Moonkite Privacy Policy
A Short Version for Kids and Grown-Ups
Moonkite is a podcast app for older kids. A grown-up sets up the family. A child listens inside the boundaries that grown-up sets.
This policy describes the Moonkite app and the Moonkite service it calls, as of October 16, 2026.
- A child profile stores a nickname, a symbol chosen from a short list, an age in years, chosen interests, and whether videos are allowed.
- The app does not ask for a legal name, email address, birthday, home address, school, photo, contacts, or precise location.
- The current app does not offer Sign in with Apple. A grown-up can connect by entering a display name. That connection is a stand-in family account, not an Apple account.
- The 4-digit Grown-ups code stays on the device. The app stores a scrambled form of the code, not the digits, and does not send the code to Cypress Creek.
- Family information is saved on the device. If a device is paired, the Moonkite service also stores that child’s profile, permissions, library, and listening progress.
- Browsing the catalog can send the child’s age in years. That request does not include the nickname.
- A grown-up’s search words go to the Moonkite service, which sends them to Podcast Index.
- Episode audio, artwork, and an optional publisher video load from the podcast’s own web addresses.
- The app has no AI chat. The Moonkite service can send podcast show text, not a child’s profile or listening history, to OpenAI to classify shows. This policy does not state how long OpenAI keeps that text.
- The app includes no third-party advertising or analytics SDK, and it does not use Apple’s App Tracking Transparency prompt.
- Apple’s privacy nutrition labels for Moonkite have not been filled in, and the app project does not include Apple’s privacy manifest file.
- Deleting information in the app clears it on that device. It does not erase copies that may already be on the Moonkite service. A later sync can bring listening progress back from the service.
- Please do not put a legal name, school, address, phone number, or email address in a nickname or a search.
The sections below explain these practices in more detail.
1. About Moonkite
Moonkite is an iPhone and iPad application for listening to podcasts. One app has a child listening mode and a Grown-ups area. The line on the welcome screen is “Follow your curiosity.”
The app is aimed at older kids, with a grown-up who sets boundaries. A profile can store an age from 5 through 17 years.
Setup asks a grown-up to continue before a child profile is created. The grown-up can enter a display name. That step is a product notice. It does not check the grown-up’s identity.
The current app does not ask for an email address and does not sign anyone in with an Apple Account. The Moonkite service has a Sign in with Apple route, and that route responds that Apple sign-in is not configured.
2. Information Stored on the Device
Moonkite saves family information in the app’s local storage on the device.
2.1 Grown-up and child profiles
The app can store:
- an optional grown-up display name;
- a child nickname;
- an avatar chosen from a fixed list of symbols, not a photograph;
- an age in years;
- interests chosen from a fixed list: Science, History, Humor, Animals, Sports, Mysteries, Fiction, and Curiosity;
- an access mode for what that child can browse; and
- whether Watch Video is allowed for that child.
The nickname is typed by the grown-up. The app asks for a nickname, not a legal name.
2.2 Grown-ups code
The grown-up chooses a 4-digit code that keeps the Grown-ups area from opening freely. The app does not save those digits. It saves a scrambled form of the code, and a scrambled form of an 8-digit recovery code. The recovery code is shown once. The current app does not send either code to Cypress Creek.
2.3 Listening, library, and rules
The app stores, on the device, content rules, approval requests, followed shows, saved episodes, listening positions, and a recent-listening list. Listening records can include the episode title and the show title.
A grown-up can copy a support summary to the clipboard. That summary includes the family account id, the grown-up display name, each profile’s nickname and age, device names, and membership status. The app places that text on the clipboard only when the grown-up uses that control. It does not email the summary by itself.
2.4 Device identifiers
The app creates a random device id and stores it in local app settings. It creates a separate random install id, beginning with inst-, and stores it in the device Keychain. These identifiers are not Apple’s advertising identifier.
The device name iOS reports for the phone can be saved in the on-device device list. That name is whatever the phone is called in iOS, which may include a person’s name.
2.5 Paired-device credentials
After a child device is paired, the app stores a credential in the Keychain. That credential can include the install id, device id, family id, child id, device token, refresh token, the child’s nickname, and the time of pairing. The Keychain item is set to stay on this device and to be readable after the device’s first unlock.
A grown-up session token for the Moonkite service is kept in memory. The app does not write that grown-up token into the child-device Keychain.
2.6 Downloads and a local diagnostic log
When someone downloads an episode, the audio file and a small index are stored in the app’s local storage. The file comes from the episode’s publisher address.
The app also writes a diagnostic log in its documents folder. Lines in that log can include the time and the child’s age in years, along with notes about catalog loading. The app does not upload that log to an analytics service.
