Version française

Privacy Policy

Last Updated: September 24, 2026

This Privacy Policy describes how OriginMind Inc. ("moonbelt", "We", "Us", "Our") collects, uses, and protects Your information when You use the moonbelt mobile application and related services (the "Service"). By using the Service, You agree to the collection and use of information as described here.

Language. This Policy is available in English and French. If the two versions differ, the one more favourable to You prevails.

1. Definitions

2. Data We Collect

Data You provide: name, email address, profile photo (optional), onboarding responses (such as Your commitment level and the obstacles You want help with), photos of food products and their packaging that You choose to contribute to the shared food database (optional, where available), photos of nutrition labels You scan when a barcode is not recognised, and Health Data including date of birth, gender, weight, height, goals, activity level, dietary restrictions, eating style, food allergies and intolerances, disliked ingredients, cuisine and meal preferences, meal, drink, and supplement logs, water intake, meal photos, voice input, workouts and sleep You record manually, favourite foods, foods You like or dislike in the AI coach's suggestions, and messages to the AI coach.

We do not ask You to create a password. You sign in with Apple, with Google, or with a one-time code sent to Your email address.

Data collected automatically: device model and identifier, OS version, app version, IP address, language, time zone, crash logs, push notification token, and usage analytics (screens viewed, features used, session duration).

Data We create: calorie and macronutrient targets, trends, streaks, nutrition insights generated by AI from Your logs, and AI coach memory (short notes the coach keeps about lasting facts You mention, described in Section 6).

Data from third parties: basic profile details from Sign in with Apple or Sign in with Google (if You choose to use those options); step count, workout sessions, and sleep sessions from Apple HealthKit (iOS) or Android Health Connect (if You grant permission, and only for the categories You turn on); subscription status from Our payment infrastructure provider.

We do not collect Health Data that is not described in this Policy. If We add a new category, We will update this Policy and ask for Your permission before reading it.

Our website and mailing list

Most of this Policy describes the moonbelt app. Our website, moonbelt.ai, collects far less. It sets no cookies and runs no advertising trackers of any kind. If You choose a light or dark theme, that choice is stored in Your browser and never leaves Your device.

Website analytics. We use Cloudflare Web Analytics to see how many people visit moonbelt.ai, which pages they read, and which links bring them here. It is cookieless: it stores nothing on Your device, does not fingerprint Your browser, and cannot follow You to other websites or build a profile of You. It records the page viewed, the referring site, Your country, Your browser and device type, and how quickly the page loaded. We use it only to understand which pages and channels work. It is never linked to Your moonbelt account and is never used for advertising.

Two companies see Your IP address when You visit, as they would on any website: Cloudflare, which hosts the site, records standard server log information to serve it and protect it from abuse, and provides the cookieless analytics described above; and Google, which serves the page's typefaces through Google Fonts and receives Your IP address as part of that request under Google's own privacy policy.

The waitlist and mailing list. Our waitlist is hosted by a third-party newsletter provider. If You join it, We receive Your email address and use it only to tell You about moonbelt. We do not add You to it unless You ask, We do not sell or share it, and We do not use it for anything else. Every message We send identifies Us and includes a working unsubscribe link, and We act on unsubscribe requests promptly. You can also ask Us to remove You at any time by emailing privacy@moonbelt.ai.

3. How We Use Your Data

We use data to:

We do not sell Your Personal Data. We do not share it for cross-context behavioural advertising.

4. Apple HealthKit & Android Health Connect

If You choose to connect Your device's health platform, We read three categories of data, and nothing else: Your step count, Your workout sessions, and Your sleep sessions. Each category is a separate permission that You control independently, and You can enable one without enabling the others.

What We readWhy
Step count To show Your daily steps, track progress toward Your step goal, and estimate calories burned from walking.
Workout sessions
(activity type, start and end time, duration, energy burned, distance)		 To show Your training on the dashboard, include workout energy in Your daily calorie balance, and let the AI coach account for Your training load.
Sleep sessions
(time asleep, time in bed, and where Your device provides it, the breakdown into light, deep, REM, and awake stages)		 To show Your sleep duration and trends, and to let the AI coach account for rest and recovery when discussing Your nutrition.

What We do not read. We request only the three permissions listed above. In particular, We do not read heart rate, heart rate variability, blood oxygen, respiratory rate, blood pressure, blood glucose, body temperature, ECG, weight or body measurements, menstrual or reproductive health, medications, clinical or medical records, mindfulness sessions, nutrition entries, or any other category available in HealthKit or Health Connect. If a future feature needs a further category, We will update this Policy and ask for Your permission before requesting it.

We never write to these platforms. moonbelt does not save, modify, or delete any data in Apple Health or Health Connect. Our access is read-only.

