Privacy Policy
Last updated: 15 October 2026
Moodella is a daily mood journal. What you write in it is personal, so the app is built to keep it on your phone: we never receive your journal. This policy says plainly what that means, the few things that do reach us or Google, and your rights.
It applies to the Moodella app for Android (and for iPhone, when it comes) and to the website moodella.com (together, “Moodella”).
1. The short version
- Your journal stays on your phone. Your moods, feelings, notes, readings and reminders are stored and processed only on your device. We receive none of it.
- Backups go to your own Google account, and we can't read them.
- There is no account. You don't sign up, and we don't know who uses Moodella.
- The app downloads one anonymous settings file from us. The request carries nothing about you, and the file is the same for everyone.
- If you buy Pro, Google Play handles the purchase. As the seller, we see your order in Google's Play Console.
- If you email us, we keep your message for 12 months to answer you.
- No ads, no analytics, no tracking, and nothing is ever sold.
2. Who we are
Moodella is provided by Tendanto Ltd (“we”, “us”), a private limited company registered in England and Wales at Companies House under company number 17481182, with its registered office at 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.
Tendanto Ltd is the controller of the personal data described in this policy, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For privacy questions and requests, write to legal@tendanto.com.
If you are in the European Union or the European Economic Area, the EU General Data Protection Regulation (EU GDPR) may also apply to what we hold about you. You then have the rights it gives you, and you can complain to the data protection authority where you live.
3. Your journal stays on your phone
Everything you enter in the app stays on your phone: your days and their moods, the feelings you pick, what helped, what you put off and what weighed on you, the words you add yourself, the readings, your reminder and your settings. The app stores and processes it on the device itself: the daily reading, the patterns and the check that shows helplines if you write certain words all run there, with or without a connection.
None of it is sent to us or to anyone else, except into a backup you choose (see “Backups”) or a file you export yourself. Because we never have your journal, we can't see it, restore it, correct it or delete it for you. On your phone you can read it, change today's entry, restore it from a backup, export it and delete it. Uninstalling the app removes its copy on the phone, but not your backups.
4. Backups in your own Google account
- Android device backup. If backup is on in your phone's settings, Android copies Moodella's journal to your own Google account, about once a day, under Google's terms. It does so only on Android 9 or later and only when your phone has a screen lock, and the backup is then end-to-end encrypted: we can't read it.
- Google Drive backup, if you turn it on in the app. Your journal is saved as dated copies in a hidden folder of your own Google Drive that only Moodella can reach, under Google's terms: each phone keeps its 7 latest daily copies there and one from each of up to 4 earlier weeks, and deletes its older ones when it backs up. Copies from a phone that no longer backs up, or from before Moodella was reinstalled on a phone or its data was deleted while Drive backup was off, stay until you delete them. We never receive any of these copies and can't read them. Unlike the device backup, they aren't end-to-end encrypted: Google keeps them as it keeps your other Drive files. Each Drive backup names the phone model that made it (for example “Pixel 7”), so you can tell your phones' backups apart; you can rename it in the app.
- Export. An export file goes wherever you choose to save or share it.
Uninstalling the app doesn't delete your backups. Delete your data shows how to remove each of them.
5. The settings file the app downloads
While the app is open, it downloads a small file of notices and settings from our server, at most once every six hours. The server is hosted by Hetzner Online GmbH, in Germany. The request carries nothing about you or your phone: no account, no identifier and nothing from your journal. The file is the same for everyone, and the app itself decides which notices apply to it.
Like any server, ours sees the IP address a request comes from. We use it for nothing, and our server's access log doesn't record this request. An address can still appear in the server's error and security logs, which are kept for 14 days to keep the server secure, read for nothing else, and then deleted. The legal basis for those logs is our legitimate interest in keeping the server secure.
The app sends us nothing else: no account, no usage count, no analytics or crash reporting of our own, and no ads. It works the same when our server can't be reached.
6. Google Play: updates, the age check and crash reports
The app asks the Google Play app on your phone whether a newer version of Moodella exists. Google Play handles that check under Google's terms, and nothing reaches us.
Each time the app starts, it also asks Google Play whether you are an adult. Google Play answers only where it shares this information, for example where the law requires it (as in Texas). The answer stays on your phone and is used only for that.
If your phone shares diagnostics with Google, Google shows us crash reports for the app. The app keeps the words of your journal out of them.
7. Buying Pro in Google Play
Google Play handles Pro, under Google's terms. Neither the app nor Google sends our server anything about your purchase: the app checks your subscription with Google Play, on your phone.
As the seller, we can see your order in Google Play Console: the order number, the product, the dates, the price and the country. Google also lets us search orders by the buyer's email address. The sales and earnings reports we download for our accounts list each order and can include your state, city and postcode.
We use your order only for support, refunds, our accounts and tax. The legal basis is our contract with you and our legal duties for accounting and tax. We keep the downloaded reports for as long as UK company and tax law requires: six years from the end of the financial year they relate to. Google keeps its own order records under its own terms.
Play Console also shows us totals, such as how many people installed the app or subscribe. They come from Google, not from the app.
8. Emails to us
If you email us, or send the email that “Report a problem” prepares in your own mail app, we keep your message for 12 months to answer you. Besides a subject and a line asking what happened, “Report a problem” fills in only the app version, your language and, if the app showed you one, an error code; nothing is sent unless you press send in your mail app. Please don't include what you wrote in your journal: we don't need it to help you. The legal basis is our legitimate interest in answering you.
Your email arrives in our mailbox at Zoho Mail, which stores it in the EU. Zoho forwards a copy to our Gmail account, where we read and answer it, so Google holds your email and our replies as well. We delete them from both places as “How long we keep it” says.