3. Information Sent to the Moonkite Service
The app is configured to call the Moonkite service at https://moonkite-api.fly.dev. That service runs on Fly.io in the United States. Its database is Postgres, also in the United States. Requests to the service use HTTPS and include a Moonkite app key.
Catalog browsing can happen without a family sign-in. Pairing, sync, and membership calls happen when a grown-up uses those features.
3.1 Catalog requests
To load shows, the app can send the active child’s age in years to the catalog, recommended, and featured routes. Those requests do not include the child’s nickname.
3.2 Fixture grown-up sign-in
A grown-up can sign in by sending a display name. The service creates a family record and a parent record, stores the display name, and marks the account as a stand-in rather than an Apple account. It returns a session token. The service stores a scrambled form of that token, not the token itself. A parent session is set to expire after 30 days. This policy does not say that an expired session row is erased on its own.
Sign in with Apple is not available. The service answers that Apple sign-in is not configured.
3.3 Child profiles on the service
When a grown-up creates a child on the service, the app sends the nickname, the age in years, the avatar symbol, and the chosen interests. The service stores those fields. It also stores an age band derived from the age in years, such as 8–10 or 11–13. It does not ask for or store a date of birth.
3.4 Pairing
To pair a device, the app sends the random install id, the iOS device name, and the platform value iOS. The service returns a 6-digit code and stores a hash of that code. The app tells the grown-up the code expires in about 10 minutes, and the service sets that lifetime. The grown-up confirms pairing by sending the code and the child id. The service can then store the device, including its display name, and issue device tokens. It stores hashes of those tokens. A one-time copy of a new device token is held so the child device can collect it, and that plaintext copy is cleared after delivery.
3.5 Sync and playback checks
A paired device can send and receive, for that child:
- content rules, including the show or episode and whether it is approved or blocked;
- followed show ids and saved episode ids; and
- listening progress, including position, duration, episode title, show title, and a version number.
Before playback, a paired device can send the episode id, show id, whether the publisher marked the episode explicit, Moonkite’s review status for it, whether it is marked unavailable, and a recommended minimum age when the episode has one. The device token lets the service know which child and family the check is for.
3.6 What a later sync can restore
If listening progress is still on the service, a later sync can copy it back onto the device. Clearing listening history on the device does not remove the service copy.
4. Podcasts, Search, and Video
Show and episode information can come from the Moonkite service. If that service cannot be reached, the app can read public podcast RSS feeds directly.
Playing or downloading an episode loads the audio from the publisher address in the feed. Artwork loads from the addresses in the catalog or the feed. Those addresses belong to the podcast publishers, not to Cypress Creek.
Watch Video, when a grown-up has left it on for that child and the episode has a publisher video address, plays that video inside the app. The video request goes to the publisher.
Grown-ups search sends the search words, a result limit, and the language (English) to the Moonkite service. The service sends the search words to Podcast Index at api.podcastindex.org. Podcast Index credentials stay on the server. The app does not put the child’s nickname in the search request. A grown-up could still type personal information into the search box. Please do not do that.
5. Artificial Intelligence
The iOS app does not send a child’s nickname, age, listening history, or search to an AI provider. The app has no AI chat and does not generate podcasts.
The Moonkite service classifies podcast shows with OpenAI to help order the recommended catalog. The model used for that job is gpt-4o-mini. An OpenAI key is set on that service, and the classification job has run against the catalog.
What goes to OpenAI is show information: the show id, title, a short summary, categories, up to eight recent episode titles, language, and whether the feed is marked explicit. It does not include a child’s profile or listening history. A grown-up’s search is not filtered by those classifications.
The Moonkite database keeps the classification results. This policy does not state how long OpenAI keeps the show text. The request does not set a retention period, and no vendor retention term is recorded for it.
6. Membership and Apple
Moonkite includes an optional family subscription through Apple’s StoreKit. Apple processes the payment. The app does not receive the payment card number or the Apple Account email from StoreKit.
When a grown-up starts or restores membership, the app can send Cypress Creek a product identifier, transaction identifiers, and a purchase time. If Apple returns a signed transaction, the app can send that signed transaction and say whether it came from Apple’s test store or the production store. A purchase tried in Xcode’s test store still uses a stand-in check.
The service can store those subscription fields. A finished production membership — a real App Store purchase checked and applied as an active family membership — is not described here as complete.
Apple’s handling of App Store and payment information is governed by Apple’s own privacy policy.
7. Information Moonkite Does Not Ask For
The app does not ask a child or a grown-up to provide:
- a legal name, other than whatever someone types into a nickname, a grown-up display name, or a search;
- an email address;
- a date of birth;
- a home or school address;
- precise location;
- a photograph, camera image, or microphone recording;
- contacts; or
- an advertising identifier.
