Privacy Policy
Last updated: 26 September 2026
Moodella is a daily mood journal. What you write in it is personal, so the app is built to keep it on your phone: we never receive your journal. This policy says plainly what that means, the few things that do reach us or Google, and your rights.
It applies to the Moodella app for Android (and for iPhone, when it comes) and to the website moodella.com (together, “Moodella”).
1. The short version
- Your journal stays on your phone. Your moods, feelings, notes, readings and reminders are stored and processed only on your device. We receive none of it.
- Backups go to your own Google account, and we can't read them.
- There is no account. You don't sign up, and we don't know who uses Moodella.
- The app downloads one anonymous settings file from us. The request carries nothing about you, and the file is the same for everyone.
- If you buy Pro, Google Play handles the purchase. As the seller, we see your order in Google's Play Console.
- If you email us, we keep your message for 12 months to answer you.
- No ads, no analytics, no tracking, and nothing is ever sold.
2. Who we are
Moodella is provided by Tendanto Ltd (“we”, “us”), a private limited company registered in England and Wales at Companies House under company number 17481182, with its registered office at 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.
Tendanto Ltd is the controller of the personal data described in this policy, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For privacy questions and requests, write to legal@tendanto.com.
If you are in the European Union, the EU General Data Protection Regulation (EU GDPR) may also apply to what we hold about you. You then have the rights it gives you, and you can complain to the data protection authority where you live.
3. Your journal stays on your phone
Everything you enter in the app stays on your phone: your days and their moods, the feelings you pick, what helped, what you put off and what weighed on you, the words you add yourself, the readings, your reminder and your settings. The app stores and processes it on the device itself: the daily reading, the patterns and the check that shows helplines if you write certain words all run there, with or without a connection.
None of it is sent to us or to anyone else, except into a backup you choose (see “Backups”) or a file you export yourself. Because we never have your journal, we can't see it, restore it, correct it or delete it for you. On your phone you can read it, change today's entry, restore it from a backup, export it and delete it. Uninstalling the app removes its copy on the phone, but not your backups.
4. Backups in your own Google account
- Android device backup. If backup is on in your phone's settings, Android copies Moodella's journal to your own Google account, about once a day, under Google's terms. It does so only on Android 9 or later and only when your phone has a screen lock, and the backup is then end-to-end encrypted: we can't read it.
- Google Drive backup, if you turn it on in the app. Your journal is saved as dated copies in a hidden folder of your own Google Drive that only Moodella can reach, under Google's terms: each phone keeps its 7 latest daily copies there and one from each of up to 4 earlier weeks, and deletes its older ones when it backs up. Copies from a phone that no longer backs up, or from before Moodella was reinstalled on a phone or its data was deleted while Drive backup was off, stay until you delete them. We never receive any of these copies and can't read them. Unlike the device backup, they aren't end-to-end encrypted: Google keeps them as it keeps your other Drive files. Each Drive backup names the phone model that made it (for example “Pixel 7”), so you can tell your phones' backups apart; you can rename it in the app.
- Export. An export file goes wherever you choose to save or share it.
Uninstalling the app doesn't delete your backups. Delete your data shows how to remove each of them.
5. The settings file the app downloads
While the app is open, it downloads a small file of notices and settings from our server, at most once every six hours. The server is hosted by Hetzner Online GmbH, in Germany. The request carries nothing about you or your phone: no account, no identifier and nothing from your journal. The file is the same for everyone, and the app itself decides which notices apply to it.
Like any server, ours sees the IP address a request comes from. We use it for nothing, and our server's access log doesn't record this request. An address can still appear in the server's error and security logs, which are kept for 14 days to keep the server secure, read for nothing else, and then deleted. The legal basis for those logs is our legitimate interest in keeping the server secure.
The app sends us nothing else: no account, no usage count, no analytics or crash reporting of our own, and no ads. It works the same when our server can't be reached.
6. Google Play: updates, the age check and crash reports
The app asks the Google Play app on your phone whether a newer version of Moodella exists. Google Play handles that check under Google's terms, and nothing reaches us.
Where the law requires it (for example in Texas), the app also asks Google Play whether you are an adult. The answer stays on your phone and is used only for that.
If your phone shares diagnostics with Google, Google shows us crash reports for the app. The app keeps the words of your journal out of them.
7. Buying Pro in Google Play
Google Play handles Pro, under Google's terms. Neither the app nor Google sends our server anything about your purchase: the app checks your subscription with Google Play, on your phone.
As the seller, we can see your order in Google Play Console: the order number, the product, the dates, the price and the country. Google also lets us search orders by the buyer's email address. The sales and earnings reports we download for our accounts list each order and can include your state, city and postcode.
We use your order only for support, refunds, our accounts and tax. The legal basis is our contract with you and our legal duties for accounting and tax. We keep the downloaded reports for as long as UK company and tax law requires: six years from the end of the financial year they relate to. Google keeps its own order records under its own terms.
Play Console also shows us totals, such as how many people installed the app or subscribe. They come from Google, not from the app.
8. Emails to us
If you email us, or send the email that “Report a problem” prepares in your own mail app, we keep your message for 12 months to answer you. Besides a subject and a line asking what happened, “Report a problem” fills in only the app version, your language and, if the app showed you one, an error code; nothing is sent unless you press send in your mail app. Please don't include what you wrote in your journal: we don't need it to help you. The legal basis is our legitimate interest in answering you.
