Privacy Policy

Last updated: 25 October 2026

The short version. More Moonshots is a small community site run as a side project. You sign in with Google, with LinkedIn, or with a code we email you, and a computer you are signed in on can sign your phone in too. From Google or LinkedIn we keep your email address and an identifier for your account there. We use the name they have for you to fill in the sign-up form, and show you the picture on your account there, which becomes your photo only if you keep it when you join — nothing else. Everything on your profile is what you typed or kept yourself. There is no analytics package, no tracking cookie and no advertising. If you choose For You for your timeline, we note what of it has been on your screen, for a month, so it can put what you have not seen first; it orders your timeline and nothing else, and choosing Latest stops it (section 4). One thing here does read what members write: Skippy, the community’s AI member, which uses Anthropic’s Claude to welcome new members, comment on moonshots, write a morning brief, define words for the Lexicon, answer anybody who tags it or messages it, like the members’ posts it finds genuinely interesting and now and then comment on one, draw a cover for a moonshot when its owner asks, draw the picture for somebody’s entry in Ignition when they ask, draw anybody a profile picture when they ask, and style a profile page when its owner asks. Some of what it writes is approved by a person first and some goes up straight away, and the people who run the site can read all of it, along with whatever it was answering (sections 6 and 7). A blog post you publish, Skippy’s morning briefs and the words in the Lexicon are also sent to Google’s Gemini to be read aloud, so that Listen can play them (section 7). The other thing worth reading properly is section 6: direct messages between members are stored as ordinary text in our database, with any pictures in them, so treat them as private from other members rather than private from us.

1. Who we are

More Moonshots is provided by Burmarsh Systems Ltd, a company registered in Northern Ireland (company number NI743398), registered office 7 Mount Ober Gardens, Belfast, County Antrim, BT8 6BL, Northern Ireland. In this policy “we”, “us” and “More Moonshots” mean that company.

We are the data controller for the personal data described below. You can reach us at me@deanwild.co.uk.

2. How you sign in, and what we take from it

You sign in with Google, with LinkedIn, or with a code we email you; there is no password of ours. Google or LinkedIn tells us three things:

• Your email address, which we use to identify your account and to check you are on the invitation list.
• An account identifier — a number Google or LinkedIn uses for your account, which stays the same if you change your email address.
• Whether they have verified that email address. We refuse sign-ins where it has not been.

That is the whole list. We ask only for the basic sign-in scopes, so we do not receive your Google contacts, calendar or files, or your LinkedIn connections, posts or work history. They also tell us the name they have for you, which we put in the name box of the sign-up form to save you typing it; it is stored only if you keep it and carry on, and you can change it there or at any time after. They also give us the address of the profile picture on your account. Joining starts with your picture, and shows you that one first, already chosen, fetched by our server, so your browser does not ask Google or LinkedIn for it. If you keep it and carry on, our server takes one copy, shrinks it and keeps it as your profile photo, exactly as if you had uploaded it, once the next page has made you a member; if you skip it or choose another picture, it is not kept. If your profile has no photo, we offer it again when you visit, until you say not to (that choice is remembered in your browser), and you can choose it from your profile picture at any time. Our server fetches it to show it to you, and keeps a copy only when you say yes; you can change or delete your photo at any time. We never see your password or your two-factor codes; those go to Google or LinkedIn, not to us.

If you sign in more than one way with the same verified email address, it is one account here: we keep the identifier from each so that any of them opens the same profile.

Signing in by email. If you give us your email address instead, we email you a six-digit code and a link, either of which signs you in once, within 15 minutes. That proves the address is yours, which is all it is for. We keep a scrambled (hashed) copy of the code and the link, never the code itself, and delete the record within a day. How often an address or a connection can ask for a code is limited, and the limit is kept against a scrambled value, not your IP address.

Changing your email address. If you signed in with a code we emailed you, you can change your address in Settings. We email a six-digit code to the new address, and the change is made only once you type it in, within 15 minutes; as with a sign-in code, we keep only a scrambled copy of it. Once the change is made, your new address signs you in and the old one no longer does, and we email the old address to say so, with your first name and the new address shown only in part (like d***@e***.com) — never a code or a link. Your account, and the identifier it is kept under, stay the same. If you sign in with Google or LinkedIn, your address comes from that account, and changes when you change it there.

Signing in on your phone from your computer. When you are signed in on a computer, “Get the app on your phone” shows you a QR code. Scanning it opens our site on your phone with a sign-in code in the address, after a # so it is not sent to our server or anybody else’s by opening it: only our page, open on your phone, uses it. On an iPhone or an iPad it signs you in as soon as the page opens, because Safari passes that sign-in on to the app you then add to your home screen; on other phones, when you press “Sign in on this phone” there. The code is made only for you, while you are signed in, and is shown only to you; it works once, for two minutes, and the QR code is replaced with a fresh one while it is on screen. Beside it is the same code as eight letters and numbers, which you can type on the sign-in page of any phone instead, within the same two minutes; using either uses up both. How many codes can be tried is limited, against a scrambled value rather than your IP address. We keep scrambled copies of the code and the short code (the short one is scrambled with a secret only our server knows), never the codes themselves, and delete the record within a day.

3. What you give us

Everything else we hold is something you typed or uploaded.

