Privacy

MoonNod uses your information to help you list items and rooms, contact other members, and keep the marketplace safe.

What other people can see

Your published listing text, photos, price, building or neighborhood, display name, and membership month are public. A UMD email badge means you verified access to that email address; it does not verify your identity or a listing.

We remove recognizable phone numbers, street addresses, unit numbers, and door codes from listing text. Automated checks can miss details. Review your listing before publishing. Emails and links you put in a description remain public.

Photos are public too. We remove embedded metadata, including location tags, but we do not automatically blur faces, addresses, documents, or other details visible in the picture.

Your account and conversations

Your sign-in email is not displayed on your profile. We store it to send sign-in codes and manage your account. Our email provider processes those emails. A session cookie keeps you signed in and remembers your chosen area and up to five recent areas. Posting, messaging, saving and AI require an 18+ declaration. We record its time and policy version, not your birth date or identity documents. This is a declaration, not verified age.

Conversations are available to their participants and are not end-to-end encrypted. We record which messages you have seen so unread counts work; the other participant does not see it. We mask recognizable phone numbers, addresses, unit numbers and door codes, but checks can miss details. Do not send passwords, financial information or private home details. Arrange to meet at a public place.

When reporting a conversation, you can choose up to three messages and confirm that you want to share them with moderators. Moderators see the submitted report and selected messages, rather than a view of your whole conversation.

Saved listings and searches

Your saved listings and saved searches are private to your account in the app. Saved searches keep your filters, filtered search words, and when you marked results seen so we can show new matches. When a new listing fits one of your saved searches or housing requests, we note the match for you; it is deleted with the search, the request, the listing or your account. Recognizable personal details are removed from search words, but avoid putting personal information in a search.

New-match notices appear on the site. Saving a search does not sign you up for email alerts.

Trips

Trips are visible only to signed-in members, because travel plans say when people are away. A trip shows its title, the places as you typed them (phone numbers and addresses are removed), dates and times, vehicle, seats, contribution and your display name. When you ask to join, the organizer sees your display name, what you offered and your note; once accepted, the people going on the same trip see each other's display names and collection slots, except where one has blocked the other. If the organizer declines you, your response stays with the trip so you cannot ask to join it again. A pickup request started from a listing links to that listing while it is available. Votes on suggested dates show as counts. A trip's group discussion is seen only by the organizer and the people they accepted. When you ask for a ride, we note offers going the same way so you can see them under My trips.

Drafts and optional AI assistance

Manual entry, selected pasted items and accepted assistant facts use private drafts. Draft photos stay private until publication. It filters recognizable contact details, addresses and access codes before saving. It also removes emails, links and handles from that draft. Review what remains: automatic filtering does not catch every personal detail. Pasted text waiting for sign-in and unsent draft fields stay in your browser tab for up to a day; signing out or closing the tab clears them.

AI writing and book lookup are off unless enabled for this site. Saving or reopening a draft does not contact either service. Before AI writing, we show the item facts and ask permission to send them to Google Gemini. We do not add your account details or photos to a text-writing request. Separate photo assistance asks permission for up to two images you select; visible labels or personal details may remain in their pixels. Photo assistance keeps its proposed facts with your draft until you accept them or the draft is removed. Shopping assistance interprets your search, then shows current database listings. Reply assistance asks separately before sending explicitly selected messages and listing facts; you edit and send replies yourself. Paste suggestions, when enabled, ask on the review page before sending the masked text of that one post (with recognizable phone numbers, addresses, unit numbers, door codes, emails, links and handles removed) to Google Gemini; your account details and photos are not sent. Gemini returns suggested details with the words it read them from, and we show only suggestions your post states word for word. A suggestion changes your draft only when you choose it. We record counts for each request (how many details were kept, which kinds of field you used, the cost and time), not your text or the suggested values. AI cannot publish or send on your behalf. Shopping conversation state stays in the current tab until you reset it or close the tab. The configured Google service may retain inputs for abuse monitoring.

Book lookup asks separately for permission to send an ISBN to Open Library. It does not send your draft text, account details or photos. Public book details may be cached for seven days; you choose which details to add to your draft. Neither feature publishes for you.

