Privacy Policy

Last updated: October 19, 2026 · MAXNOVA & LUCI Global LLC

Who is responsible for your data

This policy explains what data we process in connection with the MOY IQ app and this website, why, and on what basis.

Financial data stays on your device

The following data is stored in your browser or on your device using IndexedDB. MAXNOVA & LUCI Global LLC does not receive it:

• Income and expenses, entered by hand or imported
• Budgets, debts and goals
• Recurring (subscriptions and other repeating expenses)
• App settings

Account and contact data we do keep

You need a free account to use the app. This data is stored in our database (Supabase, servers in Ohio, USA, region us-east-2):

• Account: your email. If you sign in with Google, we receive your Google email and name. Your password is handled in encrypted form by the authentication service; we never see it. Basis: performing our contract with you.
• Starter sign-up: your email, to send you emails about using the app. Promotional emails only with your consent; every email includes an unsubscribe link.
• Demo form: your name, your email and whether you want product news. Basis: your request and, for news, your consent.
• Express Diagnosis: your email, your score and whether you want product news. Same basis.
• Tax calculator (optional): if you leave your email for the notice about the full version, we store only your email and the country (Chile). The amounts you enter never leave your browser. Basis: your request.
• Marketing email confirmation (double opt-in): if you tick the box, we send you an email with a link to confirm it and store the date and time of that confirmation as proof of your consent; until you confirm, we send you no marketing emails.
• Newsletters (MOY IQ, weekly, and MOY IQ Invest, daily): your email and which newsletters you want, stored with our email provider (Resend). Basis: your consent, confirmed by double opt-in. The footer of each issue lets you choose which ones to get or unsubscribe.
• Pro plan: the purchase email, the account it is linked to, an irreversible hash of the license key (the key itself only if you sync with the previous model; see "Sync"), the plan, the activation and expiry dates and the payment confirmation. Basis: performing the contract and legal (accounting and tax) obligations.
• Push notifications (optional): your browser's technical identifier, linked to your license hash. Basis: your consent, which you can withdraw in your browser or app settings.
• Cancellations and support: the data you send us when you cancel online or write to support, to handle the request and to be able to prove we received it.

Data we do NOT collect

• Financial data you enter in the app (optional sync uploads only an encrypted copy; see below)
• Bank account information or bank credentials
• Your card details (Stripe processes them)
• Behavior profiles: we do not follow you across sites or build usage profiles; we only count visits anonymously (see "Site usage statistics")

Optional sync, reports and license

Sync between devices is optional and off by default. If you turn it on in Settings, your device encrypts your data before uploading it (AES-GCM) and it is stored encrypted. When you turn it on you create a passphrase: the encryption key is derived from that phrase on your device (PBKDF2-SHA256 with 600,000 iterations and a random salt), and the phrase is never sent to or stored on our server. For that reason we are not able to read that copy, nor recover it if you forget the phrase: keep it somewhere safe and export backups from time to time. Your other devices ask for the same phrase before they sync.

If you were already syncing before this change, you keep the previous model until you choose to move to a passphrase in Settings (before you do, the app asks you to download a backup). In that model the key is derived from your license key, and our server keeps that key while that copy exists. For that reason we cannot, today, promise that it is technically impossible for us to read those copies; we only use them to sync your devices. When you move to the passphrase, the server replaces the key with its hash. If you prefer that your data never leaves your device, keep sync turned off.

If you use Advisor Mode to email a PDF report, the PDF passes through our server and our email provider (Resend) only to deliver it; we don't keep it. Full details in the in-app privacy policy.

Site usage statistics

To know which pages of this site (moyiq.app) are visited and to improve it, we use Vercel Web Analytics. It counts visits anonymously: the page viewed, the referring site, any campaign tags in the address (such as utm_source), an approximate country, region and city, the browser, the operating system and the device type. It uses no cookies, does not link the data to your IP address or to any account, and does not build profiles or follow you across sites: to tell visits apart within a day it uses a temporary identifier that is discarded after 24 hours. The processor is Vercel Inc. (USA). Basis: our legitimate interest in knowing, in aggregate, which parts of the site are used.

