⚖️ Moava Terms of Service

Article 1 (Purpose)

These Terms of Service govern the rights, obligations, and responsibilities between the individual operator of Moava (the “Operator”) and users of Moava’s portfolio management, investment analysis, and related services (the “Services”).

Article 2 (Definitions)

1. “Services” means the investment portfolio tracking, return analysis, financial data visualization, and other related services made available to members through Moava.
2. “Member” means a person who accesses the Services, agrees to these Terms, enters into a service agreement with the Operator, and uses the Services.
3. “Content” means financial data, charts, analytical indicators, and any other information provided through the Services.

Article 3 (Publication and Amendment of Terms)

1. The Operator will make these Terms readily available to members by displaying them on the service home screen, a linked page, or another appropriate location.
2. The Operator may amend these Terms to the extent permitted by applicable law. If the Terms are amended, the Operator will provide notice of the effective date and the reason for the amendment at least seven (7) days in advance. If an amendment is materially unfavorable to members, notice will be provided at least thirty (30) days in advance.

Article 4 (Provision, Modification, and Suspension of Services)

1. In principle, the Operator provides the Services 24 hours a day, 365 days a year.
2. The Operator may temporarily suspend the Services for maintenance, replacement, malfunction of information and communications equipment, network interruption, or other reasonable operational reasons.
3. Financial data integration may be delayed or interrupted due to circumstances involving external API providers or telecommunications failures. The Operator will not be liable for such interruptions unless caused by the Operator’s willful misconduct or gross negligence.

Article 5 (Member Obligations)

1. Members must provide accurate information when registering for the Services and must not use another person’s information without authorization.
2. Members may not reproduce, transmit, publish, distribute, broadcast, commercially exploit, or permit any third party to use the Operator’s Content without prior authorization from the Operator.
3. Members may not engage in abnormal access that places an excessive burden on the Services, including automated crawling, macros, or similar activities.

Article 6 (Disclaimer and Liability)

1. The Operator is not an investment advisory firm or financial institution, and all Content and analysis provided through the Services are for informational and reference purposes only.
2. The Operator does not guarantee the accuracy or completeness of information provided through the Services, which may be affected by market conditions, delays, errors, or interruptions involving external data providers.
3. Members are solely responsible for making their own investment decisions. The Operator will not be liable for investment losses or other financial damages arising from the use of information or analytical results provided through the Services, or from service interruptions, except where otherwise required by applicable law.
4. The Services do not provide or intermediate direct trading of stocks, digital assets, or other financial instruments.

Article 7 (Intellectual Property Rights)

1. All intellectual property rights in the Content and systems created and provided by the Operator belong to the Operator. Rights in clearly identified third-party content remain with the respective rights holders.
2. Members retain rights to personal information and portfolio data that they directly enter into the Services, subject to applicable law.

Article 8 (Current Free Service Policy)

1. Moava currently provides its core asset-management features free of charge and does not offer recurring paid plans or automatic subscription billing.
2. If paid services are introduced later, the Operator will clearly disclose the price, billing cycle, cancellation and refund terms, and effective date in advance and obtain any consent required by law.
3. Legacy payment code or transaction records do not mean that a paid subscription is currently active.

Article 9 (Voluntary Donations)

1. Members may make an optional one-time donation to the Operator. A donation is separate from purchasing service access or additional features.
2. Lemon Squeezy processes donation payments. A donation is not a recurring subscription or an investment-services agreement.
3. Duplicate charges or payment errors may be reported through the contact email and will be handled under applicable law and the payment provider’s procedures.

Article 10 (Account Deletion)

1. If a member requests account deletion, the account and user-entered data will be deleted except for information that must be retained under applicable law.
2. Once deletion is complete, the member can no longer access the account.
3. Information required for legal retention or an active dispute will be segregated, retained only for the necessary period, and then deleted.

Article 11 (Governing Law and Jurisdiction)

These Terms are governed by the laws of the Republic of Korea. Any dispute arising out of or in connection with these Terms or the Services will be subject to the jurisdiction determined in accordance with applicable Korean civil procedure laws.
In the event of any inconsistency between the Korean version and any translated version of these Terms, the Korean version shall prevail to the extent permitted by applicable law.

🔒 Moava Privacy Policy

The operator of the Moava service ("Moava," "we," "us," or "our") establishes and publishes this Privacy Policy to protect users' personal information and comply with the Personal Information Protection Act of the Republic of Korea and other applicable laws.

• Effective date: September 18, 2026
• Last updated: September 21, 2026

1. Purposes of processing

We process the minimum personal information necessary to:

• provide social sign-in, identify members, and manage accounts and sessions;
• provide user-requested asset-management features and personalized analysis, including investment accounts, portfolios, dividends, pensions, spending, and diaries;
• operate public community features such as posts, comments, polls, and follows;
• process optional one-time donations and retain legacy payment records where required by law;
• answer support requests and reports, resolve disputes, and deliver important notices;
• provide the read-only Moava Connect integration approved by the user;
• secure, troubleshoot, measure, and improve the Service and prevent abuse; and
• serve and measure advertising for users to whom ads are displayed.