• Your profile. Your name, what you do, where you are, your interests, what you are building, what you can help with, what you need, how you like to meet, your moonshot, your p(doom) and p(abundance) — numbers from 0 to 100 that you choose, shown on your profile — and optional links to LinkedIn, X, GitHub, Instagram or your websites.
• Your profile photo, if you upload one, keep the picture from your Google or LinkedIn account when you join, or use a portrait Skippy drew for you (section 6). It is stored in our database and served only to signed-in members, unless you make your profile public (see section 6).
• How your profile looks, if you style it: one of the site’s own sets of colours, one of its patterns behind the page, and a header picture Skippy drew for you, or one you uploaded, with the look’s name and, for a drawing, a line saying what the picture shows, both written by Skippy (section 6). The header is stored like the pictures you attach (below). The words you wrote to ask for it are not kept.
• What you post — discussion posts, replies, likes (and, where you chose another reaction instead, which: a love, a laugh or an angry face; one on each thing) and moonshots, and which story, episode, moonshot, poll or blog post here a post shares, if it shares one; and when you liked or reacted to something, joined a moonshot’s team or became somebody’s Moonshot Mate.
• Your blog posts: the title, the cover and what you write, saved as you write it, and what you last published, and the SEO title and description you give one, if you do. A draft, and changes you have not published yet, are seen by nobody but you (section 6). Once you publish one, we also keep a recording of it read aloud, made by Google’s Gemini from its title, your name and its words, for Listen to play (sections 6 and 7).
• Pictures you attach to a post, a moonshot, a blog post or a remark in the Lounge, including one you give a moonshot for its cover. Unlike your profile photo, these are stored with Cloudflare R2 rather than in our database, and they are served from a public address. See section 6.
• Videos you attach to a post, to a moonshot’s gallery or as its pitch, up to ten minutes each. Our own server, not any outside service, makes each into a smaller copy that plays anywhere, with a still picture from it. Before it is kept anywhere, whatever your phone wrote into the file about it, where it was taken above all, is taken out. Until the copy is made, the file you sent, with that taken out, is kept with Cloudflare R2, and it is deleted once the copy is made; the copy and its still are kept there like your pictures, and served from a public address. See section 6.
• Your entries in Ignition, the weekly challenge: what you write, and the link or the picture you add (an entry needs one of them, or both). The picture is stored like any picture you attach to a post (below, and section 6). If you ask Skippy to draw it, what you write to describe it and what Skippy says back, through that week, and the description it was drawn from, kept with the picture (section 6). And the entry you vote for as your favourite each week, if you vote.
• Your answers to the Moonshot Dilemma, the hard question Skippy asks every day: Yes or No, and the reason you give, if you give one.
• Direct messages you send to members you are connected with, and to Skippy, and the pictures you send in them (up to four a message; never to Skippy). Unlike the pictures on posts, these are kept in our own database, not with Cloudflare, and only the two of you can open them (section 6).
• Reports you make about other people’s content, including the reason you give.
• Whose posts you have hidden. If you hide a member’s posts from your timeline, we keep that you hid them and when, so their posts stay out of your timeline and they are listed in Settings until you show them again. Only you can see it, and they are not told (section 6).
• Bug reports you send from “Report a bug”: what you write, and with it the screen you were on (its name, such as Home or Polls, never its full address), what your browser says it is — its name and version, and your device’s operating system — and which version of the site it was running. Only the people who run the site read them (section 6).
• Moonbucks you send. If you send another member some of your Moonbucks, we record who sent them, to whom, how many and when, and the note you write with them, if you write one. The note is something you wrote, like a post, and goes on the timeline with the gift (section 6).
• Whose invitation you came by. If you join through a member’s invitation link, we record that they invited you, which earns them Moonbucks and lets Skippy thank them (sections 6 and 7). Your own link, which you can share from the menu under your picture, is your profile’s short name, so it holds nothing new about you.
• Which advert brought you, if one did. Our adverts link to the site with the name of the campaign in the address. If you arrived by one and joined in that same visit, we keep which campaign it was with your account, so the people who run the site can see how many members each advert brought and how they have taken to the site, as totals (section 6). Nothing about it is stored in your browser: the address forgets it as the page opens, and the page carries it only until you close it.
• What you build in Luna. Luna is a game on the site, in which members build a settlement on the Moon. It is open to every member while the people who run the site have it switched on for everybody; otherwise, while it is being tested, only the members they let in can see it, and we record on your account whether you are one of them. While it is open to everybody, and you have not yet played, a message tells you so each time you come back, and we record on your account if you press “Don’t show this again”, so that it stops. If you play, we keep your settlement’s name (one it is given when it lands, or the one you give it), the era it has reached, how many people it houses and the milestones it has reached, where it is on the Moon, each building in it with where it stands, how many floors it has and when it was built, how much metal your settlement holds, how many people live there, the Moonbucks its offices and data centres have earned that have not yet been paid to you, which blueprints you have bought with your Moonbucks and when, when you finished or skipped the tour it starts with, and a record of each of its weeks (how many people it housed and how many arrived, the buildings finished, the metal dug, its morale, the probes launched and the milestones reached, and when it was shown to you), from which the game writes a weekly diary that only you can read. The residents the diary names, and their faces, are made up from the settlement’s numbers and a list of names we chose, never anybody’s real name, and no AI writes it.

Emails we send you

Sign-in codes, when you ask for one. And, unless you turn it off, an email about activity you have not seen yet — messages, mate requests, replies, comments, tags, likes and other reactions, Moonbucks somebody sent you and the like — collected into one email once the oldest has waited about 15 minutes, and never more often than every half hour. It names who did what and links to it; it never quotes what anybody wrote. It also gives your own Moonbucks (and how many you earned this week), level and run of days, and what is new for everybody since the last one: a new episode, the top news story and how many people have joined, never anything a member wrote. Anything you read on the site first is left out, and nothing is sent while you are on the site.

Choose everything, important things only, or nothing in Settings, from the menu under your picture — every one of these emails links there — or use the unsubscribe link in any of them, which works without signing in. We send no marketing email, and nothing in these emails tracks whether you open them or click them.

4. What we collect automatically

Very little. One thing notes what you have looked at, For You’s record of what has been on your screen, and it is used for nothing but the order of your own timeline.

