NotesMosAIc ("we", "us") is operated by Randy Marcelin. This policy explains what we collect, why, and your rights.
What we collect
Account data: email address, username, and (if you sign in with Google) your Google profile name/avatar.
Date of birth: asked once, so the experience matches your age. We keep it with the age range it puts you in.
Content you create: notes (their text and the pictures, recordings and files you add), the games and apps you build and their saved data, shared metadata (title, thumbnail), and what you write to others — comments and messages.
Usage data: which sims you generate/play, non-identifying analytics via Firebase Analytics and Sentry for crash reporting.
Technical data: like any web service, our servers receive your IP address and the basic details of each request (the page or action, the time, your browser or app version), used to keep the service secure and working. If you turn notifications on, we keep your device's push token.
Advertising data (Free and Basic plans only): when an ad plays in a natural break of a game — in the iPhone app (Google AdMob) or on
our website (Google AdSense) — Google receives your device's information to show and measure that ad. On iPhone, the advertising identifier
is shared only if you allow tracking when iOS asks; otherwise ads are not personalized. We record that a break was shown, so the game's
creator can be paid their share; we do not give Google your name or email. Plans without ads see none.
We do not collect: geolocation, contact lists, or payment card numbers (Apple, Google or Stripe handles payment).
How we use it
Run the product (generate sims from your notes, save your work, sync across devices).
Send notifications you opt into (sim plays, stars, remixes).
Improve the sim generation pipeline (aggregated, non-identifying).
Who sees your data
Supabase (database + auth) — hosted in the US.
DeepInfra (AI inference, US-hosted) — the text and images you submit for a build, an edit, or a chat are sent to DeepInfra to run the AI model and return your result. See AI processing below.
Amazon Web Services (S3 storage, CloudFront delivery) and Cloudflare — store and deliver your games' files and media.
Hostinger — hosts the application server that handles your requests.
Replicate (US) — only when you ask for a 3D model from a prompt or a picture: that prompt or picture is sent to run the model.
Web search (Brave Search, DuckDuckGo) — when our AI engineers look something up for your build, the search words go to a search service, without your account.
Apple, Google Play and Stripe — payments and subscriptions. We receive your plan and its dates, never your card.
We do not sell your personal data, and advertisers never receive your name or email.
AI processing
NotesMosAIc turns your notes and prompts into working builds, and answers your questions in Mosa chat, using AI. To do that:
What we send: only the note text, prompt, chat message, or image you submit for that specific request — plus the limited context needed to produce a good result (for example, the build you are currently editing). We do not send unrelated notes or your whole account.
Who runs the models: our AI inference provider, DeepInfra (US-hosted), which handles text generation, image understanding, and the embeddings that power in-app search and retrieval. Two narrow exceptions: a 3D model you ask for runs on Replicate, and a web lookup goes to a search service (see Who sees your data). Each processes your request and returns the result under its own terms. If we ever change or add a provider, this page will reflect it.
Training: we do not use your content to train AI models, and we do not sell it. Your content is sent solely to produce your result, not to build a dataset.
Accuracy: AI output can be wrong, incomplete, or unexpected. Treat generated builds and chat answers as a starting point, not verified fact — see our Terms.
Connected AI apps
You can connect your own AI app — Claude, ChatGPT, Gemini, Cursor, VS Code or any app that speaks the Model Context Protocol — to your account (how). When you do:
You choose what it can do: the sign-in screen lists each permission — for example reading your notes, or editing and publishing your games — before you allow it. It reaches only your own account, never anyone else's, and nothing it can do moves money.
Where your data goes: what the app reads or creates through NotesMosAIc (a note's text, a game's files, a check report) goes to that app and to the AI provider behind it (for example Anthropic, OpenAI or Google), under that provider's own terms. We don't control what they keep.
What we keep: the connection itself (the app, the permissions you allowed, when it was last used) and a short record of each action it takes (which action, whether it worked, when) — never the content. The app's access tokens are stored only as one-way hashes.
Disconnect any time: in the app, Profile → Connected agents. The connection ends at once, and so does every token it held.
Age
NotesMosAIc is intended for users aged 13+. We do not knowingly collect personal information from children under 13.
Your rights
Delete your account and everything in it at any time (Profile Settings → Delete Account).
Export a note as a PDF, or a game's project as a .zip, from the note itself. For a copy of anything else we hold about you, email us.
Your account, notes, games and what you made: until you delete them. Deleting a note or a game removes it at once. Deleting your account removes your profile, your notes, your games and their files, your saves in other people's games, your messages, your follows and your connected AI apps at once, and signs you out everywhere. A report you filed about someone else's content stays for moderation without your name on it.
A connected AI app (ChatGPT, Claude and others): its access lasts 8 hours and renews itself for up to 30 days of use; a personal token lasts 90 days unless you choose longer (at most 365 days). Disconnecting ends both at once. We keep the record of what a connected app did — the action, the time, whether it worked; never your content — for 90 days, and the record of an ended connection for 30 days.
Server logs: our web server's request logs are kept 15 days, and the application's own logs 30 days. They name account and note ids and what a request did; they are used to keep the service running and to investigate abuse.
Payments: we never see your card. Apple, Google and Stripe keep their own records under their policies; we keep your plan and when it renews or ends for as long as you have an account.
Backups: our database provider keeps rolling backups for a limited period; a deleted account leaves them as they roll off.
Analytics and crash reports: kept by Firebase and Sentry for the retention periods of those services.
Cookies + storage
We store a Supabase auth token in your browser's localStorage so you stay signed in. On our website, Google AdSense may use cookies to show
and measure ads on Free and Basic plans; where the law requires consent (the EEA, the UK, Switzerland), it is asked for before ad cookies or
personalized ads are used. You can change ad personalization at adssettings.google.com, and on
iPhone under Settings → Privacy & Security → Tracking.
Changes
If this policy changes, we'll update the date above and notify active users via email before the change takes effect.