Apart from the short-lived logs described under “The settings file the app downloads” and “This website”, these messages and, if you buy Pro, your order are the only personal information about you that we hold.
9. This website
moodella.com is hosted by Vercel, which logs each request to it (IP address, time, page) under its own retention. These are the website's logs, separate from the app. The website has no analytics, no ads and no cookies for tracking.
It remembers the language you choose: in a cookie, moodella_locale (one year), and in your browser's storage (moodella.locale). Clearing your browser data removes them.
A pass link (moodella.com/…/pass#…) carries the pass after “#”, which your browser never sends to the website; the page draws its QR code in your browser. moodella.com/admin is for our staff only.
10. What the app stores on your phone
Your journal
- Where
- The app's database on your phone
- What for
- Your days, readings, the words you add yourself, your reminder and your settings.
Pro status
- Where
- Your phone's secure storage
- What for
- What Google Play last said about your subscription, so Pro keeps working for a few days without a connection.
A pass
- Where
- Your phone's secure storage
- What for
- Only if you enter one: it unlocks Pro until its date (see the Terms of Use).
Backup marker
- Where
- Your phone's secure storage
- What for
- A random code that tells this phone's Drive backups apart from your other phones'. It stays on the phone and in the names and properties of its backups in your own Drive, and never reaches us.
The settings file
- Where
- App storage on your phone
- What for
- The last notices and settings the app downloaded, so it works without a connection.
Reminder
- Where
- Your phone's notification system
- What for
- Schedules your reminder on the phone itself; no push server is involved.
“Delete all data on this phone” in the app's Settings removes all of this from the phone, except the Pro status, which Google Play gives back anyway.
12. International transfers
Vercel is based in the United States and may process the website's request logs there and in other countries where it or its subprocessors operate. Vercel Inc. is certified under the UK Extension to the EU-U.S. Data Privacy Framework, which UK law recognises as giving adequate protection to data sent to certified companies.
Where one of our providers processes personal data in a country that UK law doesn't recognise as giving adequate protection, the safeguards the UK GDPR requires for such transfers apply, such as standard contractual clauses. Write to legal@tendanto.com for details of these safeguards.
13. How long we keep it
- Your journal: we hold none of it. It stays on your phone and in your backups until you delete it.
- Emails to us: 12 months after the conversation ends, then deleted, unless we need them longer for a legal claim.
- Order records: the reports we download for our accounts, six years from the end of the financial year they relate to. Google keeps its own order records under its own terms.
- Our server's error and security logs: 14 days, then deleted.
- The website's request logs: kept by Vercel for the period its service sets.
When the time is up, the data is deleted.
14. Your rights
We hold no journal or usage data about you, and our server holds no subscription record. So most of what you might ask us to show or delete isn't with us: your journal and your backups are yours to export or delete, on your phone and in your Google account. Delete your data shows how.
Besides the short-lived server and website logs described above, what we may have is your emails to us and, if you buy Pro, your order. You can ask to see, correct or delete your emails at legal@tendanto.com. Google Play holds your order; we can look it up by its order number, which is on Google Play's receipt email. Write to legal@tendanto.com with it to see what we have about your order. What our accounts need is kept for as long as the law requires.
Under the UK GDPR you have the right to access the personal data we hold about you and get a copy of it, to have it corrected or erased, to restrict or object to our use of it, and to receive the data you gave us in a portable format.
We answer within one month, free of charge. If a request is complex, or you send us several, we may take up to two more months, and we'll tell you if we do. If we need more information to confirm the request comes from you, the month starts once we have it.
If you're unhappy with how we handle your data, you can complain to us at legal@tendanto.com. We'll acknowledge your complaint within 30 days, look into it, keep you updated and tell you the outcome.
You can also complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk/make-a-complaint. Where the EU GDPR applies to your data, you can also complain to the data protection authority where you live.
15. Security
Your journal is protected by your phone: its screen lock and Android's own encryption. Android's device backup of the app is made only with a screen lock, end-to-end encrypted. Connections to our server and to this website are encrypted (HTTPS). Our server holds only the settings file and what our staff need to edit it, and our staff sign in with a password and a code from an authenticator app.
No system is perfectly secure. If a breach affects personal data we hold about you, we'll tell the Information Commissioner's Office, and you, as the law requires.
16. Age limit
Moodella is for adults. You must be 18 or over to use it: the app asks you to confirm this when you first open it, and we don't ask for a date of birth. Where the law requires it, the app also asks Google Play whether you're an adult (see “Google Play”). If you believe someone under 18 has sent us personal data, write to legal@tendanto.com and we'll delete it.
17. Not medical advice
Moodella is a journal, not a medical or health service. It doesn't diagnose anything, and its readings aren't professional advice. If things feel heavy, please reach out to someone you trust or to a professional.
18. Changes to this policy
We don't have your email address, so this page is where we announce changes: we publish the new text here and change the date at the top, and the app may also show a notice about it. If a change is significant, such as a new kind of data reaching us or a new kind of provider, we publish it here at least 30 days before it takes effect.
19. Contact
Moodella is provided by Tendanto Ltd. Email is how to reach us: write to legal@tendanto.com about anything in this policy.