• Rate-limiting counters. We count how many actions your account has taken in the current hour, and how many posts, comments, polls and moonshot updates in the current hour and day, so that one account cannot flood the site. Each is a number attached to your account identifier, and it resets. For requests made before you sign in, the number is attached instead to a one-way hash of your address, the date and a server secret, so the address itself is never written down and cannot be recovered from what is.
• What earns you Moonbucks. Taking part earns Moonbucks, the site’s points: coming in on a new day, liking, commenting, posting, answering a poll, filling in your profile and so on. For each one we record what kind of thing it was, which post, comment or other item it was about, how many Moonbucks it earned and when. For coming in, we record the date only, not the time of day, so we keep a list of the days you came in; that is what your run of days in a row is counted from. Your total, your level and your run are worked out from this record. The days members came in are also counted, as totals and never by name, for the people who run the site: how many came in each day, how many came in on how many days, and how many of them did something that earns Moonbucks. Moonbucks you send another member, or are sent, are in it too, with who they went to or came from, and so are Moonbucks you spend on a blueprint in Luna, with which blueprint it was, any the site’s owner gives you for testing, any Luna gives you for playing it (the first time you open it, and when you come back to it, with when), and any your offices and data centres in Luna earn you (with when they were paid), all of which you can spend but which never count towards your level or the leaderboards. You can see the latest of it on the Moonbucks page; nobody else can see the record itself (see section 6 for what they do see).
• A daily visit count. When a browser opens the site we add one to a count for that day, so we can tell whether anybody is finding it, and one to either a “mobile” or a “desktop” count depending on whether your device’s main way in is a touchscreen. If you arrived by one of our adverts’ links, we also add one to that campaign’s count for the day. What is stored is a date and those numbers. No address, no identifier and nothing about you is kept beside them, nothing links one visit to another, and there is no way to work backwards from the numbers to a person.
• How long visits last, as daily totals. While you are signed in and the site is in front of you, it adds to that day’s totals: one more visit when you arrive, the minutes you spend, and whether your visit has passed one, five, fifteen or thirty minutes. A visit ends when you have been away ten minutes. What is stored is a date and those numbers, with nothing to say whose they are. To tell when your visit passes one of those lengths, we keep on your account how long the visit you are on has lasted so far, which is written over when your next visit begins. The super admins’ own visits are not counted.
• A daily install count. The first time the site is opened as an app from a home screen on a device, we add one to a count for that day. The device remembers, in its own storage, that it has been counted, and the count itself is sent with nothing about you or the device.
• Whether you use the app on a phone. Separately, the first time you open the app from a phone’s home screen while signed in, we note on your account when that was, so that we stop offering you the app on your phone when you use a computer. We also keep, on your account, how many times that offer has been shown to you, when it may next be shown, and whether you asked not to see it again; whether we have shown you the invitation to tell your friends; and when you first opened it, since when your invitation link names you (section 6). Only you are sent any of it.
• Whether you have seen Skippy’s latest morning brief. Once the newest of Skippy’s morning briefs has been on your screen in your timeline, we note its date on your account, so that it comes first in your timeline only until you have seen it, and after that sits in its place by time. It is one date, replaced by the next, not a record of what you have read or for how long, and nobody but you is sent it.
• What has been on your screen in For You. While your timeline is set to For You, which orders it for you rather than newest first, your page tells our server which posts, polls, moonshots and conversations in it have been at least half on your screen for a second, a few at a time. For each we keep the item, when you first saw it and when you last did, so that For You can put first what you have not seen, and bring back something you have seen only when people have commented on it since. It is not a record of how long you looked, or of anything you did not see. Rows go after a month, and all of them when you delete your account. Nobody is sent it but your own page, and the people who run the site see only totals with no names in them: how many members chose For You or Latest, how much was new to members on an average day, and how many of the first ten things a visit to For You showed were new. Choose Latest, above your timeline, and nothing more is noted; your timeline is then newest first, as it has always been.
• Error reports. When something breaks — on our server, or in your browser while you are using the site — we record a technical error report: what failed and where, the technical detail a developer needs to fix it, the type of browser you were using, and your member id if you were signed in. It never includes what you were writing or sending, and anything that looks like an email address is removed before it is stored. Reports stay on our own server, are kept for 30 days and are used only to find and fix faults. If something breaks in front of you, you may be shown a short reference code, which you can quote to us so we can find the report.
• That you are typing a message. While you write a message to somebody, or something in the Lounge, your page tells our server every few seconds that you are typing, and to whom, or that it is in the Lounge — never what you have typed, which is sent only when you send it. The server holds that in its memory for six seconds, and never writes it down (section 6).
• Server logs. Our hosting provider keeps normal web server logs, which include IP addresses, for a short period. We use them to diagnose faults and abuse, not to build any picture of you.

There is no analytics package on this site. No Google Analytics, no third-party analytics SDK, no tracking pixel, no advertising identifier and no session recording. The daily counts above are totals and not a trail: they cannot say who visited, what they read, where they came from, or whether two visits were the same person. The one record of what you have seen is For You’s, above, which stays on our server, orders only your own timeline, and stops when you choose Latest. We do not sell or rent personal data to anyone, and we do not use it to build profiles or to serve advertising.

5. Cookies

We set one cookie: the sign-in cookie that keeps you signed in. It holds a signed token identifying your account and which way you signed in, and it expires after seven days. It is strictly necessary — without it you would have to sign in again on every page — so it does not require a consent banner, and you will not see one. We set no advertising, analytics or third-party cookies of any kind.

Posts from X on the home page and the News page are drawn by us from our own copy, pictures included, rather than embedded from X. X sets nothing in your browser and is not told you looked, unless you follow one of their links to X itself.

We also keep a few small notes in your browser. They are not cookies, and none of them is ever sent anywhere:

• For as long as the tab is open (its session storage, emptied when you close it): that this tab has already been added to the day’s visit count, so moving around the site does not count you again; that you have been offered your Google or LinkedIn picture once this visit; and that something has been offered to you this visit, so nothing else is.
• Until you clear them (its local storage): whether you have already been asked about notifications; whether you said never to using that picture; whether you closed the note about how the site is paid for; whether you turned the site’s sound effects off; whether you left “Your moonshots” open or closed on the Moonshots page; the last eight things you searched for and opened a result of, so the search box can offer them again (each one can be removed with its ✕, and they are never sent to us); the skin tone you last picked when asking Skippy to draw you, so that it starts on that one next time (picking “Skippy picks” forgets it, and it reaches us only among your choices when you ask for a drawing, section 6); that an installed copy of the site on this device has been counted (see section 4); if you opened a member’s invitation link before joining, whose link it was and when, for thirty days or until you join, so that joining can say so; and, if you opened moremoonshots.com/invite before signing in, that you were going there, for an hour or until you sign in, so that your invitation opens once you have.
• For a moment while the site updates itself. When a newer version of the site is out, a page you have open loads it when you come back after a while. Just before it does, it puts what is on your screen — the posts, messages and anything else it was showing you — into that tab’s session storage, and shows it again straight afterwards, so you are not left looking at a loading screen. It is read once and deleted at once, it is thrown away unread if it is more than a minute old, and it never leaves your browser.

6. Who can see what — please read this one

Your profile, your posts, your replies and your moonshots are visible to every signed-in member of the community. Treat them as public within the community. So are your likes and other reactions: anybody who can see what you reacted to can see that you did, and with which (a like, a love, a laugh or an angry face), and its owner is told. Changing a moonshot once it has been up for an hour (its cover, its stage, who it is looking for, its words, its link or its pictures) puts a short line in the community timeline saying that you changed it and roughly what, with its new stage and who it is now looking for, which the moonshot itself shows anyway; a day’s changes are one line, and we keep it as long as the moonshot, never what it said before. Your profile lists your posts under Posts, newest first, for signed-in members to page back through, with how many there are: what you posted in the timeline, your updates on a moonshot while it is published, your comments on episodes and the blog posts you shared, each as the timeline shows it, with its likes and comments. What you liked, reacted to or voted in, your comments under other posts and on polls, your entries in Ignition, anything you say in the Lounge and your messages are not listed there. Your email address is shown to other signed-in members on your profile only while “Show my email address on my profile” is on. The sign-up form starts with it on, beside your address, so you can turn it off before you join, and it is in your profile’s edit form after that. Nobody who is signed out ever sees it.