2. Personal information we process

• Social sign-in and account: internal member ID; Google or Kakao provider and provider account ID; email address; name; profile image; authentication tokens; and session information. Moava does not directly collect or store your Google or Kakao password.
• Profile: nickname, profile image, portfolio visibility, activity badges and frames, and portfolio-weight tolerance. Gender, date of birth, and X handle are optional.
• Asset-management data: account name, account type and holder; securities, quantities, values and target weights; deposits, withdrawals, purchases, sales, dividends and cash records; snapshots; pension contributions, withdrawal plans and analysis settings; income, expenses, budgets and categories; and investment diary entries and notes that you enter or import.
• Community data: posts, images, comments, polls, likes, follows, blocks, reports, and public profile information.
• Support and account-deletion feedback: inquiry category, title, content and response; optional contact email; deletion reason and details; and the email, nickname, and plan at the time of deletion.
• Donations and legacy payment records: where applicable, internal member ID; order, payment and refund IDs and status; amount, currency, and date. Lemon Squeezy processes complete payment credentials, such as card numbers and CVCs, directly on its checkout page; Moava does not store them.
• Marketing attribution: first-touch utm_source, utm_medium, utm_campaign, utm_content, referring host, anonymous browser ID, and landing, sample, signup, and first-account events. Marketing events do not store asset values or post content.
• Moava Connect: client ID, authorized scope, grant, token, expiration and connection status, plus security-audit data such as tool name, success or failure, duration, and input/output byte counts. Audit events do not store the text of your questions, answers, or financial-data payloads.
• Automatically generated information: IP address; browser, operating-system and device information; access time and usage history; error and security logs; cookie and session IDs; settings and caches in local or session storage; advertising IDs; and ad interactions.

Moava does not request government identification numbers, financial-account passwords, card PINs or CVCs, or other credentials that are not needed for the Service. Do not enter such information in free-text fields such as posts, notes, or inquiries.

3. How we collect and lawfully process information

We collect information when you enter, upload, import, or otherwise use the Service; receive authorized profile information from Google or Kakao; generate technical information through browsers, servers, cookies, and similar technologies; or receive transaction results from Lemon Squeezy. Depending on the context, processing is based on performance of our agreement with you, your consent, compliance with law, or a legitimate interest permitted by applicable law that does not override your rights.

Information processed independently by a social sign-in provider is governed by that provider's policy: Google or Kakao.

4. Retention periods

We generally retain personal information until you delete it, close your account, or the processing purpose is fulfilled, and then delete it without undue delay. The following periods apply where separate retention is needed:

• Account, profile, asset-management, and community data: until account deletion or earlier deletion by the user
• Support records: three years after the inquiry is resolved
• Account-deletion feedback: one year after account deletion
• Moava Connect grants and tokens: until disconnection or expiration; expired records are removed periodically
• Moava Connect security-audit events: one year after creation
• Abuse-prevention records: one year after creation
• Anonymous blog-view deduplication cookie: one year after creation
• Marketing first-touch cookie and events: the cookie for 90 days and event records for two years
• Website access records: three months as required by Korean communications law
• Advertising records: six months as required by Korean e-commerce law
• Contract, withdrawal, payment, and supply records: five years as required by Korean e-commerce law
• Consumer complaint and dispute records: three years as required by Korean e-commerce law

Where retention is required by law, an active dispute, or a lawful government request, we segregate and retain only the minimum information required and delete it when that purpose ends. Data removed from active systems may remain until the relevant processor's backup-rotation cycle completes.

5. Public information and user content

• When you post or interact in the community, your nickname, profile image, activity badges and frames, X handle (if provided), and the content of your post, comment, or poll may be visible to members and non-members.
• If you choose to make a portfolio or investment diary public or share it with the community, the asset information you select will become public. Information that is private by default is not made public without your choice.
• You can edit or delete content through the Service, but copies already made by others or cached by search engines and third-party services may not disappear immediately.

6. Disclosure to third parties

Moava does not generally disclose personal information to third parties except as follows:

• Moava Connect: after you approve the connection, Moava provides Anthropic, PBC (Claude) with an internal account identifier, read-only authorization information, and the investment-account summary, holdings, performance, dividend, spending, or pension results requested by you. Anthropic processes the information to generate the response requested in your Claude conversation and retains it according to your Anthropic account settings and its Privacy Policy. Disconnecting the connector may not delete content already sent to a Claude conversation.
• when you separately consent to a disclosure or direct us to make information public; or
• when disclosure is specifically required or permitted by law.

You may refuse Moava Connect disclosure by declining the connection or disconnecting the connector in Claude. Refusal does not affect ordinary Moava features, but Moava Connect will be unavailable.

7. Processors and external specialist services

We delegate the following operational tasks and require appropriate safeguards through our agreements and service configurations:

• Supabase: database, file storage, and authentication-related infrastructure
• Vercel, Inc.: web hosting, server execution, content delivery, and operational logs

The following payment and advertising providers may also process information as independent controllers under their own policies and legal obligations while providing the relevant feature:

• Lemon Squeezy: optional one-time donation and legacy transaction payment and refund processing
• Google LLC: Google AdSense delivery, invalid-click prevention, and advertising measurement

We will update this Policy when a material processor, delegated task, or external specialist service changes.

