Moonlet Labs

Privacy policy

Effective date: 30 September 2026 · Last updated: 4 October 2026

Applies to Datum, Downbeat, Relay, Lode, Cone, Halloo, Startle, Assay, Spinney, Palindrome, Binnacle, Hashmark and Clatter for Android, and to the website moonletlabs.com. The apps are published on Google Play under the developer name Moonlet Labs LLC by Moonlet Labs LLC, a Minnesota limited liability company ("Moonlet Labs", "we"), which is the controller of the personal data described here. Contact details are at the end of this page.

Moonlet Labs games have their own policy: Privacy policy for games. It covers Ennead: Sudoku Puzzles.

The short version

• The apps have no accounts and no sign-in, and we run no servers that store your data.
• The apps send crash reports and usage statistics to Google Firebase, and fetch app settings from it. This data is linked to pseudonymous identifiers that Firebase creates for the app on your phone, not to your name or email. Data protection law still treats it as personal data, and so do we.
• The apps show ads from Google AdMob. Google may use your advertising ID and IP address to show and measure ads, and to personalise them if you allow it.
• In the EEA, the UK and Switzerland, the app asks for your consent first. Analytics, crash reports and personalised ads run only if you agree.
• Elsewhere, analytics and crash reports run by default. You can turn usage statistics off in Settings → Privacy, and in US states where Google's US state privacy message applies you can opt out of personalised ads there too.
• We advertise our own apps with Google Ads. When usage statistics are on (and, in the EEA, the UK and Switzerland, only if you consent), Google Ads learns that the app was installed and when you finish a job with it, so we can tell which of our campaigns work.
• Downbeat's and Halloo's microphone audio and the sensor readings in Datum, Lode and Startle are processed on your phone and never leave it, Cone's tones are generated on your phone, and Assay's tests run on your phone: its microphone tests keep nothing, and its last report stays on your phone and is not backed up. Spinney's wheels and labels stay on your phone, and a wheel you share goes only to whoever you send it to. Hashmark's counters and counts stay on your phone and in your Android backup, and are otherwise shared only in a CSV file you export. Clatter's rolls, dice, players and scores stay on your phone and in your Android backup; a roll or standings you share go only to whoever you send them to. Your settings, presets and history are stored on your phone, and Android may include them in your own Google backup and in a transfer to a new phone. Firebase identifiers and your consent choices are never backed up. Binnacle's approximate location, if you allow it, is used on your phone only and never sent.
• Palindrome records your voice only while its recording screen is open. Your recordings stay on this phone unless you share them, and saved clips are not backed up.

Contents

• What we collect and why
• Legal bases (EEA, UK and Switzerland)
• What stays on your phone, and app permissions
• Advertising
• Consent and your choices
• Who receives your data
• International transfers
• How long data is kept
• Your rights
• US state privacy rights
• Children
• Our website
• Security
• Changes to this policy
• Contact
• Google Play Data safety summary

What we collect and why

We have no servers that the apps talk to. The apps use Google services, described below, and those services are where data about your use of the apps ends up. None of them receives your name, email address, contacts, photos, files or precise location; the apps never ask for them. Every connection to Google is encrypted (TLS), and Google receives your IP address whenever the app connects.

Crash reports (Firebase Crashlytics)

• What: when an app crashes, a report with the stack trace, app version, device model, Android version, the device's state at the time (for example free memory and disk space, orientation and whether the device is rooted), a Crashlytics installation identifier and the Firebase installation ID.
• Not included: your settings, presets, preset names, audio, sensor readings or location.
• Why: to find and fix faults.
• When: in the EEA, the UK and Switzerland, only if you consent in the consent form. Elsewhere, crash reports are sent by default, based on our legitimate interest in keeping the apps working; there is no in-app switch for them.

Usage statistics (Google Analytics for Firebase)