How to object: we do not measure your visit if your browser sends the "Do Not Track" or Global Privacy Control signal. You can also turn measurement off in this browser with the button below, block the script, or write to us at support@moyiq.app.

Do not measure my visits in this browser

Emails and click measurement

The emails we send from moyiq.app (newsletters, welcome and tips, confirmations, licenses and account notices) go out through Resend. In all of them Resend measures clicks: each link first goes through a Resend server, which records that you clicked, which link and when, together with technical data such as your IP address and browser, and then takes you to the destination. We do not measure opens: our emails carry no tracking pixel. We use clicks in aggregate to learn which content is useful. Basis: your consent for marketing emails (confirmed by double opt-in) and our legitimate interest for service emails. If you object to this measurement, write to support@moyiq.app.

Service providers

These providers process data on our behalf (processors) or, in Stripe's case, partly as independent controllers. Apart from a PDF report you choose to email, none of them receives in readable form the financial data you enter in the app. We do not sell or share your personal data for advertising.

• Supabase (USA, servers in Ohio): database, authentication, form records and encrypted sync.
• Vercel (USA): hosting of this site and of the app, and site visit statistics.
• Resend (USA): email delivery, the newsletter list and click measurement (see "Emails and click measurement").
• Stripe (USA): payments, billing and the customer portal to manage or cancel your subscription. It processes your card data; we never see it.
• Cloudflare (USA): DNS for the domain and forwarding of the emails you send to our @moyiq.app addresses.
• Google (USA): the Gmail inbox where we receive and answer those emails, and sign-in if you choose "Sign in with Google".
• mindicador.cl (Chile) and dolarapi.com: public rate services. The app queries them from your device to show reference values (UF, UTM and dollar exchange rates), and the Chile tax calculator queries mindicador.cl (SII values) for the month's UTM when you calculate. The bolivar/dollar calculator in the Venezuela guide queries ve.dolarapi.com (official BCV and parallel rates) only when you calculate. They receive your IP address but not the amounts you enter or any other data about you.

International transfers

We are a US company and the providers that store your data are in the USA, so your data is processed there wherever you live.

• European Economic Area, UK or Switzerland: the transfer relies on the EU-US Data Privacy Framework where the recipient is certified and, otherwise, on the European Commission's standard contractual clauses.
• Brazil: the transfer is necessary to provide the service you sign up for or request (article 33, IX, read with article 7, V, of the LGPD).
• Chile and other countries: the transfer is necessary to provide the service you sign up for or request, and we only make it to the providers listed above, for the purposes stated.

You can ask us for information about these safeguards.

How long we keep data

• Account: for as long as you keep it. You can delete it yourself in the app, under Settings → Delete account (or at app.moyiq.app/delete-account), or by writing to support@moyiq.app. See "Deleting your account".
• Emails of people who sign up through a form (Starter, demo, Score Check or tax calculator) and do not confirm the product-news subscription: at most 12 months from sign-up.
• Newsletters and product news: while you stay subscribed. If you unsubscribe, we stop writing to you right away and keep your email flagged as unsubscribed (suppression list) so we do not write to you again by mistake.
• Pro data and payment records: for the life of the subscription and then for the legally required retention periods.
• Encrypted sync data: until your account is deleted. Turning sync off in Settings stops further uploads but does not erase the copy already stored; to erase it, delete your account or write to support@moyiq.app.
• Visit statistics: anonymous; the temporary identifier used to tell visits apart is discarded after 24 hours.
• Cancellations: 3 years, to be able to prove them.

Some data cannot be erased even if you ask, and we keep it only for that purpose: the payment and billing records the law requires us to keep, the record of your cancellation for those 3 years and, if you unsubscribed, your email on the suppression list (if you ask us to erase it as well, we will, but then we cannot guarantee that a future sign-up will not email you again).