Hiding somebody’s posts is yours alone. You can hide a member’s posts from your own timeline. Only you can see whom you have hidden, in Settings and on their profile. They are not told, and nothing changes for them or for anybody else: their posts stay in everybody else’s timeline, and their profile still lists them for you.

Your profile can be public, and you choose. The sign-up form starts with the switch on, and it is on the page with your name, above the button that carries on, so you can turn it off before you join; it is in your profile’s edit form after that. Public lets anybody read your profile — people who are not signed in, and anyone you send the link to. What becomes public is the profile you wrote: your name, role, location, interests, the “about me” sections, your links and your profile photo. Your posts, moonshots, Moonshot Mates and when you were last here stay visible to members only. A public profile may also appear on the front page, and because anybody can open it, search engines may find it too. The front page also shows anybody the news stories leading that day, with how many reactions each has, but never who reacted, or what anybody said about them. Turning the switch off makes it members-only again straight away, though, as with anything on the web, a copy somebody already saved is out of our hands.

A moonshot can be made public in the same way, once it is published, from the “Anyone can read it” switch at the last step of sharing or editing it. Anybody can then read what you wrote about it and see its pictures, with your name and role as its owner — even if your profile itself is private. Its updates, comments, likes and the rest of the team stay members-only. Taking the moonshot back to a draft makes it private again.

A blog post is yours alone until you publish it.Your drafts, and changes to a published post that you have not published yet, are seen by nobody else. Once published, every signed-in member can read it, and it goes in the feed with whatever you say about it. Its address is made from its title when you first publish it, such as moremoonshots.com/blog/why-fusion-will-power-our-homes, and does not change if you edit the title. Publishing offers “Public” first, chosen unless you pick “Members only”: public, anybody can read it without signing in, with your name and role as its writer, even if your profile itself is private, and it can appear on the front page for visitors, with its title, its cover, your name and how long it takes to read; its likes and comments stay members-only. Link previews on other sites show its title, its opening and its cover. An SEO title or description you give it (from Manage, then SEO, in the editor) is shown only once it is public: search engines and link previews show them in place of its title and its opening. Choosing “Members only” makes it members-only again. Unpublishing it takes it back to your drafts: nobody else can read it, at its address or anywhere else, and its post in the feed is hidden, with its likes and comments, until you publish it again. Deleting it deletes it, its pictures and its post in the feed, though, as with anything on the web, a copy somebody already saved is out of our hands. If you mention a member in it, they are told, as when you tag them in a post.

Listen can play a recording of a blog post, of one of Skippy’s morning briefs, or of a word in the Lexicon. Once a blog post is published, its title, your name as its writer and its words are read aloud by Google’s Gemini (section 7), never its comments, and the recording is kept with Cloudflare R2, like the pictures you attach. Anybody who can read the post can play it from its page: members, or, for a public one, anybody with the link. Like those pictures, it is at an address that contains a random identifier, so it cannot be guessed and is not listed anywhere, and only the post’s page hands it out, but anyone holding that address can play it without signing in. Once you update the post with changes, the old recording is no longer played, and it is deleted when the new one is made; deleting the post deletes it. Skippy’s morning briefs are recorded the same way, from their date, title and words, and so are the Lexicon’s words, from the word, its meaning, its paragraph more and where it comes from, never who suggested it; anybody can play either. Recordings are made only while the people who run the site have that switched on; otherwise, and for everything else with a Listen, it reads aloud with the voices on your own device, and nothing is sent anywhere to be read out.

Search engines are shown where the public pages are, and nothing else. A list of addresses for search engines (moremoonshots.com/sitemap.xml) and a short guide for AI models (moremoonshots.com/llms.txt) name the pages anybody can already open without signing in: public profiles, by their short link; public moonshots; public blog posts, with their titles and openings, or the SEO description you gave one; the podcast episodes; the Lexicon’s words; entries in Ignition; and Skippy’s morning briefs. Nothing is in them that is not public already: drafts, anything members-only, anything taken down, anything else of Skippy’s and anybody suspended are left out, and something you make members-only leaves them when they are next made, within six hours. Search engines are asked to stay out of the pages that are for members. Each public page also carries a title and a short description for search results and link previews: for a public profile, your name, your role and your moonshot line, with your profile photo; for a public moonshot, its title, its summary and its cover. The picture a link preview shows is a copy of the one on the page, made by our own server in the shape link previews take, held for a while in its memory and never stored, and it is served only while the page itself is public.

Your profile has a short link made from your name, such as moremoonshots.com/jane-smith, with a number after it if somebody got there first. It is fixed when you join and does not change if you edit your name, so a link you have shared keeps working. Anybody can see that an address exists, but it only shows your profile to signed-in members unless you have made it public.

Your invitation link says it is from you, once you have opened your invitation. From the first time you open “Invite friends”, however you get to it, anybody who opens your link, signed in or not, sees your name, and your profile photo if your profile is public. Until then your link names nobody: it opens our ordinary front page, exactly as an address nobody holds does, so it does not tell anybody whether you are a member. How many links one visitor can look up is limited, against a scrambled value rather than their IP address. Somebody joining through your link is still counted as your friend either way. When somebody joins through it you are told their name, and you can see how many people have joined through your link, the newest of them by name and picture as any member sees them, and the Moonbucks it has earned you; nobody else can.

When you open another member’s profile, they are told. They get a notification saying you viewed it — at most once a day for any one profile, however often you look. The people who run the site can open profiles without anybody being told, since they do it constantly to check that the site works. Somebody who is not signed in reading a public profile is not announced either, because we do not know who they are.

Polls. A poll you ask is checked by an admin before it goes up, and shows your name as the one who asked it. When you vote, the vote is stored against your account, which is what stops anybody voting twice. The timeline does not say that you voted, or how. Other members only ever see the totals, never who chose what; the people who run the site could look it up in the database, and would only do so for the reasons in the paragraph on direct messages below. You can like a poll, or react to it another way, whether or not you have voted in it, and who did, and with which reaction, is shown to other members, as with any like.

Skippy asks a poll of its own every day, whatever members have asked, which one of the people who run the site approves before it goes up unless they have chosen otherwise. It is marked as written by an AI, like everything Skippy writes, and works as any poll does: your vote, your like and your comments on it are as above. Its morning brief, which anybody can read, may invite everybody to answer that day’s poll and link to it, but never says how anybody has answered. Members who have blocked Skippy do not see its polls.