• What: events such as app opens, sessions and their length, screens viewed, app updates, and a few app-specific events: in Datum, which mode you use; in Downbeat, how long the metronome and the tuner are used; in Relay, when a session starts and finishes and whether it used a built-in or a custom preset (not its name); in Lode, which tool you use (metal detector, stud finder or field meter); in Cone, which tool you use (clean, test or tones) and when a cleaning cycle finishes, with its length (standard or long); in Halloo, when listening starts (from the app, the tile or the widget, and whether for claps, a whistle or both) and when an alert fires (clap or whistle), never any audio; in Startle, when it is armed (with motion, pocket or charger, from the app or the tile) and when its alarm sounds (which of the three), never any sensor readings; in Assay, which single test you open, never its result (assay_test_opened), and when a checkup reaches its report; in Spinney, which tool you use (wheel, coin or chooser), never your labels, wheel names or results; in Palindrome, which effect you used (one of the ten effect names) and that you shared a clip, never any audio, score, length or clip name; in Binnacle, when the calibration screen opens, and whether it opened by itself because the sensor's accuracy was low or because you tapped Calibrate on the warning that something magnetic is nearby, never a heading or a location; in Hashmark, when a counter reaches its target, never which kind of counter, its name or its count, and when you export a file (hashmark_exported), never what is in it; in Clatter, which tool you use (dice or scores), the first time in a session you use a feature such as dice notation or saved rolls, and which kind of score sheet a finished game used, never your rolls, totals, labels, player names or scores; in every app, when you finish a job with one of its tools, such as reaching level, a completed workout, a finished cleaning cycle, a spin, flip or choice in Spinney, or a roll or a finished game in Clatter (only which tool, never what was measured, heard, played or picked); and whether consent was given. Each event carries the app-instance ID (a random identifier for this installation of the app), app and Android version, device model and brand, language, the install source reported by Google Play, and the country, region and city derived from your IP address. Google does not store the IP address itself in Analytics.
• Advertising ID: Analytics reads your advertising ID only when ad measurement is allowed (see "Shared with Google Ads" below), and never for personalised ads.
• Why: to see which features people use and decide what to improve; and to measure which of our own Google Ads campaigns lead to installs and to people using the app, so we spend on the ones that work.
• Shared with Google Ads: two events, the app's first open (first_open) and finishing a job with a tool (task_completed, with only which tool), together with the app-instance ID and your advertising ID that Google Ads needs to tell which of our ads, if any, led to them. We see only totals per campaign. This data is not used for personalised ads or to build advertising audiences.
• When: in the EEA, the UK and Switzerland, only if you consent: to usage statistics for the statistics, and additionally to "Measure advertising performance" for us and for Google in the consent form for the Google Ads part. Elsewhere, by default, based on our legitimate interest in understanding which features are used and in measuring our own advertising; in US states where Google's US state privacy message applies, opting out there also stops the Google Ads part. "Share usage statistics" in Settings → Privacy turns both off at any time.

App configuration (Firebase Remote Config)

• What: the app fetches configuration from Firebase, such as how often full-screen ads may appear and switches that turn a feature or ads off if something goes wrong. To do this it sends the Firebase installation ID and basic app and device information (app version, Android version, language and time zone).
• Why: to operate the apps and control ad frequency without shipping an update.
• When: after the consent step on launch has finished, whatever you chose there, and then from time to time while the app is in use.

Consent check (Google User Messaging Platform)

Each time an app starts, it asks Google's consent service whether a consent or privacy message applies where you are, and stores your answers on your phone. Google receives your IP address and basic device information for this. See Consent and your choices.

Advertising (Google AdMob)

The ads SDK collects data for Google, which uses it as an independent controller. See Advertising.

Support email

If you email us, we receive your email address, your message and anything you choose to include (such as your phone model). We use it only to answer you. We keep the thread for as long as we need it to resolve your request, then delete it no later than 12 months after the request is resolved.

Website

Visiting moonletlabs.com sends your IP address to our host and to Google Fonts. See Our website.

Things we do not do

We do not sell your personal data for money or build profiles of you (Google may, for personalised ads, as described under Advertising), and we do not make decisions about you by automated means that have legal or similarly significant effects. You are not required by law or by contract to give us any personal data; the apps work offline and without consent.

Legal bases (EEA, UK and Switzerland)

If you are in the EEA, the UK or Switzerland, these are the legal bases we rely on under the GDPR, the UK GDPR and the Swiss Federal Act on Data Protection, and for reading or storing information on your device under the ePrivacy rules and UK PECR.

You can object at any time to processing based on our legitimate interests by emailing support@moonletlabs.com. See Your rights.

What stays on your phone, and app permissions

Your settings, presets, calibration and history are stored in the app's private storage on your phone. We cannot see them. Uninstalling the app or clearing its storage deletes them from the phone.

Google Play rating prompt. Each app keeps a few counters with its settings: on how many days you used it, how many jobs you finished with it, and when it last asked Google Play to show its rating prompt. They decide when the app may ask, at most once every 90 days; Google Play then decides whether the prompt appears. They never leave your phone (except in your own Android backup, with the settings). If you rate or review the app there, Google Play handles it under Google's terms, and the app is never told whether you did.

Android backup. If you have Android backup turned on, Android includes the app's settings, presets, calibration and history, and your "Share usage statistics" choice, in your own Google account backup and in a device-to-device transfer to a new phone, except Binnacle's compass trim and its last approximate location, which stay on the phone. Google stores that backup under its own terms; Moonlet Labs cannot access it. A backup you made stays in your Google account until you delete it or Android lets it expire, which can be after you uninstall the app.