Deleting your account

In the app, Settings → Delete account (or app.moyiq.app/delete-account, while signed in) immediately deletes your account and what our server keeps about it in MOY IQ and MOY IQ Invest, which share the account: license and plan, synced copy, push notifications, form records and records of emails sent, and your Invest data. It also deletes that account's data on the device where you delete it; on other devices it stays until you erase it. Before you confirm, the app offers to download a backup. It cannot be undone.

Two steps are not automatic and we do them ourselves: if you have an active Pro subscription, we cancel it in Stripe within one business day (to do it sooner, use the cancellation page), and if you were subscribed to a newsletter, we remove your email from our email provider's list. Only the payment records in Stripe, the record of an online cancellation for 3 years and a deletion record that keeps the date and how many records were deleted, without your email, account or license, are kept.

Your rights

You can ask for access, correction, deletion, objection, portability, restriction or blocking of the processing of your data, and withdraw consent at any time, by writing to support@moyiq.app from the email you signed up with (if you write from another address, we may ask you to confirm it is you). Handling your request is free. We reply within 30 calendar days at most; if you are in Brazil and ask for confirmation and full access to your data, within 15 days. US residents can use the same address for any privacy request; we do not sell personal information.

To stop receiving emails, use the unsubscribe link in each email. To cancel Pro instantly, use the Stripe customer portal (you sign in with the email of your purchase); you can also use the online cancellation.

You can also complain to the competent data protection authority: in the EU or EEA, the one in your country (in Spain, the AEPD); in Chile, the Agencia de Protección de Datos Personales; in Brazil, the ANPD; elsewhere, your local authority (for example, the SIC in Colombia).

If you live in Chile (Law 21.719)

From 1 December 2026, Chile's Law 21.719, which reforms Law 19.628 on the protection of private life, is in force, and it also applies to foreign companies that offer services to people in Chile. In short:

• Controller: MAXNOVA & LUCI Global LLC (details at the top of this policy). We have no office or representative in Chile; your channel is support@moyiq.app.
• Purposes and legal bases: those stated for each item in "Account and contact data we do keep": performance of the contract (account and Pro), your consent (marketing emails and newsletters, which you can withdraw at any time), compliance with legal obligations (payment records) and our legitimate interest (anonymous site statistics, click measurement in service emails and security).
• Your rights: access, correction, deletion, objection, portability and blocking. You exercise them in writing to support@moyiq.app, free of charge, and we reply within 30 calendar days at most.
• Transfers: your data is stored in the USA (see "International transfers").
• Supervisory authority: the Agencia de Protección de Datos Personales. If we reject your request or do not answer in time, you can file a complaint with it.
• Security incidents: if a breach affects your data, we will report it to the Agencia and, where required, to you, as the law requires.

If you live in Brazil (LGPD)

• Controller: MAXNOVA & LUCI Global LLC. Channel to contact the data protection officer (encarregado): support@moyiq.app.
• Legal bases: performance of the contract (art. 7, V), consent (art. 7, I), compliance with legal obligations (art. 7, II) and legitimate interest (art. 7, IX), depending on the data.
• Your rights (art. 18): confirmation that we process your data, access, correction, anonymization, blocking or deletion of unnecessary data, portability, information about whom we share it with and withdrawal of consent.
• Authority: you can file a petition with the National Data Protection Authority (ANPD).

Local storage and backups

If you clear your browser data or switch devices without exporting a backup, your data can be lost permanently and we can't recover it. You can export a JSON backup from Settings at any time; keeping it safe is your responsibility.

Cookies, analytics and browser storage

We don't use tracking or third-party cookies, and the visit measurement described above works without cookies. The website keeps a few preferences in your browser (for example, the country you pick in the sample view or your preference not to be measured). The hosting provider logs standard technical data, such as IP addresses, to operate the service. Fonts are served from our own server.

Minors

MOY IQ is not directed at people under 18. We don't knowingly collect information from minors.

Changes to this policy

We may update this policy. Changes are published on this page with the date of the update and, if they are material, we email you.

Contact

For privacy questions: support@moyiq.app