Privacy policy

The same text the app shows under Settings › About & legal, with both the Mac and the iPhone wording where the two differ, and a note on this website. Last updated 21 October 2026.

In short

Moonlet runs AI models on your own device — or, only if you connect one, with a cloud model account you own. Moonlit Lab AI does not collect, receive, sell or share your data. There are no accounts, no advertising, no analytics and no tracking, and the app sends no crash reports or usage data to Moonlit Lab AI.

What stays on your device

Your conversations, saved memory facts (memory is off until you turn it on), the documents you add for search, your courses, study journal and quiz results, family profiles and settings are stored in the app's own storage on your device. The family PIN is kept in the device's keychain.

If you use iCloud Backup or back up to a computer, those backups include this storage; downloaded models are left out of backups. You can delete conversations, documents, memory and study history in the app. On a Mac, moving the app to the Trash does not remove what it stored: that stays in your user Library (Application Support, Group Containers and the app's preferences), and models stay in the folders you keep them in. The family PIN and any API keys you saved stay in your keychain. Delete your history in the app first, and remove those folders and keychain items yourself to remove everything. On iPhone and iPad, deleting the app removes what it stored on this device, except the family PIN and any API keys you saved, which stay in the device's keychain — remove them in the app before deleting it.

When something leaves your device

Only when you, or the model on your behalf, use a feature that needs the internet or your local network:

Hugging Face — getting Ornith, and browsing and downloading models, sends your search words and the names of the models and files you ask for.
Web search — available by default, when the model decides a question needs it; the search the model writes (which can include words from your message) goes to DuckDuckGo and, if needed, Mojeek — or to Brave Search first, if you add your own Brave key.
Paper search — for questions about research, the search the model writes goes to OpenAlex and arXiv, and if needed Crossref.
Reading web pages — each page the model opens is requested from that site.
Pictures — the picture tool sends its search words to Wikimedia Commons, and pictures load from Wikimedia.
Stock tools (Mac download only) — ticker symbols go to Yahoo Finance, or to the data host you set.
Shell commands and programs (Mac download only) — a command or program the model writes can reach any internet address; each one is shown to you and runs only when you allow it (unless you turn off “Ask before running commands and programs” in a chat's tool settings).
A cloud account for lessons — only if you choose one in the Learning Center’s settings. Lesson prompts, your “I have difficulty with…” list, quiz questions, the answers you type for marking and passages of the documents you quiz yourself on then go to that provider (OpenRouter, Anthropic, OpenAI, Google, or a server you name) under your own key, and its terms and privacy policy apply. The key stays in this device’s keychain. Child and teen profiles cannot use one.
Services you add yourself — MCP servers, and chain endpoints in the Mac download, receive the requests the model makes to them.
Groupthink — pooling memory with a nearby device on the same Wi-Fi passes part of each reply's computation between the two devices over your local network, without encryption. It is off until you turn it on, and never available to a student profile.

These services receive the request directly from your device and their own privacy policies apply; Moonlit Lab AI receives none of it. Browsing Hugging Face happens only when you do it; everything else here can be switched off — the model's tools, including MCP servers, in a chat's tool settings, the cloud account in the Learning Center's settings, and Groupthink on Home.

Families and students

Family profiles let a parent set rules for each student. A student's device that is linked to a parent's device sends that device a study summary — subjects, time studied and quiz scores — over your local network, encrypted. If the parent turns on "Answer for their device", the student's device can have its chat and Learning Center answered by the parent's Mac: the student's typed questions, the answers they type for marking, and requests for lessons and quizzes — including their “I have difficulty with…” list — then go to that Mac, encrypted, to be answered there.

On a device the family shares, a parent or adult profile can open every profile's conversations; a student profile sees only its own.

A teen profile can also ask private questions, unless a parent turns that off: a private chat is answered on the device itself, never sent to the family Mac, and never saved or shown to a parent. Two rules the teen is shown before starting can tell a parent that the teen needs support — who, why and when, never what they wrote: at once if it is about suicide or self-harm, or the teen says they have hurt someone; for help hurting someone, explosives, making weapons, extremist views or a romantic or sexual relationship with the model, after two warnings, which count across the teen’s private chats for 30 days. The alert is kept on the device for a parent profile, and sent to the family Mac when the device is linked and that Mac has a parent profile; the teen is told whether it has arrived. One thing outranks both rules: if the teen says a parent, guardian or another adult who looks after them is hurting or frightening them, no one in the family is told anything about their private chats for the next 90 days, an alert still waiting on the device is withdrawn, and the teen is shown helplines outside the family instead.

Child and teen profiles chat only with models a parent allows. Official releases from established labs are allowed until a parent turns them off; anything else — including a model whose name or Hugging Face listing says it was made to drop its safety training, to role-play or to write adult content — waits until a parent allows it. A student can ask a parent for a model, and the request goes to a parent profile on the device, and to the family Mac when the device is linked. The labels read a model's name, publisher and listing, not what it was trained on.

Child and teen profiles have no web search and no pictures from the web, and every reply — in chat and in the Learning Center, including lessons, quizzes and the tutor's reasoning — is checked against a list of words and phrases before it is shown; a reply that matches is held back. In a teen's private chat, the few words a health class uses are allowed through. The check catches plain wording, not every paraphrase, so it is a safeguard, not a guarantee.

Moonlit Lab AI does not knowingly collect personal information from anyone, including children under 13, and receives no information about students. A parent can delete a profile and its study history at any time.

Permissions the app asks for

Microphone and speech recognition — to dictate messages; the transcription happens on the device.
Local network — to find nearby devices for the family link and Groupthink.
Photos — only the pictures you choose to attach.
Screen Recording, Accessibility and control of System Events (Mac download only, and only if you turn on Computer control) — so the model can read the screen as text on this device and use the mouse and keyboard in other apps. What it reads stays on the device with the model; it never reads or acts on Moonlet’s own window, and each action asks first until you allow the rest of that chat.

Security

What the app stores is protected by your device's passcode and storage encryption. The family link encrypts its traffic with keys created when the two devices are paired. Groupthink traffic is not encrypted, which is why it stays on your own network and is off by default.

Changes and contact

Moonlet is in active development. When this policy changes, the new version is published here with a new date. Last updated 21 October 2026. Write to Moonlit Lab AI at hello@moonlitlabai.com.

This website

The moonlitlabai.com pages set no cookies and run no analytics or tracking. A few choices are remembered in your browser's own storage on your device, such as the facts you keep in Moonlet's notebook and the trade you pick on the page for businesses; they are never sent to us.

The pages load scripts from jsDelivr (cdn.jsdelivr.net) and fonts from Google Fonts. Like the host that serves the pages, those services see your IP address and browser details when your browser asks them for a file, and their own privacy policies apply.

If you write to hello@moonlitlabai.com, for example to hear when Moonlet is ready or to ask for a free review, we keep your message and address only to answer you or to write to you once, and delete them when you ask.