Data from other apps and devices. Workout and sleep records in Your health platform may originate from other apps, a smartwatch, or a fitness tracker You have connected. When We read a workout or sleep session, We also record which app or device it came from, so that the app can show You the source and avoid counting the same session twice. We do not connect to those apps or devices directly, and We receive nothing from them except what Your health platform already holds and You have permitted Us to read.

Where this data goes

Being clear about this matters, so it is spelled out in full:

What We never do with it. We do not use HealthKit or Health Connect data for advertising, marketing, profiling for advertising, or data brokerage. We do not sell it. We do not share it with data brokers, advertisers, insurers, employers, or credit or lending providers. We do not use it to determine eligibility for employment or insurance. We do not use it to train AI models, and Google, Our AI provider, is contractually prohibited from training on it. Apart from the service providers in Section 5, who act only on Our instructions, We do not share it with third parties.

Turning it off

You can turn any individual category off inside moonbelt at Profile → Connect Device, or revoke access at the operating system level:

Revoking access stops future syncing. Steps, workouts, and sleep sessions already synced remain in Your account until You delete them in the app or delete Your account. You may also hide an individual workout or sleep session from moonbelt without deleting it from Your health platform.

5. How We Share Data

We share data only with third-party service providers necessary to operate the Service. These providers fall into the following categories:

Each provider is bound by a data processing agreement and may not use Your data for their own purposes. We do not share Your data for advertising or marketing by third parties.

We identify most providers by category because the specific provider in a category may change over time, and a policy naming a provider We no longer use would be less accurate, not more. The categories above, and the purposes they serve, remain accurate across any such change. We name Our AI provider, Google, because the app asks for Your permission before sending it Your data, and that request names Google too. If We change AI provider, We will update this Policy and ask for Your permission again before sending Your data to the new provider. If You would like to know which other providers We currently use, email privacy@moonbelt.ai and We will tell You.

Shared food database. When You log foods (for example by photo scan, voice, barcode, nutrition-label scan, or the AI coach) or contribute a product photo, generic food information derived from Your input (such as a food's name, nutrition details, barcode, or the product photo itself) may be added to moonbelt's shared food database and shown to other users. This catalog information is never displayed with Your name, profile, or any other identifying detail. Internally, We keep a record of which account contributed a catalog entry, solely for quality and abuse prevention; this link is never shown to other users and is removed when You delete Your account. Your personal meal logs, meal photos, and Health Data are not part of the shared food database.

Nutrition label scans. When a product's barcode is not in Our database and You photograph its nutrition label so the app can read it, We keep that photo, the barcode, and the values read from it in private storage, so that We can check and correct the catalog entry later. Label photos are never shown to other users. Internally they are linked to the account that took them, solely for quality and abuse prevention. When You delete Your account that link is removed, and the photo and its record are kept as de-identified evidence for the catalog entry. Please photograph only the label.

We may also share data if required by law, or as part of a business transfer such as a merger or acquisition.

6. AI Features and Your Data

Some features, including food photo recognition, voice meal logging, nutrition label reading, product photo checks, AI coaching, nutrition insights, and meal plan generation, are powered by Google's Gemini models, which We access through Google's paid Gemini API service. Google acts on Our behalf: it may process Your input only to generate the result We return to You, and only under its terms with Us.

Your permission comes first. The first time You use a feature that sends data to Google, the app asks for Your permission and names Google. Until You allow it, nothing is sent to Google and nutrition insights are not generated for You. If You choose Not now, features that do not use AI, such as food search, barcode scanning, and manual logging, keep working, and You will be asked again the next time You use an AI feature. You can withdraw permission at any time at Profile → App Settings → AI Features. After You withdraw it, nothing further is sent to Google, and features that rely on AI stop working until You allow it again. Withdrawing does not delete AI coach conversations or AI coach memory already stored with Your account; deleting Your account removes them, as described in Section 10.

Voice logging and speech recognition. When You use voice logging, Your speech is transcribed by Your device's operating system speech service, which is provided by Apple on iOS and by Google on Android. Depending on Your device and its settings, that service may transcribe the audio on the device itself or send it to the operating system provider's servers, where it is handled under that provider's own privacy policy rather than this one. The audio recording is never sent to Us, and We never store it. moonbelt receives only the resulting text, which is then processed as described above to identify the foods You named.

What Our AI features receive. So that answers and suggestions fit You rather than a generic person, Our AI features receive the information from Your account that the feature needs. Depending on the feature, this may include:

Our AI features do not receive Your name, Your email address, Your sleep stage breakdown, or Your individual workout or sleep session records. If You have not connected a health platform, or have turned a category off, nothing from that category is sent.

