel, Inc.

Product analytics, with your consent

Anonymous usage events (funnel steps), no email or name

United States

TikTok (TikTok Technology Ltd, Ireland)

Advertising measurement, with your consent

Install and usage events, device identifiers, IP address

Norway, Ireland, United States, with possible remote access from other countries of the TikTok group

OpenAI. Your answers are sent through OpenAI's API with storage disabled. OpenAI does not use API data to train its models. It may keep requests for up to 30 days to monitor abuse, then deletes them.

TikTok. Without your consent, no data is sent to TikTok. For advertising measurement, TikTok may act as a separate controller, in which case its own privacy policy applies.

We may also disclose data where required by law or at the request of a competent authority.

5. Sensitive data (health)

The statements you choose during onboarding and your free text may reveal information about your physical or mental health (stress, sleep, loneliness, anxiety, etc.). The GDPR treats this as sensitive data.

Age. To give this consent yourself, you must be at least 15 if you live in France, 16 in Germany, or the age set by the law of your country. If you are younger, ask a parent or guardian for permission before confirming. We do not verify your age.

6. AI personalization

The AI-generated program is only a content recommendation. It has no legal effect and does not similarly significantly affect you within the meaning of Article 22 GDPR. You can ignore the program and freely access the rest of the app's content.

7. Transfers outside the European Union

Some providers process your data outside the EU, mainly in the United States. These transfers rely on the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses. You can request a copy of these safeguards by writing to us.

8. Retention

Data

Retention

Account data, program, progress, virtual items

While the account exists; deleted when the account is deleted

Usage and session tracking data

400 days, then deleted automatically

Backups

Purged within 30 days

Data on the device (test score, offline files, preferences)

Until you log out or uninstall the app

Requests held by OpenAI

Up to 30 days

Purchase data held by Apple, Google and RevenueCat follows their own legal obligations, including accounting rules.

9. Your rights

You have the right to access, rectify, erase, restrict, port and object to the processing of your data, to withdraw your consent at any time, and, under French law, to set instructions for your data after your death.

Uninstalling the app does not delete your account. To cancel your subscription, use your App Store or Google Play settings.

If you believe your rights have not been respected, you can lodge a complaint with the CNIL (www.cnil.fr) or with the data protection authority of your country of residence.

10. Children

Mochi is intended for people aged 13 and over. If you are under 18, use the app with the permission of a parent or guardian. AI personalization requires parental consent under 15 (France) or 16 (Germany). We do not verify age, but if we learn that an account belongs to a child under 13, we delete it. A parent can contact us at agency.mosaik@gmail.com.

11. Advertising tracking and App Tracking Transparency

We do not use Apple's advertising identifier (IDFA). On iOS, data is only shared with TikTok for advertising measurement if you allow tracking in Apple's App Tracking Transparency prompt. You can change this at any time in Settings, Privacy & Security, Tracking. On Android and in the EU, advertising measurement depends on your consent in the app. You can also reset or delete your advertising ID in your device settings.

12. Cookies and SDKs

The app does not use cookies. It includes the software development kits (SDKs) of the providers listed in section 4. The Mixpanel and TikTok SDKs only send data with your consent.

13. Security

No system is perfectly secure. If a data breach poses a risk to you, we will notify the CNIL and, where required, you, within the legal deadlines.

14. Changes

We may update this policy, for example when we add a feature or a provider. The date at the top shows the latest version. For significant changes, we will notify you in the app or by email before they take effect, and ask for your consent again where required.

15. Contact

Thomas Janski (MOSAIK), 20 Rue de Reiningue, 68800 Vieux-Thann, France — agency.mosaik@gmail.com