Privacy Policy
Last updated: October 22, 2026
1. Who we are
Molted is a gamified self-improvement app. The controller of your personal data (within the meaning of Article 4(7) of Regulation (EU) 2016/679, "GDPR") is the Molted team, a group of natural persons without legal personality, namely Teodor-Vlad Constantin, Mihai-Alexandru Stroe, Vlad Alexandru Oancea and Tudor Filipache, who jointly determine the purposes and means of the processing (joint controllers, Article 26 GDPR). Postal address: Buzău, Romania. You can write to us at molted.app@gmail.com. We have no Data Protection Officer (DPO), because the law does not require us to appoint one.
2. What data we keep
- Account: your email address, display name and profile picture (including from your Google account, if you sign in with it).
- Acceptance of the terms: when you create an account you confirm that you have read the terms and this policy and that you are at least 16 years old (or have the consent of a parent or guardian). We store the accepted version and the date and time of the confirmation in your account, as proof of acceptance.
- What you enter in the app: your goal, your habits and their check-ins, your to-dos and planner, the scores and texts of the evening reports, your character's story and name, your settings (report time, theme), your Focus sessions and the groups you belong to.
- Public data in groups: your display name, character, level, streak, momentum and the day's progress are visible to the other members of your groups; the messages ("reminders") sent in a group are visible to their recipients.
- Push notifications (only if you turn them on): the technical address of your browser or device assigned by the notification service and the associated encryption keys, your time zone and report time, plus your choices (daily report, group reminders). We do not use them for anything else.
- Technical data: the daily counter of requests to the AI, needed for the usage limit. On your first visit, the country (worked out from your IP address by the hosting provider) and the browser language (the Accept-Language header) are used on the spot to choose the page language; we do not store them, neither on our servers nor on your device. Only what is needed for the app to work is kept locally on your device (in the browser); see the section "Cookies and local storage".
- Emails from Molted: we also use your email address to send you messages from Molted (see section 6). We keep your subscribe or unsubscribe choice (and when and how you made it), the date of your last activity in the app, a secret identifier for the unsubscribe link and a log of the emails sent (their type, date and status: sent, delivered, bounced).
- Errors and performance (Sentry): when the app throws an error or runs slowly, a technical report is sent: the type of error, the page, the app version, the browser and device type, your IP address and a short record of the steps before the error. For performance, only a share of visits is measured.
- Usage analytics (PostHog), only if you accept: the screens visited and the features used, tied to a technical account identifier (not your email or display name), plus technical browser data.
3. Why we use it and on what basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Account, sign-in, saving and syncing, statistics, groups and leaderboards, reports and stories written with AI | Performing the contract with you, i.e. the terms (Art. 6(1)(b)) |
| Push notifications | Your consent (Art. 6(1)(a)); you can withdraw it at any time |
| Usage analytics (PostHog) | Your consent (Art. 6(1)(a)) and Law 506/2004; you can withdraw it at any time |
| Emails from Molted about the app (welcome, tips, a request for feedback, a win-back message) | Our legitimate interest in keeping you informed about the service you chose (Art. 6(1)(f)), with the right to object at any time; your consent (point (a)) if you tick the box when creating the account |
| Choosing the page language on the first visit (Romanian for Romania and Moldova or for a Romanian browser, English otherwise) | Our legitimate interest in showing you the page in a language you understand (Art. 6(1)(f)); the country comes from the IP address and is not stored; you can object at any time by choosing the language with the switch or by writing to us |
| Error reports (Sentry), security, abuse prevention, the daily AI limit | Our legitimate interest in keeping the app stable and secure (Art. 6(1)(f)) |
| Keeping proof that you accepted the terms and the age confirmation | Legal obligation and our legitimate interest in proving consent (Art. 6(1)(c) and (f)) |
You are not required by law to give us this data, but without the account data and what you enter we cannot provide the service. We do not sell your data and we do not show ads. We make no automated decisions with legal or similarly significant effects on you; the AI score only contributes to momentum in the game.
4. Who processes it
We use providers that process data on our behalf:
- Clerk – authentication and account management (email, password or Google sign-in, sessions, anti-abuse protection at sign-up). Your password does not reach us. Clerk (US) is certified under the EU–US Data Privacy Framework.
- Supabase – the database where the app's data is saved, with per-user access restrictions, and the functions that run on the server. The data is hosted in London (United Kingdom), which the European Commission has recognised as providing an adequate level of protection; the Supabase agreement also includes standard contractual clauses.
- OpenRouter and the AI models used through it – they generate the evening reports, the story chapters, the personalized lines, the analyses in Stats and the plan proposed by the coach. They receive only the text needed (for example your goal, the names of your habits, the days they are scheduled, how many you ticked on each weekday, your level and streak), not your email or other account data. The models are run by third-party providers; if the AI does not answer, the app does not generate text in its place. OpenRouter (US) states that it does not use requests to train models, but some model providers (third parties) may use the text sent to them for training or improvement, under their own policies. This is why we do not send your email, password or other account data to the AI.
- Resend – sends the emails from Molted. It receives your email address, your first name (if we have it) and the text of the message; it tracks whether the email was delivered or bounced. We use no open-tracking pixels and no click-tracking links.
- Browser notification services (for example those of Google, Apple or Mozilla) – they carry push notifications to your device, if you turn them on.