Never backed up. Firebase identifiers, your consent choices, queued crash reports and usage statistics, ad data, and Binnacle's compass trim and last approximate location are never included in a backup or transfer. A reinstall or a new phone therefore starts with fresh Firebase identifiers and asks for consent again where consent is required.

Permissions

Datum reads motion sensors and Lode reads the magnetic field sensor; neither needs a permission. Startle reads the motion and proximity sensors and the charger state; none needs a permission. Assay reads motion, rotation, magnetic field, proximity, light and pressure sensors, which need no permission either. Halloo and Startle can turn on the camera's flash as a torch during an alert or an alarm, which needs no camera permission and takes no pictures. Binnacle reads the rotation-vector, magnetic field and, on some phones, accelerometer sensors, which need no permission. Clatter's Shake to roll reads the motion sensor only while you have switched it on and the dice screen is open, to notice a shake; the readings are processed on your phone only and are never stored or sent, and the sensor needs no permission. Binnacle is the only app that can ask for your location: only your approximate location, and only if you want true north or the Qibla from where you are. No app asks for your precise location, contacts, camera, photos or files.

Datum: Spirit & Bubble Level

• Datum reads the rotation-vector sensor to show tilt. Android may compute that sensor by combining the accelerometer, gyroscope and magnetometer; on phones without it, Datum reads the accelerometer alone. Readings are processed in memory on your phone and are never stored or sent. When you level something or hold a protractor angle, the usage statistics may note only that you did ("level" or "protractor"), never the reading.
• The ruler uses the screen density your phone reports. Your calibration offsets, ruler correction, unit, last mode, sound and steadiness settings are stored on your phone.
• Datum shows a banner ad, and at most one full-screen ad per app open: only when you switch modes after 30 seconds of use, never while a reading is held or during calibration.
• Runtime permissions: none.

Downbeat: Metronome & Tuner

• Downbeat asks for the microphone permission the first time you open the Tuner tab. Audio is analysed in memory on your phone to detect pitch. It is not recorded, saved or sent to anyone, including us and Google, and no pitch readings are sent either; when the tuner shows you in tune, the usage statistics may note only that ("tuner"), never the note or the pitch. The microphone is used only while the tuner screen is open and is released when you leave it or the app goes to the background. The metronome does not use the microphone.
• The metronome runs as a foreground service with a media-style notification (play, pause, tempo) so it keeps time with the screen off. On Android 13 and later, the app asks for permission to show that notification.
• Your tempo, time signature, subdivision, sound, reference pitch, transposition, latency offset and presets are stored on your phone.
• Downbeat shows a banner ad only while the screen is on, and no full-screen ads.

Relay: Interval & HIIT Timer

• Relay uses no sensors and no microphone. Your presets and session history (date, preset, total time) are stored on your phone.
• While a session runs, a foreground service keeps the timer going and shows a notification with the timer state and pause, skip and stop buttons. On Android 13 and later, the app asks for permission to show it. If you have a paired Wear OS watch, Android may mirror this notification to the watch over its connection with your phone; we receive nothing from the watch.
• The screen stays on during a session. This needs no permission.
• Spoken cues such as "Work", "Rest" and "Last round" use the text-to-speech engine set on your phone. Speech is normally generated on the phone. Some engines or voices use a network service; if yours does, the text to be spoken is sent to that engine's provider under its own terms. Moonlet Labs receives none of it.
• The home-screen widget lists your top presets from the app's storage on your phone. It shows no ads and sends nothing.
• Relay shows banner ads (including at the bottom of the running screen) and at most one full-screen ad per app open, only on the summary screen after a session.

Lode: Stud & Metal Detector

• Lode reads the magnetic field sensor (magnetometer) to detect iron and steel near the phone and to measure the magnetic field. Readings are processed in memory on your phone and are never stored or sent. When the stud finder finds a stud, the metal detector picks up metal or you copy a field reading, the usage statistics may note only that it happened ("stud", "metal" or "field"), never the reading. Zeroing to the room's background field lasts only while the app is open and is not saved.
• In the field meter, Copy puts a one-line reading on your phone's clipboard, only when you tap it. It is not sent to us.
• Your last tool, unit, sound, vibration, max-hold and stud-sensitivity settings, and whether you have seen the stud finder's instructions, are stored on your phone.
• Lode shows a banner ad, and at most one full-screen ad per app open: only when you switch tools after 30 seconds of use, never while zeroing, while the compass needs calibrating or during a stud scan.
• Runtime permissions: none. Sensor readings are processed on the device.