The Moonshot Dilemma. Every day at noon Skippy asks the community a hard question to answer Yes or No, which one of the people who run the site approves before it goes up unless they have chosen otherwise. Your answer is stored against your account, and it is final. Every signed-in member sees how everybody answered, as totals, and every reason given, each with the name of the member who gave it and which way they answered, whether they have answered themselves or not. A reason can be liked, or reacted to another way, and who did, and with which reaction, is shown, as with any like, and whoever gave it is told. An answer with no reason is only ever counted: nobody is shown that you gave it, or which way. Comments on it work as on any post. Members either side of a block do not see each other’s reasons, and nobody signed out sees any of it, but for what Skippy’s morning brief says of it. The next morning that brief, which anybody can read, says how it split and talks about the reasoning on each side in its own words, without naming or quoting anybody (section 7).

Your p(doom) and p(abundance) also go into the community’s averages, whether your profile is public or not. Signed-in members see them on the home page. Once at least ten members are counted in them, they are also on the front page, with how they have moved and how many members were counted, for anybody to see, and Skippy’s morning brief, which anybody can read too, says how they moved only then. An average names nobody, though while the community is small it says more about each member in it than it will later.

Skippy, the community’s AI, may write about you, and will answer you. When you join, it may welcome you in a comment on that day’s arrivals card, mentioning things from your profile or from the websites you list, and it may tag a member or two it thinks you would like to meet. If you joined through a member’s invitation, it may thank them in that welcome, tagging them; and if somebody joins through yours, it may send you a private message thanking you. When you publish a moonshot, it may comment on it. It may also tag you in a welcome or a comment to introduce you to somebody else. If you tag it in a post, a comment or the Lounge it replies there; if you reply to something it wrote it reads what you said and may answer; once it has answered you in the Lounge, it reads what you say there for the next ten minutes and may answer that too; and if you send it a message it answers. Depending on how the people who run the site have set it, each kind of thing it writes is either approved by one of them before anybody else sees it or posted straight away; either way, every super admin is told about everything it posts and can read it, with what it was answering. Everything it writes is marked as written by an AI, and the mark opens to say which model wrote it and how many tokens that took; the picture with its morning brief says which model drew it, and shows exactly what that model was asked to draw. Its morning brief about the community never names anybody: it may link to the news stories, new moonshots, polls and words in the Lexicon it mentions, to its own poll for the day, to the card welcoming that day’s new members, and to the posts where the conversations it mentions happened, which show who wrote them, as they do to any member; but never to a member’s profile, and it never quotes anybody in a link. Because it names nobody, that morning brief is public: anybody, signed in or not, can read each one at its own address, such as moremoonshots.com/daily/2026-10-14, and every one is listed at moremoonshots.com/daily, newest first; it may appear on the front page; and link previews on other sites show its title, its opening and its picture. What it says about the timeline is in general terms, and that includes how the community answered the day before’s Moonshot Dilemma, as above. Its comments and likes stay members-only, on its post in the timeline, and a visitor who follows one of its links to a page for members is asked to join, as anywhere else. It is everybody’s Moonshot Mate from the day they join, so it appears among yours, and you talk to it in a chat window of its own, opened from its face in the corner of the screen, rather than in your Inbox. Its first message to you, a hello when you join (or on your first visit after the window arrived), is written in advance by the people who run the site, not by its model, and its mark says so. You can block Skippy like any member, which stops it writing to you or about you and sets that connection aside.

Skippy may like your posts, and now and then comment on one. It reads each post members put in the timeline once, somewhere between a quarter of an hour and an hour and a half after it goes up (an update on a published moonshot, and a blog post you share there, included), and likes only those it finds genuinely interesting: a dozen a day at most across the whole community, and never more than one of yours in a day or three in a week. Its like shows on your post as anybody’s does, you are told of it in the site’s notifications only (never by email or on your phone), and it earns you a Moonbuck, as anybody’s like does, within the day’s limit. When it has something specific to add, it may also comment on a post it liked, no more than once a week for each member, and you are told of that as of any comment; it may tag a member it thinks could help, who is told as with any tag. Depending on how the people who run the site have set it, a like or a comment goes up straight away or after one of them has approved it. They can see, on their dashboard, each like and comment with how interesting it found the post and why, in a line; what it made of a post it did not like is seen by nobody else and forgotten after 30 days. It never judges a comment, a poll, a remark in the Lounge, a message or a post that has been taken down, and never reads anything of somebody who has blocked it, so blocking it stops it reading your posts.

Skippy can draw a cover for your moonshot, but only when you ask it to, from “Ask Skippy to draw one” where you choose its cover, once a day for each moonshot. It works from the moonshot’s title, stage and summary (section 7 says who sees those). The picture is yours to use or leave: used, it is your moonshot’s cover like any picture of yours (section 3), and anybody who can see the moonshot sees it; left unused, it is deleted when Skippy next draws you one, or after a week.

Skippy can draw you a profile picture, but only when you ask it to, from “Ask Skippy to make one” in the profile picture dialog, or from “Ask Skippy to draw you” on the first page of joining, once a day. It draws from what you pick from its lists — who you are in the picture, how old and, for a person, a skin tone if you pick one, a style, a mood, what you wear, what is behind you and a colour — and, if you add one, a short line in your own words (section 7 says who sees those). The picture comes straight back to you and is kept only if you use it: then it is your profile photo like any other (section 3), seen by whoever can see your profile. Asked for while you join, it stays in your browser until the next page has made you a member, and is only uploaded then. What you picked and your line are never stored on our server, and your line is never shown to anybody else. Your browser remembers the last skin tone you picked, so that it is chosen for you next time (section 5).

Skippy can style your profile, but only when you ask it to, from “Style my profile” on your own profile, with one drawing a day. Every member can style theirs. It works from the words you write about how your page should feel (section 7 says who sees those): it chooses the colours and a pattern from the site’s own lists, names the look and has a header drawn for it, or you can upload a picture of your own for the header instead. Nothing changes until you use it. Then everybody who can see your profile sees the look, signed out too if your profile is public, and the header is served from a public address, as the pictures you attach are. Pressed, the header opens full size; a drawn one says which model drew it and which wrote what to draw, and shows exactly what the drawing model was asked to draw, which Skippy wrote; the words you wrote are never shown. One you uploaded is only itself. Where you move the header within its strip is kept with the look. A header you did not use is deleted when Skippy next draws you one, or a week after it was drawn, and one you stop using, drawn or uploaded, is deleted then. Using a look puts you first on the card in the community timeline of who has styled theirs lately, which shows the latest eight, by name and with your picture, each a link to the profile; members can like it and comment on it, and everybody on it is told, by name. Going back to the usual look takes you off it. Choosing the colours or the pattern yourself sends nothing anywhere, and you can go back to the usual look at any time.

