Privacy Policy

1. Who we are

Mossen is operated by Mossen LLC, an Oregon limited liability company (“Mossen,” “we,” “us,” or “our”). Our registered office is in Portland, Oregon. This policy explains how we collect, use, share, and protect information when you use the Mossen mobile application and this website (collectively, the “Service”).

You can reach us with privacy questions at admin@mossen.app.

2. What this policy covers

This policy applies to information we collect through the Service — the Mossen mobile app for iOS and Android and the mossen.app website. It does not apply to third-party services you access through Mossen (for example, if you tap a link that opens Google Maps or Apple Maps, that separate service’s privacy policy applies to your use of it).

3. Information we collect

We collect the following categories of information:

(a) Information you give us directly

• Account information. Your email address and, depending on how you sign in, your name and profile photo from Apple or Google. If you sign in with email, we send you a one-time code and record that you signed in.
• Profile information. Your display name, chosen neighborhood, city, and metro area. You choose what to share here; none of it is required beyond the minimum needed to identify you to neighbors.
• Content you post. Shares you list (title, description, price, photos, category, deadline, and pickup location), Stashes you drop, Gatherings you host or attend, Rides you post or join (ride type, origin neighborhood or address, destination, departure date and time window, seat count, cost per person, payment preference, notes), messages you send to other users, and any comments or reactions.
• Communications. Emails you send to us and in-app support requests.

(b) Information we collect automatically

• Device information. Device model, operating system version, app version, language, and time zone.
• Log data. IP address, timestamps of requests, referring URLs, error diagnostics.
• Usage data.How you interact with the Service — screens visited, features used, actions taken. We use this to understand which features matter and to find and fix bugs.
• Location data.When you use location-aware features (dropping a Stash, unlocking a Stash near you, or browsing shares near your neighborhood), we collect precise or approximate location from your device with your permission. You can turn off location access at any time in your device’s system settings.
• Push notification tokens. If you opt in to push notifications, we store an Apple Push Notification Service or Google Firebase Cloud Messaging token so we can send you notifications. Revoking notification permission in your device settings invalidates the token.

(c) Information from third parties

• Sign-in providers. If you use Sign in with Apple or Sign in with Google, that provider shares a limited profile with us (name and email address) so we can create your Mossen account. We receive only what you explicitly consent to share during sign-in.
• Geocoding services.When you enter a location, we send it to a mapping provider (Mapbox) to convert it into coordinates and back. Mapbox’s handling of your location query is governed by its own privacy policy.

4. How we use your information

We use the information we collect to:

• Operate, maintain, and improve the Service.
• Show you shares, Stashes, and users in your metro and neighborhood.
• Send notifications you’ve opted into (new messages, claimed shares, nearby Ambient stashes, etc.).
• Facilitate communication between you and other users (marketplace messaging, meetup coordination).
• Enforce our Terms of Service, protect the safety of the community, and address fraud or abuse.
• Comply with legal obligations, respond to lawful requests, and defend our rights.
• Understand product usage in aggregate (which features are used, where errors happen) to improve the Service.

We do not sell your personal information. We do not share your information for cross-context behavioral advertising. We do not use your information to train large-language models or other machine-learning systems.

5. How we share your information

We share information only in these limited ways:

(a) With other users, as part of the Service

Mossen is a marketplace. When you list a share or drop a Stash, other users in your metro can see the information you chose to make public: the item’s title, description, price, photos, pickup neighborhood (a general area, not a street address, until you match with a specific participant), and your display name and profile photo. When you match on a specific share, the pickup address and message history become visible to the participants of that share.

(b) With service providers acting on our behalf

We share information with vendors who help us run the Service. These providers are contractually restricted to processing your information for us and to security and confidentiality obligations. They include:

• Supabase— database hosting, authentication, and file storage.
• Mapbox— maps, geocoding, and map tile delivery.
• Apple and Google— sign-in providers (when you use Sign in with Apple or Sign in with Google) and push-notification delivery.
• Expo— app-update infrastructure and build tooling.
• Northwest Registered Agent— registered agent for our LLC, which receives legal service of process on our behalf.

(c) For legal reasons

We may disclose information if we have a good-faith belief that disclosure is required by law, subpoena, or court order, or is necessary to protect the rights, property, or safety of Mossen, our users, or the public.

(d) In connection with a business transaction

If Mossen is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of company assets, your information may be transferred as part of that transaction. We’ll notify you of any such change in ownership or control of your personal information.

6. Where your information is stored

Your information is stored primarily on servers located in the United States, operated by our infrastructure providers. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. See Section 12 (Users in the European Economic Area, United Kingdom, and Switzerland) for the transfer safeguards we rely on.

7. How long we keep information

We keep information for as long as your account is active and for a reasonable period after (typically up to 90 days) to allow account recovery and to comply with legal obligations, resolve disputes, and enforce our agreements. You can request deletion earlier by contacting us; see Section 8.

Aggregated, de-identified data (which cannot reasonably be used to identify you) may be retained longer for analytics and product improvement.