Cone: Speaker Cleaner & Test

• Cone plays tones it generates on your phone: the water-eject pulses, the speaker test and the tone generator. It uses no microphone and no sensors, and it records nothing.
• For a cleaning cycle, Cone raises the media volume to its maximum (or the call volume, when you choose the earpiece) and sets it back to your level when the cycle ends or stops (if headphones take over the sound, once it is back on the phone's speaker); with headphones or another output connected at the start, it leaves the volume as it is. Before and during a cycle it checks whether headphones, a Bluetooth speaker or another external audio output is connected, so it can warn you or stop the cycle; it does not store or send which devices you use.
• Your last tool, cycle length, earpiece choice and tone settings (frequency, waveform, dual tone, sweep, volume, balance and timer) are stored on your phone.
• Cone shows a banner ad, and at most one full-screen ad per app open: only after you tap Done on a finished cleaning cycle, after 30 seconds of use; never during a cycle or while a tone plays.
• Runtime permissions: none.

Halloo: Clap to Find Phone

• Halloo asks for the microphone permission the first time you start listening or open Test it, after a screen that explains why. While listening is on, sound from the microphone is analysed in memory on your phone to detect a clap or a whistle, then overwritten. Sound is analysed on the device. Nothing is recorded, saved or sent. Android shows the green mic dot while Halloo listens. (On Android 11 and older, which have no mic dot, Halloo's notification shows instead.) No audio or sound levels are sent to anyone, including us and Google; the only things sent about a detection are the usage-statistics events described above: that an alert fired (clap or whistle), and that you ended it or that Test it heard you ("found" or "test").
• Test it uses the microphone in the same way, only while its sheet is open on screen, never in the background and never while listening is on.
• Halloo listens only after you turn listening on, in the app, the Quick Settings tile or the home-screen widget, and stops when you stop it, when its timer runs out (after 1, 2, 4 or 8 hours), or if another app keeps the microphone for 10 minutes. It never starts listening by itself, including after the phone restarts.
• While it listens, a foreground service shows a notification with a Stop button. On Android 13 and later, the app asks for permission to show notifications; listening works without it. When Halloo hears you, it shows a second notification with Stop buttons while the alert rings. Halloo sends no other notifications.
• The alert plays an alarm sound, raising the alarm volume while it rings and setting it back afterwards, and, unless you turn them off, vibrates and flashes the camera's flash as a torch. The torch needs no camera permission, and Halloo never takes pictures or video.
• Your settings (what to listen for, sensitivity, alert sound and volume, torch, vibration, the timer, "Ring when heard" and "No screen flashing") are stored on your phone. Whether listening is on is never stored.
• The Quick Settings tile and the widget show whether Halloo is listening. They show no ads and send nothing.
• Halloo shows a banner ad on its home screen only, and no full-screen ads. No ad appears on the alert, the permission screens, the tile or the widget.

Startle: Anti-Theft Alarm

• Sounds an alarm if someone moves your phone, takes it from your pocket or unplugs it. It can't stop a theft, track the phone or keep ringing if the phone is switched off.
• Motion, proximity and charger state are processed on the phone while Startle is armed, never stored or sent. The only things sent are the usage-statistics events described above: that it was armed (motion, pocket or charger; from the app or the tile), that its alarm sounded (which of the three), and that you disarmed a session that stayed armed for at least five minutes without an alarm ("armed").
• Startle watches only after you arm it, in the app or the Quick Settings tile, and stops when you disarm it or when the time you chose runs out (30 minutes, 1 hour or 2 hours). It never arms itself, including after the phone restarts. While it is armed, a foreground service shows a notification with a Disarm button; on Android 13 and later the app asks for permission to show notifications, and arming works without it. While the alarm rings, a second notification names what happened.
• Disarming uses your phone's own screen lock (PIN, pattern, password or fingerprint), checked by Android; if you unlocked the phone with it in the last 30 seconds, that counts. If your phone has no screen lock, Startle asks you to set a PIN for it. The PIN is stored as a hash on this phone only and is not backed up. If you remove the screen lock while Startle is armed and have no Startle PIN, Disarm asks you to confirm instead.
• The alarm plays an alarm sound, raising the alarm volume while it rings and setting it back afterwards, and, unless you turn them off, vibrates and flashes the camera's flash as a torch. Startle never uses the microphone, the camera for pictures or video, or your location.
• Your settings (trigger, sensitivity, countdown, alarm sound and volume, torch, vibration, ring time and stop time) are stored on your phone. Whether Startle is armed is never stored.
• Startle shows a banner ad on its home screen only, while it is not armed, and no full-screen ads. No ad appears while it counts down, while it is armed, on the alarm, the disarm and PIN screens, the permission screen, Settings, the tile or the notification.