- Google – sign-in, if you choose to sign in with your Google account. We do not load fonts from Google: the Nunito font is served from our own domains.
- PostHog (EU region, Frankfurt) – usage analytics, only if you accept. It also receives your IP address, used for approximate location.
- Sentry (EU region, Germany) – error reports and measurement of the app's performance. The company (US) is certified under the EU–US Data Privacy Framework.
- Vercel – hosting of the app and of the landing page (it receives the IP address and technical data of requests). It works out the visitor's country from the IP address, which we use only to choose the page language; we do not store it. Certified under the EU–US Data Privacy Framework.
We are bound to these providers by the data processing agreements (Art. 28 GDPR) they include in their terms of use: Clerk, Supabase, Sentry, OpenRouter, Vercel. Each provider publishes its list of sub-processors (for example Supabase) and its own privacy policy, which you can consult. We do not give your data to any other third party, unless the law requires it.
Transfers outside the EEA. Some providers (for example Clerk, OpenRouter and the AI models used through it, Sentry, Vercel, Google, Resend) are or may use infrastructure in the United States. The transfer relies on the European Commission's adequacy decision on the EU–US Data Privacy Framework (certified providers: Clerk, Sentry, Vercel, Google) or on the standard contractual clauses of Art. 46 GDPR, included in the data processing agreements (for example OpenRouter and Supabase). You can ask for a copy of the safeguards at the contact address. This text is updated if the basis changes.
5. How long we keep it
As long as you have an account. If you delete your account, we delete the data associated with it, including notification subscriptions. Exceptions: proof that you accepted the terms is kept as long as needed to defend ourselves in a possible dispute (at most 3 years after the account is deleted, the general limitation period); Sentry error reports are kept for at most 90 days; PostHog analytics data according to the retention of our PostHog plan (currently 12 months). The providers' backup copies may persist for a short time before they disappear. If you turn notifications off or the browser invalidates them, we delete the subscription.
6. Emails and push notifications
Emails from Molted. We may send you, at your account address, in your first weeks: a starter message if you created your account but have not checked anything off yet; a short tip on keeping your habits going; an introduction to the AI coach and groups; and a request for your opinion on the app, which you can answer directly. If you have been away from the app for a long time, you get a single come-back message; after it we do not contact you this way again unless you come back. We send no more than one email every 7 days and no more than 3 in 30 days. They are all emails about the app you use, with no third-party advertising.
How to unsubscribe. Every email has an "Unsubscribe" link that works in a single click, with no account and no password. You can also turn emails off or on at any time in the app, under Settings → Emails, or by writing to us at the contact address. It applies immediately. If the email bounces or is marked as spam, you are unsubscribed automatically. Emails strictly about your account (for example address confirmation or security), sent by Clerk, are not marketing messages and cannot be turned off while you have an account.
Push notifications are optional: they appear only if you turn them on in the app and accept the browser's request. You can choose what you receive (the daily report at your time, reminders from group members) and you can turn them off at any time from the app or from your browser or device settings. The messages contain only a short text such as "It's report time" or the text of the reminder sent by a member of your group.
7. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection (including to processing based on our legitimate interest), as well as the right to withdraw your consent at any time (for example for notifications or analytics), without affecting the processing done until then. From the app you can download your data, delete all your data or delete your account (Settings → Your data). For any other request you can write to us at the address above; we reply within 30 days at most. You have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), dataprotection.ro.
8. Cookies and local storage
The details, with the full list, are in the Cookie Policy. In short: Molted does not use advertising or marketing cookies and has no pixels. Usage analytics (PostHog) start only if you accept them; you can change your choice at any time in Settings → Cookies. The rest is strictly necessary for the app to work:
- Authentication cookies (Clerk's): they keep your session signed in. Without them you cannot enter your account. They are strictly necessary and do not require consent.
- Language: we store nothing on your device to choose the language by country (there is no cookie for it). Only your explicit language choice is saved, in localStorage and in your account.
- Local storage in the browser (localStorage): a copy of the theme and interface preferences (so it looks right before your account loads), the Focus session in progress and the history of the conversation with Molt when you are not signed in. Your preferences are saved in your account; you can delete the local copy from your browser settings at any time.
We do not need your consent for the strictly necessary ones (Article 5(3) of Directive 2002/58/EC; Article 4(6)(b) of Law 506/2004, which transposes the directive in Romania). For anything else the law requires your prior consent (Article 4(5) of Law 506/2004), which is why for analytics we ask for your agreement through a banner, before anything is stored.
9. Artificial intelligence
Molted uses AI models for reports, stories, lines, analyses and the plan proposed by the coach. The chat assistant is an AI system, not a person, and the app tells you so in the chat. The texts in reports, stories and analyses are generated by AI and may contain mistakes. The models receive only the text needed (see section 4), and how it is kept depends on the model chosen, as explained there.
10. Security
Access to data is restricted per user, communication is encrypted (HTTPS) and secret keys stay on the server. No method is perfect; if you notice a security problem, let us know.
11. Children
The app is intended for people aged 16 or over. If you are under 16, you need the consent of your parent or guardian. If we learn that we have received data from a child without this consent, we delete it.
12. Changes
We may update this policy; the date of the last update is written at the top, and we will tell you about important changes in the app or by email. Use of the app is also governed by the Terms and Conditions.
This English version is a translation provided for convenience. The Romanian version is the original text.