Privacy policy

1. What we collect

• Account details: your name, email address, a handle and an optional bio. If you sign up with email, we store a salted hash of your password, never the password itself. If you use Google sign-in, we receive your name, email address and Google account identifier.
• Ideas and analyses: the ideas you submit, any context you add (customer, market, stage), and the results we produce.
• Community contributions: competitors you add to published analyses, your votes, and outcomes you report.
• Billing records: which products you bought, amounts, and your customer ID with our payment provider. We never see or store your card details.
• Technical data: your IP address, used to apply free-use limits and stop abuse, and standard server logs.

2. Cookies and local storage

We use only cookies the service needs to work. No analytics or advertising cookies.

• mc_session: keeps you signed in, for up to 30 days.
• mc_anon: lets you keep analyses you ran before signing up, for up to a year.
• mc_oauth: protects Google sign-in, for 10 minutes.
• Theme preference: your light or dark choice, saved in your browser only.

3. How we use it

• To run analyses and show you the results.
• To run your account, apply free and paid allowances, and process payments.
• To show published analyses in the public idea library, and to use confirmed competitors from similar published analyses as leads for future analyses.
• To keep the service secure, prevent abuse, and fix problems.

We rely on our contract with you to provide the service, and on our legitimate interest in keeping it secure and improving it.

4. Private by default

Every analysis starts private, at an unguessable link that is not listed or indexed. It becomes public only if you publish it, and you can publish with or without your name and unpublish at any time. Once published, the analysis, and any competitors other founders add to it, can be seen by anyone.

5. Who processes data for us

We share data only with providers we need to run the service:

• Anthropic (Claude): receives the idea text and context to research competitors and write the analysis.
• TypeSafe (Jev): receives the idea text to check that it can be analysed and to tag its industry.
• Polar: our merchant of record. Polar handles checkout, payments, tax and invoices under its own privacy policy.
• Google: if you choose Google sign-in.
• Our hosting provider: stores the database and runs the servers.

Some of these providers are outside your country, including in the United States. We use them under their standard business terms.

6. How long we keep it

We keep your account and analyses while your account exists. When you ask us to delete your account, we delete your personal data within 30 days, except billing records we must keep for tax and accounting. Analyses you published anonymously may stay in the library without any link to you. Database backups are overwritten within 14 days.

7. Your choices and rights

You can update your name, handle and bio in Settings, and unpublish any analysis at any time. You can ask us for a copy of your data, to correct it, or to delete your account by emailing hello@checkmymoat.com from the address on your account. We reply within 30 days. Depending on where you live, you may also be able to complain to a data protection authority.

8. Security

Connections use HTTPS. Passwords are hashed with Argon2. Session tokens are stored only as hashes. Access to production systems is limited to the people who run the service.

9. Children

Moat Check is not meant for anyone under 16, and we do not knowingly collect their data.

10. Changes

If we change this policy in a meaningful way, we will update the date above and, for significant changes, let account holders know by email.