Assay: Phone Test & Checkup

• Tests run on your phone. Assay reads the motion, rotation, magnetic field, proximity, light and pressure sensors only while their test is on screen, processes the readings in memory and never stores or sends them.
• Assay asks for the microphone permission only when you reach its microphone test, after a screen that explains why. The loopback test listens for a few seconds for its own test tone and keeps nothing. Record and play back holds 3 seconds in memory, plays them back once and drops them. Nothing is saved to a file or sent. If you say no, the two microphone tests are skipped.
• For the speaker tests, Assay raises the media volume (or the call volume, for the earpiece) and sets it back when the test ends. It plays its tones on the phone's own speakers only.
• The torch test turns on the camera's flash. No camera permission is needed and none is asked for, and Assay takes no pictures. The camera test opens your phone's own camera app; Assay gets no photo and no file.
• The battery and connectivity tests read what Android reports without a permission: battery level, status, Android's health label, temperature, voltage, technology, cycle count where reported and charge current; whether Wi-Fi, Bluetooth, NFC, GPS and a fingerprint sensor are present, and whether they are on where Android shows that. Assay does not scan for networks or devices, read NFC tags or check the SIM.
• Your last report (each result, the date, your note and the device facts: model and maker, Android version and security patch, total memory and storage, screen size and refresh rate) is kept on this phone only and is not backed up. You can turn that off or delete it in Settings. It leaves the phone only when you share it, as an image and text through Android's share sheet. Results, device facts and notes are never sent to us or to Google.
• Your "Remember last report" choice is stored with the app's settings.
• Assay shows a banner ad on its home screen, the report and the Battery, Connectivity and Sensors panels, and at most one full-screen ad per app open, after 30 seconds of use: when you leave the report, or when you return home from a finished single test. Never during a checkup or a test.
• Runtime permissions: the microphone, asked at the microphone test only.

Palindrome: Reverse Singing

• Palindrome asks for the microphone permission the first time you record, after a screen that explains why. Records only while this screen is open. Your clips stay on this phone unless you share them. Recording stops when you leave the recording screen or switch to another app; Palindrome never records in the background and has no background service.
• Recordings are held in memory while you use them, and effects (such as Reverse, Echo or Robot) are applied on your phone. Nothing you record is sent to us or to Google, and recordings are never uploaded by Moonlet Labs.
• When you save a clip, the audio and its name, date and effect are stored in the app's own storage on your phone, up to 50 clips. Saved clips are not backed up: they are left out of Android backup and device transfer, so they stay on this phone only. Deleting a clip, or "Delete all clips" in Settings, removes it from your phone; uninstalling the app removes all of them.
• When you share a clip, Palindrome makes an M4A audio file of it in a temporary folder and passes it to the app you choose through Android's share sheet, which can read only that file. Save to device writes a copy where you choose with Android's file picker; Palindrome needs no storage permission. What happens to a shared or saved copy is up to you and the app or place you choose.
• The pitch match score is worked out on your phone from the two recordings, is just for fun, and is never sent anywhere.
• Your settings (default effect, haptics, and whether you have seen the challenge introduction) are stored on your phone and in your Android backup.
• Palindrome shows a banner ad on its home screen, the library, the effect picker and the challenge's listen and result screens, never while the microphone is on, and at most one full-screen ad after you finish a challenge round.

Binnacle: Compass & True North

• Binnacle reads the phone's rotation-vector and magnetic field sensors to show a compass heading (on phones without a rotation-vector sensor, the accelerometer and the magnetic field sensor). Readings are processed in memory on your phone and are never stored or sent.
• Location is optional. If you allow it, Binnacle takes your approximate location (never your precise location, and never in the background) at most once each time you open the app, and only while it needs a place and you have not chosen a city. It is rounded to about 10 km straight away, and used on your phone only to work out true north, the Qibla direction and the magnetic field strength expected where you are (for the interference warning). Binnacle never sends it. Android works out the approximate location for the app and may use Wi-Fi and mobile network signals to do so, under Google's or your phone maker's terms; Moonlet Labs receives none of it. The last approximate location is kept on this phone and is not included in backups.
• Instead, you can choose a city from a list built into the app (city data from GeoNames, CC BY 4.0). The chosen city is stored in the app's settings, which are included in your Android backup.
• Your last tool, north reference, keep-screen-on and haptics settings are stored on your phone and included in your Android backup. Keep screen on keeps the screen awake while Compass or Qibla is open, and haptics give a tap when you are on bearing or aligned; neither needs a permission. The compass trim is stored on this phone only and is not backed up.
• When you hold a bearing or line up the Qibla direction, the usage statistics may note only that you finished a job with the compass ("compass", one value for the whole app), never which tool, a heading or a place.
• Binnacle shows a banner ad on the Compass screen only. It shows no ad on the Qibla screen, and no full-screen ads.
• Runtime permissions: approximate location (ACCESS_COARSE_LOCATION), optional.

