Privacy Policy

This Privacy Policy explains what data Momora ("Momora", "we", "us") collects when you use the app, why we collect it, what stays on your own device, and what rights you have. It applies to every part of the app — stories, moments, groups, direct messages, the journal, the Petals wallet, referrals, the wish list, gifting, wellness check-ins, and the founder console — and it should be read together with our Terms & Conditions, especially Section 7 (fraud) and Section 9 (legal positions).

The short honest summary: Momora is built local-first, so much of what you create never leaves your device. What does reach us is either necessary to run your account and the Petals economy, necessary to keep mothers safe, or given with your clear consent. We do not sell your data, we do not run advertising trackers, and we do not feed your posts into advertising models.

Questions or requests about your data go to founder@momora.app — a real person (the founder) reads that inbox.

Account basics: your email, your name, your username, an optional avatar (a small image you upload), and optional details like your baby's name and age in months. Your password is never stored — we keep only a salted scrypt hash, and even we cannot read it.

Content you create: stories and moments you share to the community feed, posts inside groups, wish-list items, reactions and comments, and gift activity. There is an important nuance here — see Section 3, because much of your feed content is stored on your device first, not on our servers.

Your Petals wallet activity: every Petal transaction (signup grants, gifts, referral rewards, cash-outs, refunds) is recorded in an append-only ledger so balances can always be verified and fraud can be traced. If you cash out, we keep the payout record and the minimum payment details needed to send it.

Safety and moderation data: reports you file or receive, moderation decisions and appeals, block relationships, and crisis-resource interactions. Fraud-prevention signals are listed separately in Section 6 because they deserve their own plain-language explanation.

Technical records: your active sessions (login time, device user-agent, and a cryptographic hash of your session token — never the token itself), your in-app email outbox messages, and, if you use it, your E2EE public identity key so other devices can find you.

Momora is local-first by design. Your private journal never leaves your device — it lives in your browser's on-device storage, and we have no copy of it. Your community feed stories are also written to your device first; a story only reaches our servers when the app explicitly syncs it (for example, a moment with a photo upload that the referral program needs to verify).

This is a real trade-off we make deliberately in your favor: because we do not hold your journal, we also cannot back it up, recover it, or hand it to anyone. If you clear your browser storage or use the "Erase everything" option in Settings, that content is gone permanently — there is no server copy for us to restore.

Encrypted conversations go further: direct messages and group conversations are end-to-end encrypted on your device, and our servers store only ciphertext they cannot read. Your device holds the keys; we hold scrambled text.

Direct messages and group chats are end-to-end encrypted: only the members of a conversation can read it. To make this work, your device generates a key pair; the public half is stored on our servers so other moms can encrypt to you, and the private half never leaves your device. Group keys are likewise exchanged device-to-device.

Everything that is NOT end-to-end encrypted is still protected in transit and at rest: passwords are scrypt-hashed with per-account salts, session tokens are stored only as SHA-256 hashes, platform secrets (such as payment-processor credentials) are encrypted with AES-256-GCM, and payout account details are stored in masked form — enough to recognize "Chase ••4821", never enough to misuse.

The honest boundary: end-to-end encryption covers DMs and groups. Community feed posts, wish lists, your profile, and Petal ledger activity are visible to the systems that run the app (that is how moderation, gifting, and payouts work), so treat the public feed like the public space it is.

Petals are recorded in an append-only ledger — entries are never edited or deleted, only corrected with new entries, so your balance can always be audited. This integrity model means we retain Petal transaction history even after other data is deleted, because it is the shared record of value inside the community.

When you add a cash-out method or receive a payout, payment processing is handled by Stripe (currently in a demonstration configuration; live Stripe keys are a launch gate tracked in the founder's go-live checklist). When live keys are on, Stripe receives the details needed to move money — payout account details, amount, and identity information Stripe requires for compliance — under Stripe's own privacy policy. Momora itself stores payout details masked and encrypted.

We keep anti-fraud records of cash-out attempts (including ones our screener flagged and rejected) for the integrity of the Petals economy and to satisfy our obligations under the Terms.

The referral program gives real value (Petals worth real money at cash-out), so it attracts real fraud. To protect the economy every mom relies on, we process a small set of anti-abuse signals when you sign up through a referral link, verify your email, or make your first post. By using the referral program you consent to this processing, as set out in Terms §7.

What we actually use, and nothing more:

• •A device cookie ("momora_did") — a random identifier stored only in a strict httpOnly cookie — so we can tell one browser from another and catch self-referral and device-farm rings.
• •A salted, truncated, one-way hash of your IP address at referral moments — never the raw IP — so we can see "same network" without ever storing where you are.
• •Simple velocity counters (referral rewards per 30 days) and the email-verification and first-post status needed to decide whether a referral qualifies.
• •FraudEvent records when a signal trips, which the founder reviews case by case before any reward is paid.
• •You can decline the referral program entirely: do not use referral links or the Invite a Mom screen, and none of the above applies to you.

