Privacy Policy

Last updated September 21, 2026

Mooncart doesn’t require an account or sign-in — everything lives on your device. This policy explains what the app touches, the little that leaves your device, and the rights you have.

Who is responsible

Henrik Svendsen is the data controller for the limited processing of personal data described in this policy — in practice, shared recipe links and the messages you send us.

Data controller

Henrik Svendsen, Norway

Supervisory authority

Datatilsynet, the Norwegian Data Protection Authority

What stays on your device

Recipes, lists and items

Stored only on your device. Mooncart writes an automatic backup file to your own iCloud Drive every few hours, and whenever you ask it to, so you can recover your data if you switch phones. That file never passes through a Mooncart server.

Sharing a list

Sends the list as plain text through your phone’s ordinary share sheet, like any other message. Nothing goes through a Mooncart server.

Recipe suggestions

Generated on your device with Apple Intelligence. Your ingredients and requests are not sent to Mooncart.

Nutrition estimates

Calculated on your device from public food-composition data (see “Nutrition data sources” below).

Meal-plan calendar sync

Off by default. If you turn it on in Settings, Mooncart writes your planned meals to Apple Calendar. It only touches events it created itself and never reads anything else in your calendar.

List reminders

A plain notification from Mooncart itself. Turning them on only asks for notification permission.

Health

Mooncart can log a recipe’s estimated nutrition to Health when you choose to. It never reads your existing Health data, even though iOS requires the app to ask for read access alongside write access.

Photos

Picked with the system photo picker. Mooncart never gets access to your library, only to the photo you choose, which is stored with that recipe or item.

Hosting and international transfers

The link service runs on Cloudflare, Inc., which acts as our hosting provider and processes data on our behalf under its data processing agreement. Cloudflare operates a global network, so data may be processed in countries outside the EEA; such transfers rely on recognised safeguards. See Cloudflare’s privacy policy. Backups in iCloud Drive and all purchases are handled by Apple under Apple’s own terms.

Security

Traffic to and from mooncart.app is encrypted with HTTPS, and our hosting provider encrypts stored data at rest. The link service accepts only recipe-formatted uploads of limited size and limits how many can be created per hour. Everything else stays on your device, protected by iOS’s own device security.

Mooncart Pro

Purchases are handled entirely by Apple’s App Store. Mooncart never sees your payment details, and no purchase information passes through a Mooncart server.

Nutrition data sources

Nutrition estimates are based on public food-composition databases: Norway’s Matvaretabellen, the UK’s CoFID and the USDA’s FoodData Central. Mooncart is not affiliated with or endorsed by any of them.

What Mooncart doesn’t do

No account or sign-in

required, ever.

No analytics, trackers or advertising

of any kind.

No sharing of your data

with third parties.

No access

to your location, camera or microphone.

Your rights

Under the GDPR you have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to its processing, and to receive a copy in a portable format. Because almost everything stays on your device, the personal data we hold is limited to a shared recipe you created and the messages you send us.

To exercise a right, email support@mooncart.app. Shared links carry no account, so please include the link. We respond within 30 days. Deleting the app removes its data from your device; backups in iCloud Drive can be removed in your device’s iCloud settings. You also have the right to complain to Datatilsynet.

Messages you send us

If you email us, we use your address and message only to reply, and keep the correspondence only as long as needed to handle your request. We never use it for marketing.

Children

Mooncart isn’t directed at children and doesn’t knowingly collect data from them. If you believe a child has sent us personal data, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. The date at the top shows the latest revision, and we will mention material changes in the app’s release notes.

  • Added controller details, your rights, hosting and security, and how pasted links work.
  • Earlier version.

Questions about privacy: support@mooncart.app