Location and maps

“Use my current location” works only after you choose it. Your browser uses device coordinates to suggest public areas, and you confirm an area before it changes your search. MoonNod does not receive or store those coordinates.

On screens wider than 800 pixels (a phone turned sideways can be one), item and housing offers show a map by default when public locations are available; on narrower screens the map loads only after you choose Map. Maps load OpenStreetMap tiles; that provider receives your network address and the viewed map area. Maps do not request your device location. Markers use public complexes or approximate neighborhoods, never private unit locations. The map covers the current results page; listings without map locations stay in the list.

Feedback

“Help improve MoonNod” saves the problem, confusing experience or idea you submit, an optional screenshot you choose, and minimal page context. It does not automatically attach conversations, drafts, precise location or full search URLs. Your receipt and staff review are private. Missing-area corrections and safety reports use separate review paths. Review screenshots for private details before attaching them.

Optional email notices

A new account starts with email notices for new messages turned on, and the page after you first sign in says so. Accounts created before then keep the choice they had, which is off unless they turned notices on. One button in Email notifications turns them off, or back on. When notices are on and sent for this site, our email provider receives your email address and a link to the conversation, without the message text, listing title or sender's name. Opening the conversation still requires sign-in.

Email notices for trip updates are a separate choice on the same page, with their own button, and start off. They tell you that one of your trips needs you (a new response, the organizer's answer, a changed or cancelled plan, or a new ride offer that fits your request); messages in a trip's group are not emailed. Our email provider receives your email address and a link to the trip page, without the trip's title, places, times, other members' names or any message. To show the count of trip updates on the site, we keep when you last opened each of your trips.

Turning notices off cancels those waiting to be sent. An email already sent or being sent cannot be recalled. Sign-in codes are separate from this preference.

Usage and safety records

We keep limited activity records to measure whether the site works and prevent abuse. These usage events hold filtered search text without an account or session identifier; search and activity records, described next, are separate. Searches you choose to save are linked to your account, as described above. Removing identifiers does not guarantee anonymity: timestamps may still connect activity.

During a task test the team runs with you, the site keeps a record of what your browser does on MoonNod under a label like P1, after you have agreed; it never links that label to your name.

Search and activity records

To improve search and suggestions, MoonNod records each page of results it shows you: your filtered search words and filters, which listings it showed and in what order, and how long the search took. It also records what you do next: which listings you open and how long a listing page stays on your screen, which result cards were on screen for at least a second, and when you save a listing or a search, copy a listing's link, report a listing or start a conversation about it. When you mark your own listing sold you can say how it went and, for an item, what it sold for; both are optional, and the price is never shown on the listing. MoonNod also keeps the history of each listing's price, category, area, photo count and state.

For each conversation MoonNod keeps a record of when it started, when the other person first replied, how many messages each of you sent, when the last one was sent, and whether it was blocked or reported. Five days after you start a conversation, Messages asks you once whether it worked out: answering is optional, the other person never sees your answer, and nothing is sent by email. The conversation record and your answer stay after the messages themselves are deleted. These records never contain your messages, your email address or other contact details.

When you are signed in, these records are linked to your account. When you are signed out, they are linked to neither you nor your browser, and signing in later does not connect them to you. A result link carries a short code for the search that showed it; the listing page removes it from the address, and it is never sent to our analytics service.

These records are used to improve MoonNod. Research use, including copies of the records for the MoonNod research team, happens only if you opt in with Help MoonNod research on your account page. Research copies replace your account with a random ID that changes with every copy. If you opt out, you are left out of later copies and your records from before then are deleted at the next daily cleanup; a copy made while you were opted in cannot be recalled.

When you publish a listing that started from a pasted post or from suggested text, MoonNod records which details it suggested, whether you kept, changed, added or removed each one, how many times the draft was saved and how long it took from start to publication. For the title and description it keeps only their lengths, unless you opted in to research: then it also keeps the suggested and published wording and the masked text of the post you pasted. Previewing a pasted post, signed in or not, is counted without the text or anything about you: only how many items and rooms it found and its rough length.

