In short. moa is an iPhone app that records meetings, transcribes them and writes the notes.
· Recordings and notes are kept only on your iPhone. moa's server does not keep meeting content (it only passes a recording along to the transcription service when live transcription was not possible).
· Speech is sent to a transcription service (Soniox) to be transcribed and text to an AI service (Anthropic) for the notes. Neither trains models on it.
· The core features work without signing in. An account is needed only for a plan and the optional features (online backup, connected assistants).
· No ads, tracking or analytics SDKs. You can delete your account right in the app's settings, and everything on the server is deleted at once.
Suralab ("we") operates the moa app and the moa server ("the service") in keeping with the Personal Information Protection Act of the Republic of Korea, and this policy explains how we handle your personal data.
| Category | Data | When and how |
|---|---|---|
| Account | Your user identifier at the sign-in provider (Apple or Google), display name, email (when the provider passes it on), a moa account ID (random UUID) | When you sign in |
| Plan | App Store transaction ID, original transaction ID, product ID, subscription expiry and cancellation state. Payment details such as card numbers are handled by Apple and never reach us. | When you subscribe or restore, and through Apple's server notifications |
| Usage | Seconds transcribed, number and kind of AI tokens, request counts | Automatically as you use the service |
| Meeting content (device) | Recordings, transcripts and translations, summaries, decisions and to-dos, speaker names, moa's remarks, wiki pages, notes made before a meeting | Kept only on your iPhone. The server does not keep it and only passes it to the transcription and AI services in section 3. |
| Meeting content (server, optional) | Only when you turn on "Online backup": a meeting's notes and transcript as text, wiki pages. Recorded audio is never stored on the server. | When you turn it on in Settings |
| Connected apps (optional) | The client identifier and name of an assistant you approved, access tokens (hashed), the scope you allowed, time of last use | When you enter a code in Settings and allow it |
| Calendar (optional) | Title, time and attendee names of events that are on or about to start | Read from your iPhone's calendar when you connect it |
| Access logs | IP address, request path, time and status code, app version | Automatically when the app contacts the server |
The microphone is used only to record, and permission is asked for when you start your first recording. The service is not for children under 14.
The services below process personal data on our behalf. Each receives only what providing the service requires, and may not use it beyond that.
| Recipient | Purpose and data | Location and retention |
|---|---|---|
| Soniox, Inc. | Speech to text. Recorded audio (streamed straight from the iPhone when live; when live transcription was not possible, the file is relayed through moa's server without being stored there), language and translation settings, accuracy hints (event title, attendee and speaker names). When transcription finishes, the server asks for the file and the result to be deleted. Not used to train models. | United States. Sent during use, deletion requested after transcription |
| Anthropic, PBC | Summaries, notes, answers, translations and remarks (Claude). Transcript text, pre-meeting notes and wiki excerpts are sent straight from the iPhone (not through moa's server). Under Anthropic's commercial API terms, inputs and outputs are not used to train models. | United States. Sent during use |
| Apple Inc. | Sign in with Apple, App Store subscription billing, verification and server notifications | United States. Per Apple's policies |
| Google LLC | Sign in with Google (ID token verification) | United States. Per Google's policies |
| Amazon Web Services | Server hosting (Seoul region). Accounts, plans, usage and any backup you turned on live here. | Republic of Korea (Seoul) |
| Cloudflare, Inc. | HTTPS termination, firewall and the tunnel to the server. Handles requests in transit. | United States and edge locations worldwide. In transit |
| Assistants you approve (Anthropic Claude, OpenAI ChatGPT and others) | Only a service you allowed yourself with a six-digit code under Settings → Connected Apps reads your backup, within the scope you allowed (meeting notes, and transcripts if you chose so). This is a disclosure to a third party made with your consent; you can disconnect it in Settings at any time. | Where that service is located (mostly the United States). Until you disconnect |
Transfers to the services located abroad happen over the network as you use the service. If you do not want a transfer, you can leave the feature unused (sign-in, transcription, AI notes, backup, connected assistants). You can also only record, without transcription.
Where the law requires us to keep records (for example records of electronic transactions), we keep only those records for that period.
You may ask at any time to access, correct or delete your personal data, or to stop its processing. Most of this you can do in the app: delete a meeting, turn off online backup, disconnect an app, delete your account. For anything else, write to [email protected] and we answer within 10 days. Depending on where you live, you may also have the right to complain to a data protection authority.
We use no cookies, advertising identifiers or analytics or advertising SDKs. The app does not track your activity.
Suralab, Jeongran Jeon · [email protected]
In Korea, you can also report or consult about a privacy violation with the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118), the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972), the Supreme Prosecutors' Office (spo.go.kr, 1301) or the National Police Agency (ecrm.police.go.kr, 182).
When this policy changes, we announce it in the app and on this page 7 days before it takes effect, or 30 days before for changes that are to your disadvantage.
This policy is available in Korean and English. If the two versions read differently, the Korean version governs.