Hashmark: Tally Counter

• Hashmark keeps your counters (name, colour, type, step, start value, target, rounds, sound, vibration and volume-key choices, the current count, when it was made and last tapped, and, for dhikr, the preset or your own phrase), the time of each tap for 90 days, and a total for each day, in the app's own storage on your phone. Counts are saved as you tap and included in your Android backup. A tap's time is deleted the first time Hashmark starts after it is 90 days old, and only the day's total is kept. Deleting a counter deletes its taps and totals.
• Nothing is sent to Moonlet Labs. Your counters and counts leave your phone only in your own Android backup, if you use it, and in a CSV file you export and choose where to save. The export opens Android's own file picker, so Hashmark needs no storage permission and keeps no copy. The file holds your counters' names and types, their daily totals and tap times; what happens to it after that is up to you.
• Analytics never say which kind of counter you use, and never include a counter's name, phrase or count. The only things sent are the usage-statistics events described above: that a counter reached its target (the same event for every kind of counter, at most once each time you open the app) and that you exported a file.
• The home-screen widget and the Quick Settings tile show the name and count of the counter you choose, and a tap on them adds 1. A tap on the tile adds 1 even while the phone is locked. Anyone holding your locked phone can see the pinned counter's name and count in Quick Settings. Which counter a widget shows is kept by Android's widget library on your phone and is not backed up. The widget and the tile show no ads and send nothing.
• The volume keys count only while Hashmark is open on screen. Hashmark uses no accessibility service and draws nothing over other apps.
• Your settings (volume-key defaults, Focus dimming, vibration, click sound and the counter pinned to the tile) are stored on your phone with the app's settings.
• Hashmark shows a banner ad on the counter list, History and the counter editor, and at most one full-screen ad per app open, after 30 seconds of use: when you leave a Count counter (not dhikr or japa) after at least 30 seconds on it, or after an export. Never on the counting screen or in Focus, never when you leave a dhikr or japa counter, and never in Settings, the widget's setup screen, the widget or the tile.
• Runtime permissions: none. Vibration is granted when you install the app.

Clatter: Dice Roller

• Clatter: Dice Roller (com.moonletlabs.dice). Your rolls, dice, players and scores stay on this phone and in your Android backup. Clatter keeps your rolls (the dice, their colours and faces, the total and when you rolled), saved rolls, custom dice and their labels, saved players, and games (open and finished, with the players' names and every score and change you can undo) in the app's own storage on your phone, and Android includes them in your backup.
• History keeps your last 200 rolls, and Scores your last 100 finished games; older rolls and finished games are deleted as newer ones replace them (a game with its scores). Clear history in Settings deletes the rolls, and discarding a game deletes it with its scores. Uninstalling the app or clearing its storage deletes everything from the phone.
• Nothing you roll, label or score is sent to Moonlet Labs. A roll or final standings you share is plain text that goes through Android's share sheet to whoever you choose; Moonlet Labs never receives it.
• Shake to roll is off until you switch it on. While it is on and the dice screen is open, Clatter reads the phone's motion sensor on the phone only, to notice a shake; readings are never stored or sent.
• Usage statistics, when they are on, say which tool you use (dice or scores), the first time in a session you use a feature such as dice notation or saved rolls, which kind of score sheet a finished game used, and that the dice landed or a game finished. They never include your rolls, totals, labels, player names or scores.
• Your settings (last tool, the dice on the tray, d6 faces, roll animation, sound, haptics, shake to roll, keep screen on, result order and score sheet cells) are stored on your phone and included in your Android backup.
• Clatter shows a banner ad at the bottom of the dice screen, saved rolls, custom dice, History, the games list, a game's score sheet and the final standings, never on Big roll, in an editor, on the new game screen or in Settings. It shows at most one full-screen ad, only when the final standings appear after you end a game that has scores, at most once per game and once per app open, after 30 seconds of use. There is no ad between rolls and none while a game is open.
• Runtime permissions: none. The buzz when the dice land (VIBRATE) is granted when you install the app.

Advertising

The apps are free and funded by ads from Google AdMob, as described per app above. Ads never interrupt a measurement, practice session, workout, cleaning cycle, listening, counting, a roll, a game or an alert. We limit ads to content rated G (suitable for general audiences).

To request, show and measure ads and prevent fraud, the Google Mobile Ads SDK collects your advertising ID, IP address and the approximate location derived from it, device and app information, ad interactions and diagnostic information such as app launch time and crashes in the SDK. Google uses this data as an independent controller under its own policies, and may share it with its advertising partners, who are listed in the consent form. See How Google uses information from sites or apps that use our services and the Google Privacy Policy.

