Privacy Policy

Effective September 17, 2026

Mood Street ("we", "us") is a market-sentiment game operated from France. You swipe on stocks, indices, commodities, and crypto; the market grades each call one trading day later. This policy explains what personal data the Mood Street iOS app and moodstreet.ai collect, why, and the rights you have over it. Questions any time: [email protected].

Who is responsible for your data

What we collect

• Account details: your first and last name, username, country, email address (the one you sign in with, whether by email and password, Google, or Apple), and phone number (verified by SMS, and optional: you can skip it and add it later).
• Your date of birth: the date of birth (day, month, year) you enter at sign-up. We use it to check the minimum age and to send you a birthday greeting. It is never shown to other users. The minimum age is 16, or 18 if the country of your Apple App Store account is the United States, and we also store the fact that your date of birth puts you at or above it.
• Contacts, only if you allow it: to help you find friends, the app converts the phone numbers in your address book into SHA-256 hashes on your device. Those pseudonymised SHA-256 hashes are sent to our servers solely to match registered users, and are not retained after the lookup. The raw phone numbers, names, and emails in your address book never leave your phone. A hash is a pseudonym rather than anonymous data, so we treat it as personal data while we hold it. So that friends can find you the same way, your own verified phone number is stored on our servers as a hash in a lookup index, and it is deleted with your account. You can decline this permission and use everything else.
• Profile photo and Floor images: pictures you choose to upload are stored on Firebase Storage. Your profile photo and an optional story cover photo are shown to other users, and images attached to Floor posts are shown to everyone who can see the post. Image links are public, so anyone with the link can open the picture. Anyone can ask us to take an image down through the image report form, and a person reviews every report.
• Private messages: text messages you send to a friend in the app are stored with that conversation and shown only to the two of you. They are filtered automatically for slurs, the friend can report or block you, and they are deleted with your account. Messages are text only.
• Posts, comments, likes, and reposts on The Floor: what you publish, including any position or call you attach to a post, together with your display name and profile photo, plus the reports you file and the users you block.
• Your activity in the game: the calls you cast, including super swipes, when they resolve, your Mood Coins, accuracy record, card preferences, your watchlist, the price alerts you set, the cards dealt to you, how long you looked at each card (first-party engagement data stored on your account, used to tune your deck), and your portfolio holdings and trades.
• Feedback messages: if you send feedback from the app, we store the message with your account id, category, app version, and a reply address (your verified account email, or one you type in, if any), and email it to the founder together with your display name.
• Your notification choices: which categories of push notification you have switched on or off, and the version and date of the terms you accepted.
• Device and diagnostics: a push-notification token (Firebase Cloud Messaging) and your device time zone. The token is created when the app starts, because phone-number verification uses a silent push, and it is stored on your account once you sign in, whether or not you allow visible notifications; visible notifications are sent only if you allow them, and the token is removed when you sign out or delete your account. We also collect crash and performance reports via Firebase Crashlytics, which are tied to a device identifier and not to your name. We run no third-party usage analytics: Firebase Analytics is switched off in the app. Network infrastructure processes your IP address transiently to deliver the service. The one exception is the report form on this website, described just below, where we keep a one-way hash of your network address for 90 days so the form cannot be flooded.
• Waitlist: if you join the waitlist on this site, we store the email address you submit and use it to write to you about Mood Street's launch, and for nothing else.
• Reports sent through this website: if you use the form at moodstreet.ai/report-image to ask us to take an image down, we store what you write, the link you give us, your email address so we can send you a receipt and tell you what we decided, and a one-way hash of your network address so the form cannot be flooded. You do not need an account to send a report. We keep the report itself as a moderation record while we act on it and for as long as we may need to account for the decision, and the hash of your network address stays on that record for the same time; the separate anti-abuse counter built from it is deleted after 90 days. Write to [email protected] with your reference number if you want a copy of your report or want it corrected.

What's visible to other users

Mood Street is a competitive game. Your display name, username, country flag, profile photo, accuracy percentage, Mood Coin balance, rank, and a Pro badge if you have earned one appear on leaderboards, and any signed-in user can open your public profile to see the same details plus your swipe record and portfolio picks. Posts and comments you publish on The Floor, and comments you leave on stories, are visible to everyone using the app, together with your display name and profile photo. Private messages are visible only to you and the friend you sent them to. Your email address, phone number, and date of birth are never shown to anyone.

Notifications

Push notifications fall into five categories: results (how your calls resolved, and the morning digest), social (friend requests and adds, comments, likes, story activity, and your birthday greeting), alerts (the price alerts you set yourself), nudges (streak and comeback reminders), and market movers (a rare heads-up when an asset makes a real move behind real news).