To perform our contract with you (the Terms): running your account, showing your content to the community you chose, keeping your Petals balance correct, paying out cash-outs, and delivering service emails like verification and payout notices.

For our legitimate interest in safety and integrity: moderating the community, preventing fraud and abuse, enforcing the community rules, and responding to reports — always balanced against your rights, and with appeals built in.

With your consent: referral fraud signals (Section 6), optional research participation, and anything else the app asks before it does. Where consent is the basis, you can withdraw it and we will stop. Where the law requires it (for example, tax or legal-hold obligations): we comply, and we will tell you when we can.

No advertising networks. No data brokers. No sale of personal data, ever, and no training advertising or recommendation-for-profit models on your content. Momora does not exist to resell mothers' attention.

Processors we rely on to run the app: our hosting and storage (currently local infrastructure during the pre-launch phase), Stripe for payments when live keys are enabled, and email delivery for service mail. Each processes only what the task requires, under contract.

Other members see only what you post where they can see it: your profile and public stories, the groups you join, the DMs you send them, and your wish list if you share it. Moderators may see reported content to resolve reports. The founder console can see account and ledger records to run the economy and safety. We may disclose data to law enforcement only on a valid legal demand, and we push back on overbroad ones.

Sessions expire after 30 days and expired sessions are pruned automatically. Email-verification tokens are single-use and die after 24 hours. Your in-app email outbox keeps service messages (welcome, verification, referral and payout notices) until deleted on your side or housekeeping removes them.

The Petals ledger, moderation decisions, and fraud records are append-only by design and are retained while the Petals economy exists — they are the system of record for real value and for sanctions, and Terms §4 explains how that interacts with your deleted content.

Everything device-local (your journal, your local feed cache, your encryption keys) lives exactly as long as you keep it on your device. Clear it, and it is gone from the world.

You can access and export your data: the app includes in-app export for your blocks and your research data, and you can request a copy of your account, content, and ledger records any time at founder@momora.app. We will provide it in a readable format within 30 days.

You can correct your profile from the app, and you can delete: content you posted, your cash-out methods, and your whole account (Settings → erase, plus account deletion at founder@momora.app). Deletion removes your profile, content, and personal details; append-only integrity records (ledger entries, fraud and moderation records) are minimized rather than erased, as Section 9 explains.

If you are in the EEA/UK, you have GDPR rights of access, rectification, erasure, restriction, portability, and objection, and you can complain to your supervisory authority. If you are a California resident, the CCPA/CPRA gives you the right to know, delete, correct, and opt out of any sale or sharing — and Momora does not sell or share personal information as those laws define it, so there is nothing to opt out of. We never discriminate against you for exercising any of these rights.

Momora is a community of new mothers, and some messages matter more than privacy. If content gives us a reasonable belief of acute risk to a life — yours or a child's — we may surface crisis resources to the people involved, and we may involve emergency services where the law allows and the situation demands it. This exception exists to save lives; it is not a monitoring program, and automated systems do not scan your end-to-end encrypted conversations (they cannot).

Reports of sexual content involving minors are removed without appeal and reported to the authorities and to NCMEC where required by law. Nothing in this policy limits those obligations.

If you are in crisis right now, do not wait for an app: call or text 988 (US) or Postpartum Support International at 1-800-944-4773. The crisis card in More → Safety works offline.

Momora is for adults — you must be at least 18 to have an account (Terms §2). The service is not directed at children, and we do not knowingly collect data from anyone under 18.

If we learn an account belongs to a minor, we suspend it and delete the associated personal data. If you believe a minor is using Momora, tell us at founder@momora.app and we will act on it quickly.

Many of our members post about their babies. We ask — and the community rules require — that parents be thoughtful about their children's images and information, because children cannot consent to a permanent digital footprint.

This policy carries a version stamp (v1.0, effective September 17, 2026) shown at the top of the standalone Privacy Policy page, so you can always see which text governs you. When this policy changes materially, we will notify you in-app and by email before the change takes effect.

Unlike the Terms, this policy does not require a re-acceptance checkbox — it is a disclosure, not a contract. If a future change ever needs your consent (for example, a new optional feature), we will ask for it explicitly, and declining will not break the rest of the app for you.

Privacy questions, data requests, and reports: founder@momora.app. The founder reads and answers this inbox personally, and every data request is answered within 30 days.

Crisis resources are in More → Safety inside the app, always one tap away, and always outside this policy's jurisdiction: 988 (call or text, US) and Postpartum Support International at 1-800-944-4773.