Privacy Policy

Last updated: July 2026 — beta draft, pending legal review

Beta draft — pending legal review. This document describes, in plain language, what Moru actually does today. It is not final legal wording and will be replaced by a lawyer-reviewed version before general availability.

We respect your privacy. This Privacy Policy explains what personal data Moru ("we," "us," "our") processes, why, and what choices you have.

1. Who We Are

Moru is self-hosted on our own infrastructure in Falkenstein, Germany (EU). Contact us at [email protected] for any privacy question or request.

2. Information We Collect

Account & authentication: an email address, only if you create an account via magic link or Google sign-in, plus a pseudonymous user ID assigned automatically even for anonymous/guest use.

Camera data: processed entirely on your device for eye-tracking. Raw video frames and the full face mesh (including iris landmarks) are never stored or transmitted — they exist in memory for a single computation and are discarded immediately.

Derived vision & fatigue indicators: numeric measurements only (e.g. blink rate, gaze accuracy, screen distance, head pose, a computed fatigue score, self-reported eye strain) sent to our servers so we can track your progress.

Usage & analytics data: pseudonymous product-usage events, collected only if you opt in.

Device & technical data: device type, OS, browser, screen size, and a coarse country derived from your network location, used for compatibility and quality.

Feedback & support: anything you send us directly (email, in-app feedback), which may include your email address.

3. Camera & Biometric Data — Our Core Guarantee

We never store or transmit your webcam video or your raw facial landmarks. Everything camera-related happens locally, on your device, for as long as it takes to compute a single measurement — then it is discarded.

Only small numeric values ("derived scalars") that describe your eyes and posture leave your device — never an image, never a video, never the raw face mesh.

Because these derived indicators relate to eye health and fatigue, we treat them as sensitive data and only collect them after you give explicit, separate consent — before your first measurement.

4. Why We Process This Information

Provide and improve eye-tracking and vision-training exercises.

Compute your progress, fatigue trends, and Health Score.

Operate your account and, if you opt in, send you service updates.

Understand product usage in aggregate to improve Moru (analytics, opt-in only).

Comply with legal obligations and keep the service secure.

5. Legal Basis (EU/EEA users)

Providing the core service: performance of a contract with you.

Camera-derived health/fatigue measurements: your explicit consent (Art. 9 GDPR), which you can withdraw at any time.

Analytics: your opt-in consent.

Security and fraud prevention: our legitimate interest.

6. Who We Share Data With

Hosting: everything runs on our own servers in the EU (Hetzner, Germany).

Network proxy: Cloudflare fronts our landing page and web app as a TLS-terminating security proxy — it sees your device's IP address and the full content of those requests. Our API host is not proxied through Cloudflare.

Analytics (opt-in only): PostHog Cloud, EU region.

Content delivery: Google Cloud Storage and jsDelivr serve the eye-tracking model and engine files — your device's IP address is visible to them when it downloads these files.

Email delivery: Google Workspace, used to send account-related emails.

We do not sell your data, and we do not share it with advertisers.

7. International Transfers

Your account and measurement data stay in the EU. A few supporting services — our landing page and web app's security proxy (Cloudflare), the eye-tracking model files, and outgoing account emails — are delivered via providers based in or operated from the United States, which means your IP address, request content, or email content may be processed outside the EU for those specific purposes. Our API host is not proxied through Cloudflare.

We rely on appropriate safeguards for these transfers and are working to reduce them further, for example by self-hosting the eye-tracking model files.

8. How Long We Keep Data

We currently keep your data for as long as your account exists. Deleting your account permanently removes your account, measurements, sessions, and feedback from our systems. We are working towards more granular retention limits for each data type.

9. Your Rights

Access the personal data we hold about you.

Correct inaccurate data.

Request deletion of your account and associated data — available today in-app (Settings → Account → Delete account).

Withdraw consent for camera measurements or analytics at any time, without affecting past use.

Object to or restrict certain processing.

Request a copy of your data in a portable format — this export feature is planned but not yet available; contact us in the meantime.

10. Children

Moru is not directed at children. We do not knowingly collect data from children under 16. If you believe a child has provided us data, contact us and we will delete it.

11. Security

Camera data never leaves your device. Account data is stored using industry-standard encryption and access controls. No system is perfectly secure, and we continuously work to improve ours.

12. Changes to This Policy

We will update this page as the product and our practices evolve, and mark a new "last updated" date. Material changes affecting camera or health-adjacent data will ask for renewed consent.

13. Contact Us

Questions, requests, or complaints about this Privacy Policy: [email protected].