The Lexicon is public. Its words and what they mean can be read by anybody, signed in or not, and found by search engines. You can suggest a word with “Suggest a word”, or by asking Skippy to add one when you tag it or message it, which suggests it for you, credited to you just as if you had used “Suggest a word”. Either way Skippy looks it up, and it goes in only once one of the people who run the site has approved what Skippy wrote. If you say what you think the word means, Skippy is given that to look it up by, and the people who run the site see it beside the word when they check it; it never goes into the Lexicon. From then on, signed-in members see that you suggested it, unless you have blocked each other; nobody who is signed out does, and the word stays if you leave. You are told when it goes in, and it earns you Moonbucks.

Ignition, the weekly challenge, is set and judged by Skippy. Every Monday it sets a brief, and you can enter until nine the next Monday. Entries are public, whatever your profile’s setting, and there is no choosing otherwise: each has an address of its own, and anybody with it, signed in or not, can see the entry with your name and your profile picture (which is served to them for it, as it is for a public profile), though not the rest of your profile unless that is public. Anybody can share that address, and when it is shared the site it is shared to shows a card with your name, the week, your words and your picture. On the site, your entry is on the Ignition page for every signed-in member except anybody either side of a block with you. The entry is not among the posts on your profile. Signed-in members can comment on your entry, though not across a block with you, and you are told, by name, when somebody does; signed out, nobody sees the comments. The timeline has a card for each day’s entries saying who entered, by name, with their pictures while the week is open; members can like it and comment on it, and everybody on it is told, by name. Everybody who had already entered that week is told, by name, that you have entered too. Through the week you can vote for one entry as your favourite, not your own, and move or take back your vote until it closes; it earns you Moonbucks once a week. Nobody is ever shown who voted for which entry, you included for anybody else’s vote: only you see your own. Everybody who can see the week sees how many votes are in so far, as one total, never which entries they went to; until the winner is announced nobody sees how many votes any entry has. Skippy reads the entries without anybody’s name, with how many votes each got, to pick a winner (section 7), which one of the people who run the site approves before it is announced unless they have chosen otherwise. The winner is named and tagged in Skippy’s post on the timeline, earns 500 Moonbucks, and their entry stays on the Ignition page, with why it won and how many votes it got. If the community voted most for another entry, Skippy’s post names whose it was and how many votes it got, and it stays on the Ignition page beside the winner, with its count. Once a week is over, its entries leave the timeline but stay on the Ignition page, among the past weeks members can look back through, each with its entrant’s name and, once the winner is announced, how many votes it got (never who cast them); and each stays at its own address. Everybody who entered is told the result. You can change your entry until the week closes, or withdraw it, which takes it down with its picture and the Moonbucks it earned. If you have blocked Skippy you cannot enter. Skippy enters each week too, for fun, with a picture it drew and a few words: you can vote for its entry like any other, but it never judges its own, so it never wins.

Skippy can draw the picture for your entry in Ignition, but only when you ask it to, from “Draft with Skippy” as you enter, once a week. You tell it your idea in up to three messages, and it asks you about it after each; then it draws it from everything you said, and writes the words to go with it, only once it has said it can (section 7 says who sees those). What you write to it, and what it says back, is not shown to anybody else. The drawing and its words are yours to change, submit or discard. Submitted, they are your entry like any you write, and your entry says “Drawn with Skippy” wherever it is shown, to everybody who can see the entry, so that it is fair to those who made theirs by hand; when the week is judged, Skippy is told which pictures it drew. Discarded, it is deleted at once, with its words, and there is no other drawing that week.

A bug report is read by the people who run the site, and nobody else. Every super admin is told that you sent one, by name, on the site, in a notification on their device if they turned those on, and in their activity email, none of which quotes it; they read it, with what was sent with it, on their dashboard.

Members who joined early carry a “founding member” badge on their profile. It records when you joined and nothing else.

The people who moderate carry a “community moderator” badge. An admin’s or a super admin’s picture has a small shield on it wherever it appears, which says “Community moderator” when you point at it or, on their profile, tap it, so you know who is looking after the community. Everybody who can see their picture sees it, signed out on a public profile included. It says that they moderate and nothing else, not which role they have.

Your Moonbucks, your level and your run of days are shown to other members. Your profile shows your total, the level it makes and, while it lasts, how many days in a row you have come in; the leaderboard on the Moonbucks page and the home page ranks members (never the person who runs the site) by Moonbucks, this month and of all time, and shows how many places each has moved up or down, or whether they are new to it, since 24 hours before. The total, the level and the leaderboards count every Moonbuck you have earned: spending them on a blueprint in Luna lowers what you have to spend and nothing else, while Moonbucks you give away lower the total too. Only signed-in members see any of it, even on a public profile, and members you have blocked, or who have blocked you, do not see you there. Other members never see what earned your Moonbucks or which days you came in: only you see your own list, on the Moonbucks page.

Your settlement in Luna is seen by the others who play it. Everybody on the Moon shares one world, so members who play Luna can see your settlement, every building in it and how many floors each has, with its name over the middle of it, your name, your picture, the role in your profile and the short name in your profile’s link, and can look it up by that short name. Luna’s leaderboard shows them your settlement’s name, how many people it houses and its era, with your name, and so does a panel on your profile, with a picture of your settlement, which only they are shown. They never see how much metal you hold, what you have bought or your settlement’s diary. When your settlement lands, members whose settlements stand near it are told so the next time they open Luna, and shown where it is, unless you have blocked them or they have blocked you. Members you have blocked, or who have blocked you, still see your buildings, since they stand where they stand, but not your name, your picture or your settlement’s name on them, and cannot look your settlement up or find it on the leaderboard. Nobody who doesn’t play sees any of it, and nobody signed out. When you first land in Luna, every super admin is told that you did, by name, on the site, in a notification on their device if they turned those on, and in their activity email, each leading to your settlement.

Moonbucks you send somebody are shown on the timeline. Every signed-in member can see who sent how many to whom, and the note that went with them, as they can see a post; it can be liked, answered and reported like one. Members who have blocked either of you, or whom either of you has blocked, do not see it. The person you sent them to is told, with your name and how many, on the site, in a notification on their device if they turned those on, and in the activity email, which never quotes your note. Deleting it takes it off the timeline; the Moonbucks stay with whoever you sent them to. Nobody signed out ever sees any of it.

Other members can see when you are here, and when you last were. While you have the site open you appear as online to everyone else, and your name can be listed in the “Online now” box on the home page. When you are not, your profile and your row in the member directory tell other members roughly how long it has been — “last seen two hours ago” — up to “a week ago”, and nothing once it has been a fortnight. Both come from the same thing: the last time a page you had open asked us for anything, which it does continually while it is in front of you, to see whether anything on it has changed. You stop appearing as online about ten minutes after you stop reading. For this we keep only that single most recent time, beside how long the visit you are on has lasted so far, which only adds to the daily totals in section 4 and nobody sees, and there is no setting to hide it. Moonbucks keep the dates of the days you came in as well (see section 4), but never the times, and other members never see them.