• Personalised ads are based on information Google holds about your activity across apps and websites. In the EEA, the UK and Switzerland they are shown only if you consent.
• Non-personalised ads are based on context, such as the app and your approximate location. Google still uses your device's identifiers for frequency capping, measurement and fraud prevention.
• If you refuse consent where it is asked, the app works normally; you may see non-personalised or limited ads, or none.

Google and its advertising partners may collect information about your activity over time and across apps for personalised ads. See Consent and your choices to limit this.

Consent and your choices

• EEA, UK and Switzerland. On first launch, the app shows a consent form from Google's User Messaging Platform, a consent management platform registered with the IAB Transparency and Consent Framework. It lists the purposes and the ad partners. No ad is requested, and no usage statistics or crash reports are sent, until you have answered. You can change or withdraw your choice at any time in the app's Settings → Privacy → "Privacy options", which shows the form again.
• US states with privacy laws. Settings → Privacy → "Privacy options" shows Google's US state privacy message, where you can opt out of the sale or sharing of your personal data for targeted advertising. See US state privacy rights.
• Usage statistics, everywhere. Settings → Privacy → "Share usage statistics" turns Analytics off on this phone, and with it everything shared with Google Ads. It cannot turn Analytics on where you refused consent in the consent form.
• Advertising ID. You can reset or delete your advertising ID in your phone's settings (usually Settings → Privacy → Ads, or Settings → Google → Ads). Deleting it stops apps from using it for personalised ads.
• Reset the app's identifiers. Uninstalling the app, or clearing its storage, deletes the Firebase identifiers on your phone. The apps never include these identifiers in Android backup or device transfer, so a reinstall or a new phone starts with fresh Firebase identifiers that are not linked to the old ones, except that where ad measurement is allowed (see Usage statistics), Google Ads can still connect them through your advertising ID if it has not changed. To prevent that, reset or delete your advertising ID in your phone's settings (see above).

Where the "Privacy options" entry is not shown, no consent or opt-out message applies to your region. You can still use the other controls above, or email us.

Who receives your data

• Google LLC, for Firebase (Crashlytics, Analytics, Remote Config, installation IDs): our processor and service provider, under the Firebase Data Processing and Security Terms. Our Firebase projects are configured with the Google Analytics data-sharing settings and Google signals turned off, so Google does not use this data for its own purposes. See Privacy and Security in Firebase.
• Google LLC, for AdMob and the consent check: an independent controller, under the Google Ads Controller-Controller Data Protection Terms.
• Google LLC, for Google Ads, which receives the two Analytics events described under Usage statistics, with the app-instance ID and advertising ID, to measure our campaigns: we treat Google as an independent controller for this, under the same Controller-Controller Data Protection Terms.
• Google's advertising partners: independent controllers, listed in the consent form.
• Vercel Inc., which hosts moonletlabs.com: our processor.
• Google, for Google Fonts on the website: under Google's own privacy policy.
• Google LLC, for Google Workspace, which hosts our support mailbox: our processor.
• Authorities, courts or others where the law requires it, or to protect our rights.

International transfers

We are based in Minnesota, United States. Google and Vercel process data in the United States and other countries where they operate. When personal data from the EEA, the UK or Switzerland is transferred to the United States, we rely on the EU-US Data Privacy Framework, its UK Extension and the Swiss-US Data Privacy Framework where the recipient is certified (Google LLC is), and otherwise on the European Commission's Standard Contractual Clauses with the UK Addendum and the Swiss amendments. The providers that hold the data we collect directly, Google Workspace for support emails and Vercel for website logs, rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses.

How long data is kept

Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to its use, to receive it in a portable format, and to withdraw consent at any time. You may object at any time to processing based on our legitimate interests.

How to use them without an account. The apps have no accounts, and the identifiers Firebase uses are not linked to your name or email, so we cannot find your data from your email address. These routes work:

• To stop collection: withdraw consent in Settings → Privacy → "Privacy options" (where shown), or switch off "Share usage statistics".
• To cut the link to past data: uninstall and reinstall the app, or clear its storage. The app then uses fresh identifiers (the identifiers are never included in Android backup or device transfer, so a restore does not bring the old ones back). Where ad measurement is allowed, also reset your advertising ID in your phone's settings, or Google Ads can still connect the old and new data through it. Data already linked to the old identifiers stays with Google until it ages out under the retention periods above; we cannot delete it early because we cannot tell which identifiers were yours.
• For ads: reset or delete your advertising ID in your phone's settings, and see Google's own controls at My Ad Center.
• For anything else, including your support emails: email support@moonletlabs.com. If we cannot identify data as yours, we will tell you so and explain what we can do.

