Privacy Policy

Overview

Moon is operated by MoonNFT, a company registered in France (“Moon”, “we”, “us”, “our”). Moon is a platform for certifying, collecting, and trading physical artwork on the blockchain. This policy covers the Moon website (moon-nft.com), the Moon app for iOS and Android, and the Moon web apps. It explains what personal information we collect, how we use and share it, and the choices you have. MoonNFT is responsible for (the “controller” of) your personal information.

Information we collect

Sign-in details: the email address or phone number you sign in with. Sign-in is handled by our authentication provider, Privy.

Profile: your name, username, profile photo, and bio. Artists can add an artist statement. Galleries add a gallery name, description, founding date, and commission terms. You can also add a physical address.

Wallet: the address of your crypto wallet. This is either a wallet Privy creates for you or one you connect through WalletConnect. We never see or store your wallet's private keys.

Artworks and activity: photos and details of the artworks you add (title, description, dimensions, location), plus your listings, bids, offers, purchases, sales, gallery deposits and retrievals, likes, follows, notifications, and app settings.

NFC chip scans: when someone scans an artwork's chip, the chip's one-time authentication code is sent to our servers to confirm the artwork is genuine.

Technical data: our servers log IP addresses and request details to keep the service running and secure. The Moon app contains no advertising or analytics trackers, and we do not track you across other companies' apps or websites.

Website forms: the details you send through our contact, application, and newsletter forms.

What is public, and what is permanent

Your public profile (username, name, profile photo, bio, and artist or gallery details) and your wallet address can be seen by anyone. A gallery's address is shown on its profile. We never show anyone else's address.

Blockchain: minting, listing, sales, bids, and gallery custody are recorded on the Ethereum blockchain together with your wallet address. These records are public and permanent. No one, including Moon, can change or delete them.

IPFS: artwork photos, artwork metadata, and profile photos are stored on IPFS, a public file network, through our provider Pinata. Anyone with the link can view them. When you delete your account we remove your profile photo from our Pinata storage, but copies that others have saved on IPFS may remain.

How we use your information

To run the platform: create your account, show your profile and artworks, verify artworks and their gallery custody, and process listings, bids, and sales.

To send you the notifications and emails you asked for, respond to your enquiries, and review artist and gallery applications.

To detect, prevent, and address fraud, security incidents, and misuse of the service.

To comply with our legal obligations and enforce our terms.

Service providers

We do not sell your personal information or share it for advertising. We share it only with providers who help us run Moon, and only for that purpose:

Privy: sign-in, and creating and securing wallets for users who don't bring their own. Privy holds your sign-in email address or phone number.

Pinata: storing files on IPFS.

WalletConnect (Reown): connecting external wallets.

Ethereum node and blockchain explorer providers (such as PublicNode, Alchemy, and Blockscout): reading the blockchain. They receive your wallet address and IP address.

DigitalOcean: our servers and database. Vercel: our web apps. Expo: app update delivery. Amazon Web Services: email delivery. Google: website contact and newsletter form submissions.

We may also disclose information when the law requires it, to protect the rights and safety of our users or others, or as part of a merger, acquisition, or sale of assets.

Deleting your account

In the Moon app, go to Profile → Account settings → Delete account. If you no longer have the app, you can ask us by email. See how to delete your account.

Deleting your account removes your name, username, email address, sign-in link, profile photo, bio, address, wallet link, notifications, likes, and follows, and signs you out everywhere.

We keep an anonymised record of your past sales, bids, gallery custody, and ownership history, shown as “Deleted user”, because these are part of other users' records and each artwork's history. Blockchain and IPFS records cannot be deleted (see above).

You can't delete your account while one of your pieces is at a gallery or on its way to or from one, is listed for sale or in an auction, or while you are the leading bidder in an auction. Resolve these first.

Deleting your Moon account does not delete your wallet. If Privy created your wallet, you can only reach it again by signing back into Moon, so move any funds out first. To have your Privy sign-in and wallet removed as well, email us at [privacy contact email].

How long we keep information

We keep personal information while your account is open. When you delete your account we delete or anonymise it as described above, except where the law requires us to keep it longer (for example for tax, accounting, or dispute resolution). Server logs are kept for a limited period and then deleted.

Your rights

Depending on where you live (for example under the GDPR in Europe or privacy laws in California), you may have the right to access, correct, or delete your personal information, to receive a copy of it, and to object to or restrict certain uses. To exercise these rights, email us at [privacy contact email]. We will respond within the time the law requires. You can also complain to your local data protection authority.

International transfers

Our service providers may process your information in countries other than your own, including the United States. Where the law requires it, we rely on appropriate safeguards such as standard contractual clauses.

Children

Moon is not intended for anyone under 18, and we do not knowingly collect information from children. If you believe a child has given us personal information, contact us and we will delete it.

Security

We use reasonable technical and organisational measures to protect your information, including encryption in transit. No method of transmission or storage is completely secure.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the date at the top of this page. Significant changes will be communicated through the platform or by email where appropriate.

Contact us

Questions about this policy or your data? Email [privacy contact email] or reach out through our contact page and we'll be glad to help.