The world map on the home page is drawn from the location on your profile. It shows a dot for each place members have given, not a dot for each member. Signed-in members can open it and press a dot to see who is there, with their names and pictures, which says nothing a member could not already read on your profile; you are listed under the place we matched, not exactly what you typed, and never to anybody you have blocked or who has blocked you. Your location is matched against a list of place names that ships with the site, on our own server: it is never sent to a mapping or geocoding service, and the map itself is a drawing we serve rather than tiles fetched from anybody. If you would rather not be on it, write something general — a country, or nothing at all.

Pictures you attach to a post, a moonshot, a blog post or a remark in the Lounge, and videos you attach to a post or a moonshot, are more public than that. The Lounge itself is for signed-in members, but its pictures, like the rest, are served from a public address, so anyone holding the link can open one without signing in, and search engines or anyone the link is forwarded to could reach it. The address contains a random identifier, so it cannot be guessed and the pictures and videos are not listed anywhere, but it is not a secret either. Deleting the post, moonshot or remark, removing the picture or video on its own, or giving a moonshot another cover or pitch video in place of yours, deletes the file — though anyone who already saved a copy keeps it, as with anything on the web. Please do not attach a picture or a video you would mind a stranger seeing. Your profile photo works differently: it is served only to signed-in members, unless you have made your profile public, in which case it is shown with it.

Direct messages are a weaker kind of private than people usually assume. They are stored as ordinary text in our database, not encrypted end-to-end. Other members cannot read them. But we could: anyone with access to the database — in practice, the person who runs the site — is technically able to read them, and moderators can remove a message that has been reported. We do not go looking through people’s messages, and we would only ever read one in response to a report or a legal obligation. Even so, please do not send anything through this site that you would be upset to have read.

A picture in a message is as private as its words. It is kept in our own database, never in the public store that posts’ pictures are in, and its address works only for the two of you, signed in, while the message is there and neither of you has blocked the other; for anybody else, signed in or not, there is nothing at it. A moderator can see it only once the message has been reported to them. Deleting the message, or a moderator taking it down, deletes its pictures outright. Skippy cannot be sent one.

Messages you send Skippy are read, by design. They are sent to Anthropic so that its model can write Skippy’s answer, and the people who run the site can read them, with what Skippy said back, on their dashboard. Skippy says so at the top of its chat window.

Skippy can draft a poll for you, but only you can send it. Ask it in its chat window and it proposes a question and answers under its message, which you can ask it to change. Nothing is sent until you press “Submit for approval”; then it waits for an admin to approve it, like any member’s poll, and when it goes up it is shown as yours, marked as drafted with Skippy. On the Polls page you can also have Skippy draft one from a topic you pick or name, and a line about what you want to ask if you write one: the draft appears there for you to change, nothing of it is kept until you send it, and a poll sent from it is marked as drafted with Skippy the same way.

Deleting a conversation deletes it for you, not for the other person. It disappears from your Inbox, but they keep their copy of everything that was said, because it is their conversation too. The messages themselves stay in our database for as long as either of you can still see them.

The person you are messaging can see when you have read what they sent. Opening a conversation marks it as read, and under their latest message they see “Seen” rather than “Sent”, with the time you read it if they hover over it. Only the other person in that conversation sees it. We keep one time per conversation — when you last read it — not a history of every time you looked, and there is no setting to turn it off.

The people you are writing to can see that you are typing. While you type a message to somebody, they see “is typing…” with your name at the end of your conversation, and “typing…” in their list of conversations; nobody else sees that. While you type in the Lounge, everybody with the Lounge open sees your first name in “… is typing…” under the conversation, or a count, such as “3 people are typing…”, when several are. Either way it lasts until a few seconds after you stop or until what you wrote arrives, it is never shown to anybody either side of a block with you, and what you are typing is not sent until you send it. It is held in our server’s memory for those few seconds and never stored.

Which advert brought you is seen only as totals. The site’s owner sees, on their dashboard, how many people arrived by each advert’s link, how many joined in that visit, and how those members have taken to the site, as numbers: never who they are. No other member is ever shown it.

7. Who else is involved

We keep the list of companies that touch your data as short as we can.