AI coach memory. So that You do not have to repeat yourself, the AI coach may save short notes about lasting facts You mention in a conversation, such as a food You dislike, an allergy or intolerance, a routine, a goal, or a health condition You describe. To do this, recent messages are processed by Google after the coach replies. The notes are stored with Your account, used only to personalise future coach conversations, and deleted, along with Your conversations, when You delete Your account.

Photos. Your profile photo and the meal photos saved with Your logs are stored only on Your device and are not uploaded to Our servers. When You use AI Scan, the photo is sent through Our servers to Google to identify the food, and We do not store it. Nutrition label photos are the exception and are kept as described in Section 5.

We do not use Your identifiable content to train AI models without Your explicit consent, and Google does not use Your content to train its models. Your meal photos, voice inputs, messages to the AI coach, and other content are used only to generate the result You requested (for example, to identify a food or produce a meal plan). Your content is sent to Google for that purpose alone, under the terms of Google's paid Gemini API service, which prohibit Google from using it to train or improve its models. We do not sell this content and We do not use it for advertising.

We may use data that has been aggregated or de-identified, so that it can no longer reasonably be linked to You, to improve the Service, including its AI features. If We wish to use Your identifiable content to improve or train Our AI features, We will ask for Your permission first, and declining will not affect Your access to the Service.

AI output can be inaccurate or incomplete. Please review the Medical Disclaimer, AI Features, and Nutrition Data sections of Our Terms of Service before relying on any AI-generated result.

7. Data Retention

We retain Account data while Your account is active. When You delete Your account, it is deleted from Our active systems immediately, and copies in Our backups are erased within 30 days. Crash and diagnostic logs are retained for no more than 90 days. Analytics data is retained for no more than 24 months. These are ceilings rather than targets: Our current providers expire both sooner, and We state the limit so that it stays accurate if We change plan or provider.

Subscription records. Our copy of Your subscription status is deleted with Your account. Purchase and billing records are held by the Apple App Store or Google Play and by Our subscription management provider, under their own retention policies.

Health Data, including meal logs, weight history, steps, workout sessions, and sleep sessions, is retained while Your account is active so that You can see Your own history and trends. You may delete any individual entry at any time, and all of it is deleted when You delete Your account, as described in Section 10.

AI coach conversations and AI coach memory are retained while Your account is active so that the coach can pick up where You left off, and are deleted when You delete Your account. Google processes Your messages only to generate the result and does not retain them for its own purposes beyond any short period needed for abuse monitoring under its terms with Us.

Deletion record. When You delete Your account, We keep a minimal record that a deletion was requested and completed, identified only by a one-way cryptographic hash of Your account ID rather than Your account ID itself, so that We can show the request was honoured.

8. HIPAA Does Not Apply

moonbelt is a general wellness product, not a healthcare provider, health plan, or healthcare clearinghouse. OriginMind Inc. is not a "covered entity" or a "business associate" under the U.S. Health Insurance Portability and Accountability Act ("HIPAA"). Health Data You record in moonbelt is not protected health information subject to HIPAA, and it is governed solely by this Privacy Policy and Our Consumer Health Data Privacy Policy. Please do not use the Service to store or transmit information that You believe requires HIPAA-level protection, and do not use it as a medical record.

9. Your Privacy Rights

Depending on where You live, You may have the right to access, correct, delete, or export Your Personal Data; to withdraw consent; and to lodge a complaint with Your local privacy authority. To exercise any right, email privacy@moonbelt.ai or use the in-app account deletion option.

How We handle Your request. We verify requests using the email address associated with Your account, so please write from that address. We will respond within 45 days; where reasonably necessary, We may extend once by a further 45 days and will tell You if We do. Exercising Your rights will never result in discrimination or a denial of the Service, though deleting data that a feature depends on may limit that feature.

Appeals. If We decline to act on Your request, You may appeal by replying to Our response or emailing privacy@moonbelt.ai with the subject line "Privacy Rights Appeal". We will respond to Your appeal within 45 days with a written explanation of Our decision. If Your appeal is unsuccessful, You may contact Your state attorney general or Your local privacy authority.

moonbelt does not sell or share Personal Data for behavioural advertising. California residents may submit CCPA requests at the same address. We are a Canadian company, so Our handling of Your Personal Data is also subject to Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), wherever You live. You may raise unresolved concerns with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Washington and Nevada residents: Our Consumer Health Data Privacy Policy describes how We handle consumer health data and the additional rights You have under the Washington My Health My Data Act and Nevada law, including how to exercise them and how to appeal a decision.

10. Deleting Your Account

Go to Profile → App Settings → Delete Account inside the app, or email privacy@moonbelt.ai. Deletion is permanent and cannot be undone. It removes Your profile, meal logs, weight history, steps, workout sessions, sleep sessions, AI coach conversations, and AI coach memory from Our active systems immediately, and copies in Our backups are erased within 30 days. If You want to keep a copy, use Export My Data in App Settings first.