We reply within one month (EEA, UK and Switzerland) or 45 days (US states), and may extend this where the law allows. You also have the right to complain to a data protection authority: in the EU or EEA, the authority where you live or work (list of authorities); in the UK, the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner. If you live elsewhere, you may have similar rights under local law; contact us.

US state privacy rights

This section applies to residents of California and other US states with consumer privacy laws, and is our notice at collection. Whether or not these laws apply to Moonlet Labs, everyone in the United States can limit targeted advertising with the advertising ID controls in their phone's settings, and where Google's US state privacy message applies, the app also offers an in-app opt-out of the sale or sharing of personal data and of targeted advertising, as described below.

• Categories we collect: identifiers (advertising ID, Firebase app-instance and installation IDs, IP address); internet or other electronic network activity (app and ad interactions); approximate geolocation derived from IP address; device information. If you email us: your email address and message. We do not collect sensitive personal information.
• Sources: your device, through the apps; you, if you email us.
• Purposes: as described in What we collect and why.
• Disclosed to: our service providers (Google for Firebase, Vercel, our email provider) and, for advertising and for measuring our own ad campaigns, Google and its advertising partners.
• Sale, sharing and targeted advertising: we do not sell personal information for money. When personalised ads are shown, Google and its advertising partners receive identifiers, approximate location and ad-interaction data for cross-context behavioural advertising. California law may treat this as "sharing" (and in some cases "selling"), and other states as "targeted advertising". We also send Google Ads the two Analytics events used to measure our own ad campaigns (see Usage statistics); we treat this as sharing too, and your opt-out stops it.
• How to opt out: where Google's US state privacy message applies, open Settings → Privacy → "Privacy options" in the app and use that message; Google then restricts how it uses your data for ads (restricted data processing). Settings → Privacy shows whether you have opted out. Everyone in the US can also delete or reset their advertising ID in their phone's settings. Email support@moonletlabs.com for questions about your choice or to appeal; email itself cannot switch off ads processing in the app.
• Global Privacy Control and Do Not Track: these are signals sent by web browsers. The apps contain no browser, so they cannot receive them; use the in-app options above. Our website is static, sets no cookies of its own, runs no analytics or advertising, and does not track you over time or across sites, so it does not sell or share personal information and has nothing for these signals to switch off.
• Your rights: to know and access what we collect, to delete it, to correct it, to opt out of sale, sharing and targeted advertising, and to limit use of sensitive personal information (which we do not collect). See Your rights for how requests work without an account. We will not treat you differently for using these rights.
• Authorised agents may make a request by emailing us with proof of your authorisation.
• Appeals: if we decline your request, you can appeal by replying to our answer with "Appeal" in the subject. We respond within 60 days. If you are not satisfied, you may contact your state attorney general.
• Minors: we do not knowingly sell or share the personal information of anyone under 16.
• Retention: see How long data is kept.

Children

Datum, Downbeat, Relay, Lode, Cone, Halloo, Startle, Assay, Spinney, Palindrome, Binnacle, Hashmark and Clatter are general-audience tools rated for a general audience. On Google Play they target people aged 13 and over, and they are not directed at children under 13 (or under the minimum age for consenting to online services in your country). We do not knowingly collect personal data from children. Ads are limited to content rated G. If you believe a child has given us personal data, for example by emailing us, contact support@moonletlabs.com and we will delete it.

Our website

moonletlabs.com is a static website hosted by Vercel Inc. When you visit, Vercel processes your IP address, browser user agent, the pages you request and the time, to deliver the site and protect it from abuse, and keeps these request logs for the limited period set out in Vercel's privacy policy. The pages load fonts from Google Fonts, so Google receives your IP address and browser information when you visit; see the Google Privacy Policy. The site sets no cookies of its own and uses no analytics or advertising. Our legal basis is our legitimate interest in running a working, secure website.

Security

Data sent from the apps to Google is encrypted in transit. We operate no servers that store your data, and we limit access to the Firebase and AdMob consoles to the people who run Moonlet Labs.

Changes to this policy

If we change what the apps or the website do with data, we will update this page and the dates above. For material changes we will also tell you in the app before the change takes effect, and ask for consent again where the law requires it. Previous versions are available on request.

Contact

Moonlet Labs LLC · 445 Karen Dr Unit 316, Woodbury, MN 55129, USA · support@moonletlabs.com

Google Play Data safety summary

This summarises each app's Google Play Data safety answers, using Play's definitions: "collected" means sent off your phone, including by the Google SDKs in the app; "shared" means transferred to a third party, and data processed by our service provider on our behalf is not "shared".

All data is encrypted in transit. "Required" means collection cannot be switched off for every user in every region: in the EEA, the UK and Switzerland, Analytics and Crashlytics run only with consent, and nothing goes to Google Ads without consent.