What Moonlight knows about you

Who this covers

This policy applies to the Moonlight iPhone app, published by Darryl Fong, who is responsible for the data described here. It is written in plain language on purpose; if something here is unclear, ask and it will be fixed rather than explained.

Your account

Moonlight needs an account. You can sign in with Apple, Google, or an email address and password. Accounts are run by Firebase Authentication, a Google service.

Your account holds your email address (with Sign in with Apple this can be a private relay address Apple creates for you), your name if Apple or Google provides one, an account ID, and which way you signed in. If you choose a password, Firebase stores it in a form no one can read back — including us.

What is backed up, and who can read it

Once you are signed in, Moonlight keeps a copy of the following in Cloud Firestore, Google's database, under your account:

• Your word bank — each word with its definition, example, part of speech, the book it came from, and its review schedule.
• A summary of your progress — your display name, streak, last quiz day, reading time and active days, and the book you are reading with its page count.
• Your friend list — the friend codes of the people you have added, so your circle comes back on a new phone.

This is private to your account. The database only lets a signed-in account read and write its own copy; other Moonlight users cannot see it. It exists so that nothing is lost if you lose your phone, delete the app, or move to a new iPhone.

To be straight about it: as the owner of Moonlight's Firebase project, I can technically view this data in the Firebase console. I don't look at it, except to investigate a problem you have reported and asked me to look into.

What your friends can see

The Social tab works through a small profile you publish when you first open it. It is the only part of Moonlight other people can read. It holds:

Always

Your display name and @username; your friend code; your streak; how many words you have saved, mastered, and saved this week; when the profile was last updated; and an internal account ID (a random string, not your email) that lets the database check the profile is yours.

If you share

Words you share with friends, one at a time, from the word itself: the word, its definition, part of speech and example. Stop sharing one and it is removed.

If you switch it on

The title of the book you are reading. Off unless you turn on Show what I'm reading on the Social tab.

Cheers

Which friend codes you have cheered, and when — so the friend can see your cheer. Kept for a week.

Any signed-in Moonlight user who has your friend code or knows your @username can read this profile. Usernames are unique, so anyone can look one up. The rest of your word bank is never part of it — not the words you haven't shared, not your review history, not your notes.

Your reading habits from sign-up (when you read, what you read on, what you like reading) are not published or backed up. They stay on your iPhone.

Reporting a definition

If a definition is wrong, the word card lets you report it. A report holds the word, the definition you were shown, the reason you picked, anything you chose to type, and the app version. It is anonymous: no account ID, name or email is attached, and it is not linked to your word bank. Reports are read only to fix the dictionary.

Inviting friends

Invite from Contacts uses iOS's own contact picker, which runs outside Moonlight. Moonlight never asks for access to your address book and never sees it. It only receives the contacts you pick, and uses their phone number or email address once, to address the invitation in Messages. It does not store them or upload them. You send the message yourself.

QR codes carry your friend code and nothing else. Scanning one happens on your iPhone; the camera image is not saved or sent.

Permissions, and what each one does

Microphone

Captures the word you say, so it can be looked up. Audio is not recorded to a file and not kept after the word is recognised.

Speech

Turns that audio into text using Apple's Speech framework. Moonlight asks for on-device recognition, so in normal use nothing leaves your iPhone. If on-device recognition is unavailable — an unsupported language or device — iOS may process the audio on Apple's servers instead, under Apple's privacy policy. Moonlight never sees or stores that audio either way.

Camera

Reads words off a page, and scans friends' QR codes. Both run on the device. The image is not saved and not sent anywhere.

Photos

Reads words from a picture you have already taken. Moonlight reads the one image you pick and nothing else in your library.

Notifications

The daily review reminder and the weekly recap, scheduled locally by your iPhone. No push server is involved.

Each permission is requested only when you first use the feature that needs it, and declining one leaves everything else working.