MoonNod may test a change to what you see, such as the order of some search results, only with members who opt in to research, and only after the team turns that test on. Each test is planned before it starts. Members who opt in are put in a group at random, and the records say which group you were in and when you first met the change. Opting out ends every test for you at once. No test is running now.

To prevent misuse of sign-in emails, we keep protected hashes of the recipient address and network address for two days. These are not plain addresses, but they are not anonymous. They remain after sign-out or account deletion so those actions cannot reset sending limits.

Our hosting providers process network addresses and request information to deliver and protect the service. We do not use advertising cookies or sell your personal information.

Services that handle your information

• Resend sends sign-in codes and, when email notices are on, those notices.
• Google Cloud hosts the site, its database, listing photos and logs.
• Sentry receives reports of errors on our servers: the kind of page, your browser type, whether you were signed in and where in our code the error happened. Reports never include your messages, email address, what you typed, the page's full address or your IP address. Errors in your browser are not sent to Sentry.
• Cloudflare provides the site's DNS. It also forwards email sent to support@moonnod.com and abuse@moonnod.com to the team's inbox. Messages you send there are kept in that inbox, not in MoonNod.
• OpenStreetMap serves map tiles to your browser, as described under Location and maps.
• Open Library and Google Gemini receive only what you agree to send, and only when book lookup or AI features are enabled for this site, as described under Drafts and optional AI assistance.

How long information stays

• Sign-in code records and separate sending-limit records expire after two days. A code itself expires after ten minutes.
• Signed-in sessions last until thirty days after your last visit, unless you sign out or delete your account.
• Published listings, whether active, reserved, sold, expired or hidden by a moderator, stay until you delete them, which moves them to Trash as described below, or delete your account. Expiry does not remove a listing.
• Saved listings and searches stay until you remove them or delete your account. Unavailable saves stay hidden and may be cleared; they disappear when the listing is permanently removed.
• Unfinished listing drafts and their photos expire thirty days after the draft was started; the date is shown with the draft, and saving does not extend it. Assistant drafts and book-lookup history expire thirty days after their last update.
• Deleting a listing hides it immediately and keeps it in private Trash for seven days, including recoverable photos. After that, its content and photos are removed by cleanup. Conversations can continue with a generic unavailable-listing label. They expire ninety days after the last message, or sooner if a participant deletes their account.
• Product feedback and its screenshot expire ninety days after resolution or one hundred eighty days after submission, whichever comes first. Area suggestions have the same maximum period.
• Usage events expire after two years (730 days).
• Search and activity records, listing histories, how-did-it-go answers and sale prices, conversation records and did-this-work-out answers, records of how you corrected suggested details, and test groups expire after 730 days, even when the conversation or listing they describe is gone sooner.
• Server error reports stay for the period set in our Sentry project. They carry no link to your account or session.
• Trips, the responses to them, their date polls, discussions and ride alerts are deleted thirty days after the trip's date passes; a trip with no date yet is deleted sixty days after its last change.
• Safety reports stay while unresolved, then expire ninety days after resolution.
• Completed email-notice records expire one day after completion. Older writing/ISBN use-limit records expire after one day. The shared model cost ledger keeps the current UTC month and rolling-day window, whichever is longer; uncertain attempts keep their cost reservation. Paste-suggestion counts expire after thirty days; deleting your account removes their link to you. Email-notice limits expire after twenty-five hours.

Expired records are removed by scheduled cleanup. Deleting your account removes your listings, the trips you organize, your places, votes and discussion messages on other trips, listing drafts and their photos, photo-assistance proposals, conversations, saves, assistant drafts, search and activity records, conversation records on either side and research choice, revokes sessions, and clears your profile details, adult declaration and notification preference. Retained product feedback loses its account/session links and follows its separate retention period. Photo files are queued for deletion. Short-lived use-limit records keep counts after their account links are cleared; safety reports remain for the period above. Account deletion cannot retract emails or data already sent to a provider. Backups may retain deleted information until their retention period ends.

Your choices

You can browse without an account, edit your listings, remove photos and saves, control email notices, block another member, and delete your account from Your account. Use the report link on a listing, trip or conversation to flag exposed personal information or abuse. For a takedown or a data request without an account, write to support@moonnod.com.