The app’s information list does not include a location, contacts, photo, camera, microphone, or tracking permission.
Moonkite does not include a public gallery, comments, child messaging, or user-to-user sharing.
8. Children and Grown-Ups
Moonkite is made for families with children. The listening experience is the child’s. Profiles, rules, pairing, and membership sit in the Grown-ups area, behind the 4-digit code.
That code is a gate inside the app. It is not a check of the adult’s identity, and it is not a separate parental-consent form.
A children’s-privacy legal review for Moonkite is not finished. This policy does not say that Moonkite complies with the Children’s Online Privacy Protection Act.
Parents and guardians can use the deletion controls in section 10 and can write to privacy@cypresscreekventures.com about information the Moonkite service holds.
9. How Long Information Stays
On the device, profiles, the Grown-ups code hash, rules, requests, libraries, and listening history stay until a grown-up deletes them with the controls in section 10, or until the app’s data is removed.
Downloaded audio stays until that download is removed in the library, or the app is removed. “Delete all family data on this device” does not delete downloaded audio files, and it does not delete the diagnostic log.
On the Moonkite service, no retention period is set for family profiles, listening progress, device rows, subscription records, or show-classification results. There is no automatic deletion of those rows. Ending a membership does not start a deletion timer. A pairing code is set to expire after 10 minutes. A parent session is set to expire after 30 days. Device sessions stay until a grown-up revokes the device. This policy does not say that an expired session row is erased on its own.
If you email us about privacy, we may keep that correspondence for as long as we need it to read the request and to meet legal duties. We do not state a fixed number of days.
10. Deleting Information
In Grown-ups → Account & privacy, a grown-up can:
- Delete listening history on this device. That clears recent listening and resume positions on the device. Profiles, rules, and requests stay. If the service still has listening progress, a later sync can restore it.
- Delete all family data on this device. That removes on-device profiles, the Grown-ups code, rules, requests, libraries, and listening history, and returns the app to first-launch setup. It also clears the paired-device Keychain credential on that device. It does not delete downloaded audio, the diagnostic log, or records already stored on the Moonkite service.
- Revoke a paired device. That asks the service to revoke that device’s session.
The iOS app does not include a control that deletes the family from the Moonkite service.
To ask about server-side records, email privacy@cypresscreekventures.com. The family account id shown under Account & privacy can help locate a family without using a child’s legal name. We may ask for enough information to tell which family the request is about. This page does not promise a reply time.
11. Advertising and Tracking
The Moonkite app project includes no third-party advertising SDK and no third-party analytics SDK. It does not use Apple’s App Tracking Transparency framework, and it does not request the advertising identifier.
The app project does not include an Apple privacy manifest (PrivacyInfo.xcprivacy). App Store privacy nutrition labels have not been filled in App Store Connect. This policy does not describe labels that are not entered.
Moonkite has no feature that sells personal information or that shares it for advertising.
12. Security
Calls to the Moonkite service use HTTPS. Child-device credentials and the install id are stored in the Keychain for this device. The Grown-ups code is stored as a salted hash. The service stores hashes of session tokens and pairing codes rather than the raw secrets, except for the one-time device-token delivery described above.
These measures reduce the chance of unauthorized access. They are not a promise that every system is immune to compromise.
13. Privacy Rights
Depending on where you live, you, a parent, or a guardian may have rights to access, correct, or delete personal information, or to object to certain uses.
Because the current app does not use an email login, we may need the family account id from Account & privacy, or something else that identifies the installation, to find records.
Write to privacy@cypresscreekventures.com. This page does not set out a separate notice for each state or country. The app project does not name the storefronts where Moonkite is offered.
The in-app deletion controls are described in section 10. They clear information on that device. They do not, by themselves, delete the service copies.
14. This Webpage
This privacy policy is a static page. It does not include an advertising or analytics script.
The page title, the site header, and the site footer use Libre Baskerville, loaded from Google Fonts, so the browser requests font files from Google. The policy text uses the device’s system sans.
The host may keep ordinary technical logs needed to deliver and protect the page. This policy does not state how long those logs are kept.
15. Changes to This Privacy Policy
We will update this policy when Moonkite’s information practices change, and we will change the Last updated date when we do.
The practices above are the ones in the Moonkite app and the Moonkite service it calls, as of October 16, 2026. A later version that turns on Sign in with Apple, finishes production purchase verification, or uses information differently needs an update here before those practices are described as current.
16. Contact Us
Questions about Moonkite privacy can be sent to:
Cypress Creek Ventures LLC
426 Westport Avenue, Suite 1100
Norwalk, Connecticut 06851-4423
United States
