Munu Privacy Policy

1. What stays on your device

Munu's memory is a folder of notes on your own computer. We do not upload it. Your microphone is used for wake-word detection on your device. Hand-control camera frames are processed on your device and are not sent to us. Munu has no analytics or advertising tools built in.

2. What our account service stores

When you start a trial or a plan, our server (hosted on Fly.io in Germany) stores:

• your email address, and a one-way hash of it;
• a one-way hash of a device identifier, so one trial is given per device;
• the sign-in code we emailed you (stored hashed, deleted after use or expiry);
• hashed session tokens that keep you signed in;
• the IP address and time of sign-in code requests, used to limit abuse;
• your plan record: plan type, status, renewal date, Paddle customer and subscription ids, and the time you accepted the terms;
• the access key for your included AI use, stored encrypted. It is turned off when your plan ends and deleted if the plan is refunded.

Our server does not see what you say to Munu, what Munu says back, or your voice audio. Those requests go from your device directly to the AI and speech services below.

3. Third parties

These services handle data when you use the matching feature:

• OpenRouter (openrouter.ai) and the AI model providers it routes to receive your requests to the assistant, including any text, files or screen images you ask Munu to look at. They apply their own privacy policies.
• Deepgram receives your voice audio for speech recognition and speech output, using short-lived tokens that our server issues.
• Paddle is our merchant of record. It collects your payment details, billing country and tax information, and shares your email and purchase status with us. See Paddle's privacy notice (opens in a new tab).
• Resend delivers the sign-in code email.
• Fly.io hosts our account service.
• Composio (composio.dev), only if you connect apps such as Gmail or Google Calendar. You use Composio under your own account and its terms. Composio and the connected apps see the requests Munu makes for you, and what Munu reads from them is sent to the AI models. Munu stores only your Composio sign-in, in your device's keychain. You can disconnect in Settings at any time.

We do not sell your data and we do not use it for advertising.

4. How long we keep it

Account and plan records are kept while your account exists and as long as tax and accounting rules require for payments. Sign-in codes are deleted after use or expiry. Records of sign-in requests (email, IP address, time) are kept to limit abuse. Ask us to delete your account and we will delete or anonymise these records, except what the law requires us to keep.

5. Your rights

You can ask us for a copy of your data, a correction, or deletion by writing to munetic.studio@gmail.com. We answer within 30 days. If you live in the EU, UK or another place with data protection law, you have the rights that law gives you, including the right to complain to your local authority.

6. Children

Munu is not for anyone under 18. If you think a child has made an account, tell us and we will delete it.

7. Changes and contact

When this policy changes, the date above changes with it. Moon Labs LLC is based in Yerevan, Armenia. Contact: munetic.studio@gmail.com. See also the terms of service.