Privacy Policy for Moyogi

Effective date: 1 November 2026 (draft updated 29 October 2026: why we ask for location, and what happens to it)

Overview

Moyogi ("we", "our", "the app") is a bonsai journal, mentor and calendar. This policy explains what the app collects, why, and where it lives. Location once for climate; photos you choose to have read go through moyogi.app to Anthropic, which keeps them for a limited time (below). moyogi.app keeps no photos.

What we collect, and why

Location — once, for climate

Why we need it. Bonsai care depends on your climate. When you set your climate in onboarding or Settings and tap Continue, Moyogi asks iOS for your location once, while the app is open, to work out your hardiness zone and average frost dates. Those drive when to water, repot, feed, protect from frost and bring trees in, and the weather alerts that change the plan.

What happens to it. The coordinates and place name are stored on your device (and in your own iCloud, if sync is on) — never on a server of ours. We do not use it for advertising, tracking or analytics, do not sell it, and do not share it with anyone else. The one exception is Apple Weather (WeatherKit), which receives the stored place to return your forecast (see below). Moyogi does not read your location in the background.

Your choice. Location is optional. You can type your city or set the zone yourself instead of sharing a location, and the app works the same. If you decline the iOS prompt, nothing else is blocked. You can change or clear the place at any time in Settings, and revoke the permission in iOS Settings → Privacy & Security → Location Services → Moyogi.

Photos — yours, sent only for a reading, after you agree

Every photo you take stays on your device (and in your own iCloud, if sync is on). Before the first photo ever leaves the device, Moyogi asks once whether it may send photos to Anthropic for these readings; until you agree, nothing is sent. A photo then leaves the device only for one of four readings:

Identifying a tree or checking its health: up to three photos, resized, to suggest the species and estimate age, pot, height, soil, style and visible health signs.
Reading the trunk on the shaping canvas, to fit the proposed silhouette to the tree.
Suggesting branch work (remove, wire, develop), shown dashed until you accept a mark.
Estimating measurements (trunk, height, nebari, crown), using the pot as the scale.

Each reading sends the resized photo, with its location and other metadata removed, to moyogi.app, which passes it to Anthropic's Claude model and returns the answer. moyogi.app does not store the photo or the answer. Anthropic, as our processor, keeps the request and the answer for up to 30 days to run the service and keep it safe, then deletes them; material its safety systems flag can be kept for up to 2 years. Anthropic does not use them to train its models. The answers are saved only on your phone (and in your iCloud).

Photos are never sent anywhere else, and never used for any purpose but the reading you asked for.

What moyogi.app keeps for photo readings

To make sure only the real Moyogi app uses the service, each install proves itself with Apple's App Attest. moyogi.app keeps that install's App Attest key identifier and public key, and a count of readings per day (to stop abuse); the daily counts are deleted after 90 days. None of this is linked to you, your Apple ID or your trees, and no photo, estimate or location is kept.

Your trees, journal and photos — in your own iCloud, private to you

Moyogi's whole record — trees, care plans, journal entries, photos, measurements, wire records — lives in Core Data, synced through NSPersistentCloudKitContainer to your own private iCloud database if you choose to sync. We cannot see it: the only server of ours is the one that passes photos to the model and keeps nothing of them, and there is no account to sign into. Turning sync off keeps everything on this phone only.

Weather

Forecasts and frost/heat alerts come from Apple WeatherKit, using the location you set for climate. This is between your device and Apple; we do not see or store the forecast.

Purchases

Moyogi Pro (yearly with a 7-day trial, or lifetime) is sold and processed entirely by Apple through the App Store. We receive only whether your account is Pro — no payment details ever reach us, because they never reach an app of ours at all.

What we do not do

No analytics, no tracking, no advertising, and no third-party SDK that collects anything. The app bundles one open-source library, Lottie, which only draws an animation and sends nothing. The services the app talks to are moyogi.app (and, through it, Anthropic) and Apple's own (WeatherKit, CloudKit, StoreKit, App Attest).
No account, no sign-in, no email collected by the app itself.
No store of your data on a server of ours. Your data's only home outside this phone is your own iCloud account.

Your choices

Sync: Settings → Data and privacy → iCloud sync. Off keeps everything local only.
Location: set a zone yourself in onboarding or Settings instead of sharing coordinates.
Identification: the species picker works entirely offline; reading a photo is optional, and every estimate it fills in can be changed.
Export: Settings → Data and privacy → export your whole record as CSV or a ZIP (photos, JSON, CSV) at any time, before doing anything else with it.
Delete: Settings → Data and privacy → delete everything, on this phone and in iCloud. Deleting removes the data from this phone and from your iCloud; it never touches anything on a server of ours, because there is not one holding your data.

The website

moyogi.app uses Vercel Web Analytics to count page views. It works without cookies and without storing personal data or IP addresses; we use it only to see which pages on the website are read. Like any website, the servers that deliver moyogi.app (Vercel and Cloudflare) see your IP address with each request and keep it in short-lived logs for operation and security.

Who processes data for us

Anthropic reads the photos you send for a reading (see above).
Vercel hosts moyogi.app and the photo-reading service.
Cloudflare delivers moyogi.app and protects it from abuse.
Neon stores the App Attest keys and the daily reading counts.
Apple provides weather, iCloud sync, purchases and App Attest under its own privacy policy.

Some of these companies process data in the United States. Where that happens, the transfer relies on the safeguards they offer, such as the European Commission's Standard Contractual Clauses.

Why we may use it (EU and UK)

Photo readings and location: your consent, which you can withdraw at any time (Settings → Data and privacy → Photo readings; or set a zone yourself instead of sharing a location).
App Attest keys, daily counts and server logs: our legitimate interest in keeping the service secure and free from abuse.
Purchases: handled by Apple to perform your contract with it.

How long it is kept

Photos and answers at Anthropic: up to 30 days (longer only if its safety systems flag them).
Daily reading counts on moyogi.app: 90 days. App Attest keys: as long as the install uses them.
Server logs at Vercel and Cloudflare: a few days.
Everything else lives on your phone and in your iCloud until you delete it.

Your rights

You can ask to access, correct or delete personal data, to restrict or object to its use, and to receive it in a portable form. Almost everything is already in your hands: export it or delete it in Settings → Data and privacy. For the little moyogi.app keeps, write to the address below. You can also complain to your data protection authority.

Children's privacy

Moyogi does not knowingly collect data from children under 13 and is not directed at children.

Changes to this policy

We may update this policy as the app changes. Updates are noted with a new effective date above.

Contact

Questions about this policy: [email protected]