PRIVACY POLICY — MOOSY
Last updated: July 5, 2026

This Privacy Policy describes how Moosy ("we", "us") handles the
personal data of people who use the Moosy application, the moosy.app
website and related services (together, the "Service"), in accordance
with the Brazilian General Data Protection Law (Law No. 13,709/2018 —
LGPD). It forms part of our Terms of Service.

1. WHAT DATA WE COLLECT

1.1. Data you provide:
- Access request: name and e-mail (waiting list).
- Account: name, e-mail and password (stored encrypted — never in plain
  text).
- Financial data you record in the app: income, expenses, recurring
  entries, assets and investments, goals, contributions and settings
  (e.g., emergency-fund months). This data is entered by you; we do not
  connect to banks and do not collect financial data automatically.
- Invites: the e-mail addresses of people you invite to shared accounts.

1.2. Data collected automatically:
- Minimal technical records of access and usage needed to operate and
  secure the Service (e.g., authentication and error logs).
- Language preference, stored only on your device.

1.3. What we do NOT do:
- We do not sell or rent your personal data.
- We do not show ads or use your data for advertising.
- We do not use marketing trackers in the app.
- We do not access your bank or brokerage accounts.

2. HOW WE USE THE DATA

- To operate the Service: authentication, synchronization and display of
  your data on your devices and to the members you have authorized.
- Operational communications: invites, password reset, waiting-list
  access release and important notices about the Service.
- Security: prevention of fraud, abuse and unauthorized access.
- Compliance with legal and regulatory obligations.

Legal bases (LGPD): performance of a contract (art. 7, V), legitimate
interest in securing and improving the Service (art. 7, IX), compliance
with legal obligations (art. 7, II) and consent where applicable
(art. 7, I).

3. SHARING

We share data only with:
- Members of your shared accounts: the financial data of a shared
  account is visible to all members you invited or whose invitation you
  accepted.
- Infrastructure providers strictly necessary to operate the Service:
  hosting and database (Amazon Web Services) and transactional e-mail
  delivery. These providers process data on our behalf under security
  obligations.
- Authorities, when required by law or court order.

Market quotes: to display prices, the app queries public quote APIs
sending only asset codes (tickers, e.g. PETR4) — never your personal
data or positions.

4. STORAGE AND SECURITY

- Data is stored on Amazon Web Services servers.
- Traffic between the app and our servers is protected by token-based
  authentication; passwords are stored with cryptographic hashing.
- We adopt technical and organizational measures proportional to the
  risk; no system, however, is 100% immune. In the event of a relevant
  security incident, we will notify affected users and the Brazilian
  data protection authority (ANPD) as required by law.

5. RETENTION AND DELETION

- We keep your data for as long as your account exists.
- You can delete shared accounts (as owner) in the app itself — deletion
  removes that account's data for all members.
- You can request permanent deletion of your user account and its
  associated data at any time, in the app or via the contact e-mail
  below. After deletion, data is removed, except for retention required
  by law (e.g., access logs under the Brazilian Internet Framework).
- Waiting-list data is kept until access is granted or you request
  removal.

6. YOUR RIGHTS (LGPD)

You may request, at any time: confirmation of processing, access,
correction, anonymization, portability, information about sharing,
review of automated decisions (we do not make automated decisions with
legal effects), withdrawal of consent and deletion of data. To exercise
your rights, write to the contact e-mail below. We will respond within
the timeframes set by the LGPD.

7. CHILDREN AND TEENAGERS

The Service is intended for people aged 18 or older. We do not knowingly
collect data from minors; if we identify an account belonging to a
minor, it will be removed.

8. INTERNATIONAL TRANSFER

Our infrastructure providers may store data on servers located outside
Brazil (e.g., the United States). In such cases, the transfer follows
the mechanisms provided by the LGPD and contracts with adequate
protection clauses.

9. CHANGES TO THIS POLICY

We may update this Policy to reflect changes in the Service or in
legislation. Relevant changes will be communicated in the app or by
e-mail. The date of the last update appears at the top of this document.

10. CONTACT

Controller: Moosy.
Questions, requests and exercise of rights: contato@moosy.app.