8. International transfers

The following information may be transferred abroad or processed on systems operated by foreign providers. Transfers occur through encrypted network connections when you use the Service or invoke the relevant feature.

• Supabase (United States and Singapore): hosts and operates account, profile, asset-management, community, support, and connection data. The primary data region is configured in the Republic of Korea; limited operational, security, or support data may be processed where Supabase or its subprocessors operate. Data is retained until account deletion or termination of the service relationship, subject to backup rotation.
• Vercel, Inc. (United States): processes service requests, IP address, device and browser information, cookies, session IDs, and operational logs for hosting, delivery through its global network, and security. Moava prioritizes a server-execution region in the Republic of Korea. Retention follows the service configuration and Vercel's notice.
• Lemon Squeezy (United States): processes the internal member ID, buyer information, and order, payment, and refund information for an optional one-time donation or a legacy payment transaction. Retention follows applicable law and Lemon Squeezy's policy.
• Google LLC (United States): when advertising loads, processes IP address, device and browser information, cookies, advertising IDs, and ad interactions for delivery, measurement, and abuse prevention. Retention follows Google's policy.
• Anthropic, PBC (United States): after you approve Moava Connect and invoke a tool, processes the connection information and requested results described in Section 6 to generate your response. Retention follows Anthropic's policy.
• X Corp. (United States): when an X embed loads, your browser may send your IP address, browser information, and X cookies directly to X so it can display public social content. Retention follows X's policy.

You may avoid optional transfers by declining paid checkout, Moava Connect, advertising, or X embeds and may block third-party cookies or scripts in your browser. Supabase and Vercel processing is required to provide the core member Service; refusing it prevents use of that Service.

9. Deletion procedures

We identify and delete personal information without undue delay when its purpose or retention period ends. Information that must be retained by law is segregated and deleted when the required period expires. Electronic records are securely deleted so they are not readily recoverable, and any paper records are shredded or incinerated. Following account deletion, account and service data is deleted through the account-deletion process, except for records expressly retained under Section 4.

10. Your rights and how to exercise them

You or an authorized representative may request access, portability, correction, deletion, restriction of processing, withdrawal of consent, or account deletion. You may act directly in profile and account settings or the relevant edit/delete screen, contact us through Support, or use the privacy contact below. Moava Connect can be disconnected from Claude's connector settings.

We may verify your identity or authority before responding. A request may be limited where another law requires retention or where fulfilling it would infringe another person's rights; we will explain the applicable reason.

11. Cookies and similar technologies

Moava uses cookies and browser storage for sign-in and security, connection state, settings, performance, blog-view deduplication, and advertising.

• Essential and functional storage: login sessions, OAuth/OIDC state, interface settings, and caches
• View-count cookie: a random identifier used to count the first view of a community post by a signed-out visitor. It lasts one year, and the raw identifier is not stored on the server.
• Advertising cookies: Google AdSense may set cookies for delivery, frequency management, measurement, and abuse prevention.

You can delete or block all or third-party cookies in your browser and manage ad personalization in Google Ads Settings. Blocking essential cookies may prevent sign-in or other features from working correctly.

12. Security measures

Moava applies technical and organizational safeguards, including least-privilege and separated administrator access, database row-level security (RLS), server-only secrets, encryption in transit, security logging and review, and appropriate processor security settings.

13. Children under 14

Moava is not directed to children under 14 and does not knowingly collect their personal information. If we learn that such information was collected without the consent of a legal representative, we will verify and delete it without undue delay. A legal representative may exercise rights through the contact in Section 15.

14. Third-party content and links

The "Public Figures" and "Market Voices" sections of the blog may embed public X profiles and list timelines. When an embed or external link loads, your browser communicates directly with that provider, whose terms and privacy policy apply. Moava does not separately store the original X posts.

15. Privacy contact and remedies

• Privacy and complaint contact: Development and Operations Lead
• Email: moava.service@gmail.com
• Online: Support

If your concern is not resolved by Moava, you may seek assistance from the Korean Internet & Security Agency's Personal Information Infringement Report Center (privacy.kisa.or.kr, 118), the Personal Information Dispute Mediation Committee (kopico.go.kr, +82-1833-6972), or the Korean National Police Agency's Cybercrime Reporting System (ecrm.police.go.kr, 182).

16. Changes to this Policy

We will publish the effective date and reason when this Policy changes. We generally give 30 days' advance notice of changes that materially affect user rights and seven days' advance notice of other changes. Changes required immediately for legal compliance or urgent security may take effect at once, with notice provided without undue delay.

• September 18, 2026: comprehensively updated the Policy to reflect social sign-in, payments, public community data, Moava Connect, advertising and cookies, processors, international transfers, retention, and remedies.

If this translation conflicts with the Korean Privacy Policy, the Korean version prevails to the extent permitted by applicable law.