Market movers are selected for you, not broadcast. We choose them from the assets in your simulated portfolio, the assets on your watchlist, the preferences you set for your deck, and assets similar to those (same kind of asset, same region, comparable size). If a day's moves match nothing you hold, watch, or asked for, we send you nothing. The selection runs on our own servers, on your account data alone: no advertiser or other third party takes part in it, and we never sell this data.

You can switch each of the five categories off on its own, at any time, in Account settings under Notifications, and you can turn notifications off for the whole app in iOS Settings. Switching a category off stops those notifications and changes nothing else about your account.

Why we process it (legal bases)

• To run the service (contract): accounts, calls, scoring, leaderboards, friend features, and The Floor.
• With your consent: contact matching, push notifications (including the market movers we select from your portfolio, watchlist, and deck preferences, and the birthday greeting), waitlist emails, and the photos you upload. You can withdraw each at any time (iOS Settings for permissions, the notification switches in Account settings, and, for waitlist emails, by replying to any message or writing to [email protected]).
• Our legitimate interests: keeping the game fair (abuse and manipulation prevention), moderating The Floor and acting on reports, securing the service, and fixing crashes and performance problems. When we match your address book, we look up the numbers of people who are not Mood Street users only to answer the single question "is this person already here", we keep no record of the ones that do not match, and we balance our interest in letting you find friends against those people's interests.
• Legal obligation: keeping moderation records and answering lawful requests from authorities.

Who processes data for us

• Apple (Sign in with Apple): receives your sign-in identifier.
• Google Firebase and Google Cloud (authentication and SMS verification, the Firestore database, Cloud Functions, Cloud Storage for profile photos and Floor images, Cloud Messaging for push notifications, and Crashlytics for crash and performance reports): processes everything the app stores, on our instructions.
• Financial Modeling Prep (market data): receives stock symbols only, never anything about you.
• Anthropic, OpenAI, Google, OpenRouter, and Hugging Face (the AI models behind the analyst desk and the news summaries): receive stock symbols, public prices, and public news only, never anything about you, your calls, or your portfolio.
• Resend (email delivery for waitlist emails, feedback, and report notifications): receives your email address, display name, and account id when you write to us or file a report, and the email address you give us for the waitlist.
• Cloudflare, Inc. (hosting for the moodstreet.ai website you are reading): processes your IP address transiently to serve the page.
• Google Fonts (the typeface on this website): receives your IP address when your browser loads a font file from Google's servers.

These providers process data on our instructions and are bound by data-processing terms. The website sets no cookies and loads no third-party scripts; it does load its typeface from Google Fonts, which sees your IP address when the page opens.

Where your data is stored

Our database sits in Paris (Google Cloud region europe-west9). Our Cloud Functions currently run in the United States, so data transits the United States on every read and write, and email delivery, crash reporting, and website hosting also involve United States providers. Google LLC is certified under the EU-US Data Privacy Framework, and transfers to it rely on the European Commission's adequacy decision of 10 July 2023, with the Commission's Standard Contractual Clauses as a fallback. Transfers to our other United States providers rely on the Standard Contractual Clauses and equivalent safeguards.

How long we keep it

Your data is kept while your account exists. Your date of birth is kept for as long as your account exists and is deleted with it, like the rest of your profile. Delete your account any time in the app (Account → Delete Account): this permanently removes your profile, calls, friend connections, score history, sign-in identity, your Floor posts together with their comments and likes, the comments you left on other posts and stories, the private messages you sent, your profile photo and uploaded images, your entry in the phone lookup index, and your block list from our systems. The hashes made from other people's address books are never stored, so there is nothing to delete there. Three things stay behind, and here is exactly what they are. The likes and the bull or bear reactions you left on other people's posts and stories stay as rows keyed by your account id, carrying that id, the date, whether it was a like or a bull or a bear call, and which post or story it was on. Those rows stay readable inside the app, the way any like or reaction on public content is, but once the account is deleted that id resolves to no person, no name and no profile, so what is left is the fact that somebody reacted, not who. A block another person set against your account stays on that person's own block list, so their decision to block is not undone by an account deletion and a blocked account cannot come back. And if a post or an image of yours is the subject of a report, and you delete that post or your whole account, we move that single item out of public view, into a private place no other person can read, and keep it for up to a year from the report, because we have to preserve reported content while a complaint is being handled, while an appeal is still possible, and while the law requires us to keep it. Closing the report does not shorten that year. A job runs every day and deletes that material as soon as the year is up, together with the internal note that said where it was kept and which account it came from; the report itself stays as a moderation record. Everything else goes. You can also delete any of your Floor posts in the app without deleting your account, and unless a report is holding that post, deleting it is the end of it. Feedback messages and reports are kept as moderation records so we can act on them and reply, and reports sent through the form on this website are kept the same way, with the anti-abuse counter built from the reporter's network-address hash deleted after 90 days; write to [email protected] if you want the reply address removed from a feedback message. Crash reports expire automatically after 90 days, engagement data after 90 days, and operational logs on rolling schedules. Waitlist emails are kept until you opt out.