Usage analytics and crash logs linked to Your account are not deleted immediately. They expire under the retention periods in Section 7.

Deleting Your account does not cancel a subscription purchased through the Apple App Store or Google Play. Cancel it in Your store account, as described in Section 7 of Our Terms of Service.

Generic contributions to the shared food database (such as food entries and product photos) and nutrition label scans, described in Section 5, are de-identified on account deletion: the internal link to Your account is removed. Catalog entries and product photos may remain available to other users, as described in Section 8.2 of Our Terms of Service, and label photos remain in private storage.

11. Security

We use TLS encryption in transit, encryption at rest, passwordless sign-in, and least-privilege access controls. No system is entirely secure, but We continuously work to improve Our practices.

A note on sensitive information. The Service lets You record and import health-related information such as weight, body metrics, food logs, allergies, goals, workouts, and sleep. Please consider the sensitivity of what You choose to add. While We protect Your data as described above, no method of storage or transmission is completely secure, and in limited circumstances information may be subject to lawful access by courts, law enforcement, or regulators in jurisdictions where We or Our service providers operate.

12. Children's Privacy

The Service is intended for adults aged 18 and older and is not directed to anyone under 18, as described in our Terms of Service. We do not knowingly collect personal information from anyone under 18, including children under 13 (consistent with the U.S. Children's Online Privacy Protection Act) and anyone under 16 in the EEA and UK.

If You believe someone under 18 has provided Us with personal information, please contact privacy@moonbelt.ai and We will delete the account and associated data.

13. EEA & UK Residents (GDPR / UK GDPR)

If You are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the following additional information applies. OriginMind Inc. is the controller of Your Personal Data.

Legal bases for processing. We process Your Personal Data on the following bases:

Special-category data. Health Data is special-category data under Article 9 of the GDPR. We process it only with Your explicit consent, which You provide when You choose to enter it into the Service. You may withdraw that consent at any time by deleting the relevant data or Your account.

International data transfers. We are based in Canada and use service providers located in the United States and other countries. Where We transfer Personal Data outside the EEA, the UK, or Switzerland, We rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (together with the UK International Data Transfer Addendum) and applicable adequacy decisions. You may request a copy of the safeguards We use by emailing privacy@moonbelt.ai.

Your rights. In addition to the rights described in Section 9, You have the right to lodge a complaint with Your local data protection supervisory authority.

EU / UK Representative. moonbelt is currently offered only to users in the United States and Canada and is not directed to individuals in the EEA, the UK, or Switzerland. Before We offer the Service in those regions, We will appoint a representative under Article 27 of the GDPR and the UK GDPR and identify them here.

14. Canada and Quebec Residents

This section applies to users in Canada, and includes what Quebec's Act respecting the protection of personal information in the private sector asks Us to tell You.

Person in charge of the protection of personal information. The Director of OriginMind Inc. is Our Privacy Officer and is responsible for Our compliance with Canadian privacy law, including Quebec law. You can reach the Privacy Officer at privacy@moonbelt.ai or by mail at the address in Section 16.

Data held outside Quebec and Canada. Our service providers, listed by category in Section 5, store and process Your Personal Data outside Quebec, mainly in the United States. Before We send Personal Data outside Quebec, We assess whether it will be adequately protected, considering how sensitive it is, why it is sent, the safeguards in place, and the privacy laws where it goes, and each provider is bound by a written agreement. Data held in another country may be accessible to the courts, law enforcement, and national security authorities of that country.

Your rights. In addition to the rights in Section 9, You may ask to access and correct Your Personal Data, withdraw Your consent, and receive the data You provided in a structured, commonly used format. Export My Data in App Settings gives You a copy as a JSON file at any time.

Automated processing. Your calorie and macronutrient targets, nutrition insights, and AI coach answers are produced automatically from the information You give Us. They are suggestions, not decisions about You, and You can change Your targets at any time. If You would like to know what information a target or suggestion was based on, or have a person review it, email the Privacy Officer.

Confidentiality incidents. We keep a record of every confidentiality incident involving Personal Data. If an incident presents a risk of serious injury, We will promptly notify the Commission d’accès à l’information du Québec, the Office of the Privacy Commissioner of Canada, and the people affected.

Complaints. Please contact the Privacy Officer first so We can try to resolve Your concern. If We cannot, Quebec residents may file a complaint with the Commission d’accès à l’information du Québec at cai.gouv.qc.ca, and anyone may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.

15. Changes to This Policy

We may update this Policy from time to time. Material changes will be announced through the app or by email before taking effect. Continued use of the Service constitutes acceptance of the updated Policy.

16. Contact Us

OriginMind Inc.
3265 Carding Mill Trail, #415, Oakville, Ontario Canada
Email: privacy@moonbelt.ai