Privacy Policy

Last updated: August 6, 2026 · Applies to: Mochi — Desk Companion for macOS

The short version: Mochi collects nothing, transmits nothing, and has no accounts. The app makes no network request on its own — its one network act is a download you start by pasting a guest-pet link — and you can verify all of it yourself (see below).

1. Data we collect

None.

Mochi has no analytics, no telemetry, no crash reporting service, no advertising, no third-party SDKs, and no user accounts. We do not collect personal information, usage information, device information, or any other category of data. The App Store privacy label for Mochi is “Data Not Collected.”

2. Data that stays on your Mac

Mochi keeps a small amount of information locally on your Mac so the pet can do its job. This information never leaves your computer:

Care data — your pet's name and species, break counts, streaks, and settings.
Activity rhythm — how long you've been active at the screen (derived from system idle timing; Mochi never reads what you type or click).
Signal scores — if you enable camera features, a handful of numbers per glance (eye openness, blinks, brow position, smile, head position) used to learn your personal baseline. Numbers only — never images.
Care actions — water-refill trips you log (a count, never amounts) and the daily rituals you set (times and your custom messages).
Pet identity — a random “genome” number chosen at hatch, your pet's growth points, and a small behavior profile built only from actions you chose (breaks taken, rituals kept, refills logged). Camera-derived signals never feed the pet's appearance or personality — your face can never become a permanent profile. The whole identity can be exported as a “pet passport” file you own.
Agent-wait timing — if you wire a coding agent to the mochi:// link, Mochi stores start/end timestamps of runs so the pet can keep watch and count reclaimed waits. It never sees what the agent did — only that a run happened.

All of it lives in two small, human-readable files inside the app's container (~/Library/Containers/com.ngoan.mochi/…/Application Support/Mochi/): state.json — care data, settings, and signal baselines — and checkins.log, a plain-text log of the numeric scores from each camera read (numbers only, never images), kept so you can inspect exactly what was computed. Open them anytime; delete them anytime. Deleting the app deletes everything.

3. The camera

Camera use is optional and off by default. If you enable it (per-click check-ins, or the opt-in ambient mode), each glance:

lasts a couple of seconds;
is processed entirely in memory, on your Mac, using Apple's on-device Vision framework;
produces only numeric scores — no photo or video is ever written to disk, stored, or transmitted;
is visibly announced: the pet glances up at you at the exact moment the camera is active, alongside macOS's green camera indicator.

Mochi never computes a face template and cannot recognize who is in frame. Nothing it stores is biometric. A shutter toggle in the menu bar disables every camera code path, and ambient mode can be paused or turned off in one click. Ambient glances automatically stop during meetings, screen sharing apps' camera use, low battery, and your quiet hours.

4. The microphone

The microphone permission exists for push-to-talk chat. The mic listens only while you hold the talk button, speech is transcribed on-device by Apple's frameworks, and neither audio nor transcripts are ever stored or transmitted. Release the button and the microphone is off — macOS's orange indicator confirms it either way.

5. The calendar

If you opt in to calendar awareness, Mochi reads event times on-device to stay quiet during meetings and go gentler on meeting-heavy days. Event titles, attendees, and details are never stored, and nothing is transmitted.

6. Guest pets from a link

If you paste a link to a friend's shared pet, Mochi downloads that one file, validates it locally, and keeps the pet on your Mac. The request goes only to the address you pasted — like any download, that site's server sees a standard request from your Mac. Mochi attaches nothing about you to it, makes no other requests, and never phones anywhere on its own. We operate no server and cannot see any of it.

7. Verify it yourself

macOS apps must declare an entitlement for every capability they use. If you have Mochi installed, you can print its permissions at any time — paste this into Terminal (it only prints; it changes nothing):

codesign -d --entitlements - /Applications/Mochi.app

You will find camera, microphone, and calendar entitlements — each gated behind your explicit consent — and a client-network entitlement that exists for exactly one user-initiated act: downloading a guest pet from a link you paste. There is no server entitlement and no request the app makes on its own.

8. Children's privacy

Mochi does not collect data from anyone, including children under 13. There are no accounts, no social features, no advertising, and the app never transmits personal information to anyone — we operate no server that could receive it.

9. Your rights

Because no data ever reaches us, there is nothing for us to access, correct, export, or delete on your behalf — you hold the only copy. To erase everything, delete the app and its container folder.

10. Changes to this policy

If a future version of Mochi ever changes these practices (for example, an optional iCloud sync), this policy will be updated before release, the change will be opt-in, and the version history will note it. The “last updated” date above always reflects the current revision.

11. Contact

Privacy questions: ngoanlearning@gmail.com

Developer: Pham Van Ngoan