Apart from the short-lived logs described under “The settings file the app downloads” and “This website”, these messages and, if you buy Pro, your order are the only personal information about you that we hold.
9. This website
moodella.com is hosted by Vercel, which logs each request to it (IP address, time, page) under its own retention. These are the website's logs, separate from the app. The website has no analytics, no ads and no cookies for tracking.
It remembers the language you choose: in a cookie, moodella_locale (one year), and in your browser's storage (moodella.locale). Clearing your browser data removes them.
A pass link (moodella.com/…/pass#…) carries the pass after “#”, which your browser never sends to the website; the page draws its QR code in your browser. Our staff's admin is not part of this website: it is on our server.
10. What the app stores on your phone
Your journal
- Where
- The app's database on your phone
- What for
- Your days, readings, the words you add yourself, your reminder and your settings.
Pro status
- Where
- Your phone's secure storage
- What for
- What Google Play last said about your subscription, so Pro keeps working for a few days without a connection.
A pass
- Where
- Your phone's secure storage
- What for
- Only if you enter one: it unlocks Pro until its date (see the Terms of Use).
Backup marker
- Where
- Your phone's secure storage
- What for
- A random code that tells this phone's Drive backups apart from your other phones'. It stays on the phone and in the names and properties of its backups in your own Drive, and never reaches us.
The settings file
- Where
- App storage on your phone
- What for
- The last notices and settings the app downloaded, so it works without a connection.
Reminder
- Where
- Your phone's notification system
- What for
- Schedules your reminder on the phone itself; no push server is involved.
“Delete all data on this phone” in the app's Settings removes all of this from the phone, except the Pro status, which Google Play gives back anyway.
12. International transfers
Vercel is based in the United States and may process the website's request logs there and in other countries where it or its subprocessors operate. Vercel Inc. is certified under the UK Extension to the EU-U.S. Data Privacy Framework, which UK law recognises as giving adequate protection to data sent to certified companies.
Zoho Mail stores the emails you send us in the EU; on rare occasions Zoho's staff in India may access them to give technical support, under standard contractual clauses. Google may process the copy in our Gmail account in the United States and in other countries where it has servers. Google LLC is also certified under the UK Extension to the EU-U.S. Data Privacy Framework.
Where one of our providers processes personal data in a country that UK law doesn't recognise as giving adequate protection, the safeguards the UK GDPR requires for such transfers apply, such as standard contractual clauses. Write to legal@tendanto.com for details of these safeguards.
13. How long we keep it
- Your journal: we hold none of it. It stays on your phone and in your backups until you delete it.
- Emails to us: 12 months after the conversation ends, then deleted from both Zoho Mail and Gmail, unless we need them longer for a legal claim.
- Order records: the reports we download for our accounts, six years from the end of the financial year they relate to. Google keeps its own order records under its own terms.
- Our server's error and security logs: 14 days, then deleted.
- The website's request logs: kept by Vercel for the period its service sets.
When the time is up, the data is deleted.
14. Your rights
We hold no journal or usage data about you, and our server holds no subscription record. So most of what you might ask us to show or delete isn't with us: your journal and your backups are yours to export or delete, on your phone and in your Google account. Delete your data shows how.
Besides the short-lived server and website logs described above, what we may have is your emails to us and, if you buy Pro, your order. You can ask to see, correct or delete your emails at legal@tendanto.com. Google Play holds your order; we can look it up by its order number, which is on Google Play's receipt email. Write to legal@tendanto.com with it to see what we have about your order. What our accounts need is kept for as long as the law requires.
Under the UK GDPR you have the right to access the personal data we hold about you and get a copy of it, to have it corrected or erased, to restrict or object to our use of it, and to receive the data you gave us in a portable format.
We answer within one month, free of charge. If a request is complex, or you send us several, we may take up to two more months, and we'll tell you if we do. If we need more information to confirm the request comes from you, the month starts once we have it.
If you're unhappy with how we handle your data, you can complain to us at legal@tendanto.com. We'll acknowledge your complaint within 30 days, look into it, keep you updated and tell you the outcome.
You can also complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk/make-a-complaint. Where the EU GDPR applies to your data, you can also complain to the data protection authority where you live.
15. Security
Your journal is protected by your phone: its screen lock and Android's own encryption. Moodella has no lock of its own, so your journal is only as private as your phone: anyone who can unlock the phone can open the app and read your journal. Android's device backup of the app is made only with a screen lock, end-to-end encrypted. Connections to our server and to this website are encrypted (HTTPS). Our server holds only the settings file and what our staff need to edit it, and our staff sign in with a password and a code from an authenticator app.
No system is perfectly secure. If a breach affects personal data we hold about you, we'll tell the Information Commissioner's Office, and you, as the law requires.
16. Age limit
Moodella is for adults. You must be 18 or over to use it: the app asks you to confirm this when you first open it, and we don't ask for a date of birth. Each time it starts, the app also asks Google Play whether you're an adult; Google Play answers only where it shares this information (see “Google Play”). If you believe someone under 18 has sent us personal data, write to legal@tendanto.com and we'll delete it.
17. Not medical advice
Moodella is a journal, not a medical or health service. It doesn't diagnose anything, and its readings aren't professional advice. If things feel heavy, please reach out to someone you trust or to a professional.
18. Changes to this policy
We don't have your email address, so this page is where we announce changes: we publish the new text here and change the date at the top, and the app may also show a notice about it. If a change is significant, such as a new kind of data reaching us or a new kind of provider, we publish it here at least 30 days before it takes effect.
19. Contact
Moodella is provided by Tendanto Ltd. Email is how to reach us: write to legal@tendanto.com about anything in this policy.