Privacy policy
Effective November 4, 2026
SURI Inc. operates Moya. Contact support@suri.team about privacy, access, correction, deletion, or support.
Who this service is for
The Moya app and parent website are for parents and authorized adult caregivers. They show and manage cloud-connected Moya devices; this iPhone app does not record microphone audio or pair directly with a physical Moya device. Children use the separate Moya device under a parent or guardian’s supervision.
Information we process
We process the identifier and profile information provided by Apple or Google sign-in, account and family memberships, device identifiers and nicknames, transfer and invitation records, settings, and consent choices. We also store device conversation transcripts and responses, topics and timestamps, parent chat messages and responses, and derived AI memory used to maintain conversation context. We do not require a child’s legal name to use the parent app. Avoid entering unnecessary identifying or sensitive information.
Why we use it
We use this information to authenticate users, control access to families, show conversation history and interests, respond to parent questions, apply shared family preferences, manage devices, provide support, and keep the service reliable and secure. Family caregivers can see shared device history and family preferences. Each parent’s chat is private to that account; preferences deliberately saved from chat are shared with the family. Device nicknames do not establish which child was speaking.
AI and service providers
Parent chat sends your message, relevant previous chat or derived memory, shared family preferences, and relevant child-device transcripts to OpenAI for AI responses and, where requested, web search. Moya uses Mastra Cloud for AI application hosting and Supabase for account, database, and storage services, with Vercel hosting the web application. The separate physical-device service can additionally send voice audio or response text to ElevenLabs for speech recognition or synthesis and use LiveKit or gateway infrastructure for transport. These providers may process data outside your country. Provider processing and retention depend on the relevant service configuration and contractual requirements; we do not promise zero retention by every provider.
Your AI choice
Before starting parent AI chat, we ask for explicit permission to send the described data to AI services. You can decline and continue using family records and management, and withdraw permission under Privacy and AI in the app or in the web chat. Withdrawal stops new parent-chat requests; it does not undo completed processing or automatically erase existing history. Physical-device voice use is a separate data-processing flow; changing parent-chat consent does not turn off a Moya device.
Retention and deletion
Device conversation history and shared family data are retained until the family is deleted. Parent chats and derived memory are retained until the account or relevant family is deleted. An account owner must first transfer ownership or delete owned families. Deleting an individual account removes its private data but does not erase a surviving family’s shared device history or preferences. Transferring a device does not move its earlier history to the new family. Backup copies and provider-held records may persist according to their retention and legal requirements; they are not a live history feature. Contact us for deletion assistance or questions about provider-held records.
Your controls
Use family management to review memberships, change shared settings, leave or delete a family, and initiate account deletion. You can request access, correction or deletion at support@suri.team. We may need to verify identity and authority over shared family data. We do not sell personal data or use child conversations for advertising.
Security and changes
We use authentication and family-scoped access controls, limit access to service credentials, and protect network communication in the production service. No service can guarantee absolute security. We update this policy when data practices change and request fresh AI permission when the relevant disclosure changes.