When Moonlight uses the network

Capture and review work with no connection at all, and so does the dictionary most of the time: a definition is answered from the WordNet data bundled inside the app before anything is asked of the internet. Something leaves your iPhone in these cases:

• Signing in, backup and friends — to Google's Firebase, as described above. Changes are saved on the phone first and sent when there is a connection.
• A word the bundled dictionary does not have. That one word is sent to Wiktionary, and then to dictionaryapi.dev if Wiktionary has no entry either. The word is all that is sent.
• An example sentence for a word you are reading, from Tatoeba. Again, just the word.
• Looking up a book. The title you type is sent to Open Library, and to Google Books if Open Library has no match, to get back a cover, author and page count. Only the search text is sent.
• Fetching a book cover image from Open Library, once you have chosen the book.

Dictionary and book services see the request the way any website sees a visit, including your IP address, and receive nothing about your account. Their own policies apply: Wikimedia, Internet Archive / Open Library, Google and Apple.

Looking up a word with Apple's built-in dictionaries hands the word to iOS, which resolves it from dictionaries already downloaded to your device. It does not go to Moonlight.

Who else is involved

Google

Runs Firebase Authentication, Cloud Firestore and Google Sign-In for Moonlight, and processes your account, backup and friends data on Moonlight's behalf under the Firebase data processing terms. Data may be stored and processed outside the UK.

Apple

Sign in with Apple, TestFlight and App Store crash reports (only if you have chosen to share analytics with developers in iOS Settings), and speech recognition when it cannot run on the device.

Moonlight contains no analytics, no advertising and no tracking: no Google Analytics or Firebase Analytics, no advertising identifier, no ad network. Nothing about you is sold or shared for advertising.

Getting your data out, and deleting it

Export: Profile → Export writes your whole word bank to a CSV file and hands it to the iOS share sheet. Where it goes from there is your choice.

Delete account: Profile → Settings → Delete account removes, in this order, your published friend profile and username, your backed-up words and progress, your account itself, and then everything Moonlight stored on your iPhone. It cannot be undone. If Firebase asks you to sign in again first (it does when your last sign-in was a while ago), do that and repeat.

Signing out keeps your words on the phone and leaves your account in place, so you can sign back in. Deleting the app removes what is on the phone but not your account; to remove that too, use Delete account first, or email me and I will delete it for you.

Data is kept for as long as your account exists, and removed from the live database as soon as you delete it.

Your rights

You can ask for a copy of what Moonlight holds about you, ask for it to be corrected or deleted, or object to how it is used, by emailing the address below. Account, backup and friends data is processed because it is needed to provide the features you sign up for. If you are in the UK or EU and are unhappy with a response, you can complain to the Information Commissioner's Office or your local data protection authority.

This website, and its launch list

This section is about moonlight.living, not the app. The site runs no analytics and loads nothing from third parties: its fonts are served from the site itself.

If you join the launch list, your email address is stored by Netlify, which hosts the site, and used for exactly one thing: a single email telling you Moonlight is on the App Store. If you answer the two optional questions after joining (whether you would like a TestFlight invite, and whether you mostly read paper or ebooks), those answers are stored the same way, next to your email, and used only to decide who gets an early invite. Nothing is shared, sold, or added to anything else, and the list is deleted once the launch email has gone out.

To be taken off the list before then, email the address under Contact below and it will be removed.

Children

Moonlight is not directed at children under 13, and children under 13 should not create an account.

Changes to this policy

If a future version of Moonlight changes what is described here, this page will be updated before that version ships, and the change will be called out in the app. The effective date at the top always reflects the current version.

This revision, 2 November 2026, is one of those updates. It adds required accounts (Apple, Google or email), the private backup of your word bank, the Social tab with usernames, shared words, cheers and the optional current book, QR codes and contact invitations, and moves friends from Apple's CloudKit to Firebase. The previous version said your words never left your iPhone, which was true of the app it described and is not true of this one.

Contact