Security and data breaches

We protect your data with encrypted transport, access rules enforced on the server, and a small number of administrative accounts protected by two-factor authentication. If a breach of security affects your personal data and is likely to result in a risk to your rights, we notify the CNIL within 72 hours of becoming aware of it, and we tell you directly, without undue delay, when the risk to you is high. New Zealand users: see the New Zealand section below for the parallel commitment under the Privacy Act 2020.

Your rights

Optional deactivation: Account → Deactivate account retains your account and associated data with a deactivated status. Sign-in, account actions and notifications stop. Previously shared content remains visible. Contact [email protected] to request reactivation or permanent deletion. Deactivation is not erasure. The separate permanent-deletion option remains available before deactivation; afterwards you can request deletion through support.

Website signup confirmation: entering an address requests a confirmation email, not campaign enrollment. Only confirmed addresses are included in our mailing-list export. Confirmation requests and hashed network-address quota records expire within two days. Failed transactional emails are held in a private retry queue; unresolved sends are flagged for review.

Under the GDPR you can ask for access to, correction of, deletion of, or a portable copy of your personal data, object to or restrict certain processing, and withdraw consent. Write to [email protected] and we'll respond within one month. You can also lodge a complaint with your data-protection authority: in France, the CNIL (cnil.fr).

United States

If you are in the United States, this section applies to you in addition to the rest of this policy. We do not sell your personal information and we do not share it for cross-context behavioural advertising, and we never have. We show no ads, we run no third-party usage analytics, and we use no advertising identifiers, so there is nothing to opt out of. We do not knowingly collect the sensitive categories that state privacy laws single out: precise geolocation, biometrics, health data, race, religion, union membership, or immigration status. Private messages you send to friends in the app are stored so the conversation can be delivered and shown to the two of you; we do not read them except when a message is reported or caught by the automatic slur filter, and we never sell or share them.

Wherever you live in the United States, you can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it, by writing to [email protected] or by deleting your account in the app. We answer within 45 days. We do not charge for this and we will not treat you differently for asking. If you want an authorised agent to make the request for you, tell us and we will verify it with you directly.

Minimum age in the United States: 18. If the country of your Apple App Store account is the United States, you must be 18 or older to create an account, which is higher than the minimum of 16 that applies elsewhere. The app is not directed at children, we do not knowingly collect personal information from children under 13 within the meaning of the Children's Online Privacy Protection Act, and we do not knowingly collect personal information from anyone under the minimum age that applies to them. If you believe a child, or anyone under that age, has created an account, write to [email protected] and we will delete the account and the data attached to it.

New Zealand

If you are in New Zealand, the Privacy Act 2020 applies to us because we carry on business in New Zealand, and we handle your personal information under the information privacy principles, including principle 3A on information we collect about you from someone else. When another user's address book tells us that a phone number is already registered with us, we hold only a hash for the length of the lookup and keep no record of numbers that do not match, which is how we meet principle 3A in practice.

You can ask us for access to your personal information and for corrections (principles 6 and 7) at [email protected], and we will reply within 20 working days. Our Privacy Officer, appointed under section 201 of the Act, is reachable at the same address.

Some of the providers listed above process your information outside New Zealand, mostly in the United States and in France. Google and Apple hold that information as our agents and only on our instructions, and where information is disclosed to a provider for its own purposes we take reasonable steps to satisfy ourselves that it is protected by safeguards comparable to those in the Privacy Act, which is how we meet principle 12. If we have a privacy breach that is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and the people affected as soon as practicable. You can complain to us first, and then to the Office of the Privacy Commissioner at privacy.org.nz.

The minimum age to create an account in New Zealand is 16. See the Age section below.

Mainland China

The Service is not offered to residents of mainland China and is not directed at the mainland Chinese market. We do not market the app there, we do not offer it in Chinese, we do not select mainland China as an App Store territory, and we do not analyse the behaviour of people located in mainland China. If you are in mainland China, please do not create an account.

Age

You must be 16 or older to create an account, and 18 or older if the country of your Apple App Store account is the United States (see the Terms of Use). We ask for your date of birth once, at sign-up, to check this. We do not knowingly let anyone under the minimum age that applies to them create an account, we do not knowingly collect their data, and if we identify such an account we close it and delete the data attached to it.

European Union. Article 8 of the GDPR lets each member state set the age of digital consent anywhere between 13 and 16, so a minimum of 16 is at or above that age in every member state. Everyone who can use Mood Street in the European Union can therefore consent for themselves: we do not rely on a parent or guardian's consent and we run no parental consent flow.

New Zealand. The minimum age is 16, and no parental consent step applies.

Changes

If we change this policy in a meaningful way, we'll update the date above and tell you in the app before the change applies.