8. Your rights and choices

Regardless of where you live, you can exercise these rights by emailing admin@mossen.app from the address associated with your account:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Delete your account and associated data (subject to the retention window in Section 7 and any legal requirements to keep certain records).
• Download a copy of your personal information in a portable format.
• Withdraw consent for any processing based on your consent (for example, revoking location or notification permission at the device level).
• Opt out of receiving non-essential communications (product update emails, marketing). Transactional messages (account security, service notifications) will continue as long as you use the Service.

We’ll respond to requests within the timeframes required by applicable law (typically 30–45 days). We will not discriminate against you for exercising any of these rights.

9. California residents (CCPA / CPRA)

If you’re a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) gives you the following rights:

• Right to know what personal information we collect, use, disclose, and sell or share.
• Right to delete personal information we collected from you.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing of personal information. Mossen does not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of.
• Right to limit use of sensitive personal information. We do not use sensitive personal information for any purpose beyond what is necessary to provide the Service.
• Right to non-discrimination for exercising these rights.

Categories of personal information collected in the past 12 months: identifiers (email, name), commercial information (share history), internet or network activity (usage logs), geolocation data, sensory data (photos you upload), professional information (none), inferences (product preferences based on usage).

Categories disclosed for a business purpose in the past 12 months: identifiers, commercial information, internet or network activity, and geolocation data, disclosed to the service providers listed in Section 5(b) for the purpose of operating the Service.

Categories sold or shared in the past 12 months: none.

Exercise your California rights by emailing admin@mossen.app with “California Privacy Request” in the subject line. You may designate an authorized agent to submit requests on your behalf; we’ll require proof of authorization and verification of your identity.

10. Residents of other US states with comprehensive privacy laws

If you live in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Tennessee, Iowa, Delaware, New Hampshire, New Jersey, Minnesota, Maryland, or any other US state with a comprehensive privacy law, you generally have the following rights:

• Right to access, correct, and delete your personal data.
• Right to obtain a portable copy of your data.
• Right to opt out of targeted advertising, sale of personal data, and certain profiling. Mossen does not do any of these, so there is nothing to opt out of.
• Right to appeal our response to a privacy request.

Exercise these rights the same way as the CCPA rights above: email admin@mossen.app from the address associated with your account. If you disagree with our response, you may appeal by replying to our response email; if the appeal is denied, you may contact your state attorney general.

We honor the Global Privacy Control (GPC) signal as an opt-out request for jurisdictions where it is legally-recognized as such.

11. Nevada residents

Nevada residents have the right under NRS 603A to opt out of the sale of certain personal information. Mossen does not sell personal information as defined by NRS 603A. If you would like to submit an opt-out request anyway, email admin@mossen.app.

12. Users in the European Economic Area, United Kingdom, and Switzerland

If you are located in the EEA, UK, or Switzerland, this section applies. The controller of your personal data is Mossen LLC, contactable at admin@mossen.app.

Legal bases for processing

We rely on the following legal bases under the GDPR:

• Performance of a contract— to provide the Service you signed up for.
• Legitimate interests— to prevent fraud, improve the Service, and maintain security. Where we rely on legitimate interests, we’ve considered your rights and interests and concluded they are not overridden.
• Consent— for optional features like precise location and push notifications. You can withdraw consent at any time by changing device permissions.
• Legal obligation— to comply with applicable law.

Your rights

In addition to the rights described in Section 8, you have the right to lodge a complaint with your local supervisory authority if you believe our processing violates the GDPR.

International transfers

Your personal data is transferred to and stored in the United States, which the European Commission does not currently deem to provide an adequate level of data protection. For these transfers, we rely on the European Commission’s Standard Contractual Clauses with our service providers as an appropriate safeguard under Article 46 of the GDPR. You can request a copy of the SCCs by emailing admin@mossen.app.

13. Children

Mossen is intended for adults. We do not knowingly collect personal information from anyone under 18 years of age. If you believe a person under 18 has provided information to us, contact us at admin@mossen.app and we’ll delete the account and information promptly.

14. Security

We use industry-standard technical and organizational measures to protect your information: encryption in transit (HTTPS/TLS), encryption at rest for sensitive stored data, access controls on our infrastructure, and least-privilege practices for internal access. No system is perfectly secure, though, and we cannot guarantee absolute security.

If we learn of a security breach affecting your personal information, we’ll notify you and applicable authorities as required by law.

15. Do Not Track and Global Privacy Control

The web version of the Service does not respond to traditional “Do Not Track” browser signals, as there is no consensus standard for how sites should respond. We do respect the Global Privacy Control (GPC) signal in jurisdictions where it is legally recognized as an opt-out request.

16. Third-party links and services

The Service may contain links to third-party websites or services. Those third parties operate independently of us, and their handling of your information is governed by their own policies. We are not responsible for the practices of third parties.

17. Changes to this policy

We may update this policy from time to time. When we make material changes, we’ll update the “Last updated” date at the top and, for significant changes, we’ll notify you through the app or by email before the change takes effect. Your continued use of the Service after the change means you accept the updated policy.

18. Contact us

Questions, requests, or concerns about this policy or our privacy practices? Email admin@mossen.app.