Private does not mean mysterious.

What you type or say

input scope

Raw text and voice transcripts needed for continuity and support surfaces are processed for product function. We do not treat this as public-facing content.

• Text is the primary signal.
• Voice is optional and can be disabled.
• Face input is optional and can be declined.

What moc. stores

retention scope

We persist session continuity artifacts that are needed for you to continue a thread. We do not keep hidden “lifetime profiles” that turn your session into a surveillance history.

• User-said facts and thread markers.
• Correction history tied to carried items.
• Timestamps and session state needed for safe handoff.

What moc. infers

provisional inference

Inference is low-authority unless you explicitly confirm through ongoing use. Guesses can be wrong, and they do not outrank what you already said.

• Repeat patterns may be surfaced as hypotheses.
• Emotion tags are context-limited.
• No diagnosis is inferred, stored, or surfaced as fact.

What may go to a model provider

processing path

Plain-language: moc. sends a limited, signed request payload to the model provider when a reply is needed. It is the current message, any allowed context for the room, and the safety decision flags needed for stable routing.

• Model endpoints do not receive your old notifications history or deleted materials.
• Provider calls are used for runtime reply composition and safety checks, not behavior profiling.
• Calls are minimized when local policy can answer safely.

Never for ads, feeds, or public ranking

Your session text is not used to train recommendation feeds or public social ranking systems.

• We do not profile your usage to rank or sell content.
• There are no social-feed optimization loops from session text.
• Safety and continuity do not imply behavioral marketing.

Correction, deletion, export

user authority

Corrections are first-class. Deletion and export controls are for the records that are already visible in your surfaces and should be part of your practical safety posture.

• Correct wrong records.
• Pause or remove specific carried items.
• Export what you chose to keep when available.

Camera, microphone, notifications, biometrics

permission-by-permission

Signals are opt-in and purpose-scoped. No permission should feel like a trapdoor.

• Camera: only when facial texture is useful for optional context; never required.
• Microphone: optional; text remains primary and sufficient.
• Notifications: only for specific user-owned threads and only when there is a reply-relevant action.
• Biometrics: optional local unlock for fast return; never used as an inference signal.
• Decline path: the room works with your reply exactly the same way when you skip any optional signal.

App Inference

what is not hidden

If you rely on the app for more than the companion surface, check the runtime behavior where your controls and provider routing live. This page reflects deployed behavior, not aspirational architecture.