• Google and LinkedIn — sign-in only, and only whichever you use. It will know you signed in to More Moonshots.
• Railway — hosting for the site and the database.
• Resend — sends our emails: sign-in codes, codes to change your address and the note to the old one, and activity emails. It receives your email address and the email itself, and delivers it; open and click tracking are turned off.
• Anthropic — its Claude model reads the headlines of public news stories, and the short description each publisher’s feed gives with them, to choose the ones on our News page, notice when two report the same news, and write a line about each. Once a week it also reads the headlines of the stories our News page kept that week, to pick out new names worth watching for (a new model, mission or medicine) for the filter that decides which stories it reads first. Once a week it also helps Skippy find more news sources: it may search the web for sites that publish news on topics our News page has little of, told those topics, how many stories each brought last month and the sites we already read or have turned away; and it reads the latest public headlines of sites Skippy might read, to judge whether they are worth trying. The sites come from the web search, a list we started it with, the sites the stories we keep link to, the sites the X accounts we follow link to, and the sites members link to in their posts, counted by how many members, never who. Skippy reads the best of them itself, on a two-week trial, rather than an admin choosing them: every story they bring is judged like any other before anybody sees it, and an admin can keep or remove any of them. It also writes the descriptions Google’s Gemini draws the illustrations from that our News page shows on a story that came without a picture of its own (below): for each, it is told only the kind of story it is for, a topic and a subject within it such as space launches, and the scenes already drawn for that subject, so that they differ. Never a story, a headline or anything about anybody. In the same way it reads public posts from a list of X accounts our admins choose — each post, its author’s public name, handle and follower count, and its public counts of likes, reposts, replies and views — to choose the ones shown as From X and write a line about each. Once a week it also helps Skippy find more X accounts worth following: it reads the public profiles (name, handle, bio, follower count and the kind of tick X gives them) and the latest public posts of accounts that the ones we follow mention or quote, or whose posts members link (below), told which of the accounts we follow mentioned them and how many members linked them, never who; and it may search the web for people who post about topics we follow few accounts on, told those topics and the handles we already follow. Skippy follows the best of these itself, on a two-week trial, rather than an admin choosing them: their posts are judged like any other before anybody sees them, stay out of the timeline while on trial, and an admin can keep or remove them at any time. Nothing about any member is part of any of that, and X itself is sent nothing about members: our server asks it only for public posts and profiles of X accounts and, when somebody links a post on X where they ask Skippy something, for that post (below). For Luna it is sent the game’s own list of buildings and blueprints, and nothing about anybody who plays, to propose a new one each day for the people who run the site to approve. It also writes Skippy’s drafts (section 6), and for those it is sent:
  • when you join, what your profile says — your name, role, interests, about me, what you can help with and are looking for, and your moonshot line — and the text of the websites you list, which we fetch once to do it;
  • when you publish a moonshot, what it says and the text of its link;
  • for either, the name, handle, role, interests and what they can help with of a few other members it might introduce;
  • when you join through a member’s invitation, their name and handle, with your profile, so that its welcome can thank them;
  • when somebody joins through your invitation, your first name, and their name, role and moonshot line, so that it can write you a thank-you;
  • when you tag Skippy in a post or a comment, or reply to something it wrote, what you wrote, your first name, what the post or moonshot it is under says, the comment you were answering, and the comments before yours there, without anybody’s name; and the text of up to two web pages linked in what you wrote, in the comment you were answering or in the post it is under (under a news story, the story itself), which our server fetches once to do it, and of up to two posts on X linked there, which we ask X for (below); and, under a post sharing a published blog post, that blog post’s title and the first 1,500 characters of it;
  • when you tag Skippy in the Lounge, or say something there in the ten minutes after it answered you, what you wrote, your first name, and up to the last hour of what was said there before it, without anybody’s name, and the text of up to two web pages and up to two posts on X linked in what you wrote;
  • when you send Skippy a message, your conversation with it, and your first name and what your profile says that suggests who you should meet: your role, interests, About me, what you can help with and are looking for, and your moonshot line, never where you live or the links on your profile; the text of up to two web pages linked in what you have said since its last answer, which our server fetches once to do it, and of up to two posts on X linked there, which we ask X for (below); and, so that it can suggest who you might connect with, the names, handles, roles, interests and what they can help with of up to 25 other members who share your interests, never anybody you are already Moonshot Mates with, anybody suspended, or anybody either side of a block with you or with Skippy. Whoever it suggests is not told;
  • when you post in the timeline (an update on a published moonshot, and a blog post you share there, included), once, between a quarter of an hour and an hour and a half later, so that it can decide whether to like it: what you wrote, your first name, what it updates or shares (the moonshot’s title, or the blog post’s title and first 1,500 characters), the text of up to two web pages linked in it, which our server fetches once to do it, up to two of its pictures, by their public address (a still picture from its video, if it has one, in place of one of them: never the video itself), and up to twelve of the comments under it so far, without anybody’s name and none by anybody either side of a block with you or with Skippy; and, when it decides to comment on it, the same again, with what it made of it and the name, handle, role, interests and what they can help with of up to 25 other members it might introduce, never anybody suspended or either side of a block with you or with Skippy;
  • when Skippy answers a tag or a message, Anthropic itself may open a web page linked in what it is answering (what you wrote, the post and the comments around it that it is shown, or your conversation with it) that our server did not read for it, such as one that turns robots away or a PDF, or a page linked from one it opened: never any other address, never a social network’s or this site’s own, and only while it writes that answer. The site sees a request from Anthropic, not from you or anybody reading, and is sent nothing about you. Which pages it opened is kept with the answer, as the pages our server reads are;
  • when you ask Skippy to draft a poll on the Polls page, the topic you picked or named, the line you wrote about what you want to ask if you wrote one and, if you ask for something else, the draft it gave you, never who you are;
  • once a day, the previous day’s posts and comments on the timeline without anybody’s name, new moonshots and poll questions, words that went into the Lexicon, the day’s news and community-wide figures: how many people joined, whether the community was busier than usual, and the average p(doom) and p(abundance), once at least ten members are counted in them, since the post is public; any change at the top of the public frontier AI leaderboard; and, while a week of Ignition is open, its title, when entries close and how many members have entered, never who, nor anything about votes; and the day before’s Moonshot Dilemma: its question, how members answered it, as shares, and up to ten of the reasons given for each side, never who gave them, nor any reason from somebody who has blocked Skippy; and, once it is up, the question of its own poll for the day, never how anybody answered it;
  • once a day, to write the day’s poll, the headlines of the news stories we kept in the last day, with their source and topic, the subjects the Polls page offers, and the questions of the polls it has asked before, so that it never asks one again; nothing about anybody, and never a member’s poll, a comment on one, or how anybody voted;
  • once a day, the questions it has asked as the Moonshot Dilemma, so that it can write a new one, with its thoughts on it, and nothing about anybody; and, when one of the people who run the site asks for its thoughts on a dilemma already asked, that dilemma’s question alone;
  • when a new episode of Moonshots, one of the podcasts on the Podcasts page, comes out, its title, date, length and YouTube description, all of which are public;
  • when you suggest a word for the Lexicon, with “Suggest a word” or by asking Skippy to add it in a tag or a message, the word as you typed it or as Skippy took it from what you asked, and what you said you think it means, if you said, never who suggested it, with the words already in the Lexicon or waiting to go in, and any notes an admin adds about the word when they send it back to be looked up again; and once a day, those same words, so that it can choose a new one;
  • once a week, the titles of the last few weeks’ challenges in Ignition, so that it can set a new one;
  • once a week, the title and brief of that week’s Ignition, which it set itself, so that it can make an entry of its own; never anybody else’s entry;
  • when a week of Ignition closes, every entry in it, each by a label and never with anybody’s name: its words, and for its link, the page’s title and description and some of its text, which we fetch again to do it; its picture, which Anthropic fetches from the picture’s public address (section 6); whether Skippy drew its picture; and how many members voted for it, never who. Entries from anybody who has blocked Skippy are left out;
  • only when you ask Skippy to draw a cover for one of your moonshots, that moonshot’s title, stage and summary, and nothing else about it or you, so that it can write what to draw;
  • only when you ask Skippy to draw the picture for your entry in Ignition, that week’s title and brief, and your messages to it that week with what it said back to each, and nothing about you, so that it can ask about your idea, say whether it can draw it, and write what to draw and the words to go with it; and, if you add a final touch to the drawing, what you ask it to add, so that it can say what to change. Google’s Gemini is sent only what Skippy wrote for it to draw and, for a final touch, the drawing it made for you;
  • only when you ask Skippy to draw you a profile picture and add a line in your own words, that line and nothing else, never your name or anything about you, so that it can check the line is fit to draw before anything is. We do not store the line.
  • only when you style your profile with Skippy, the words you write about how it should feel (or, for a new header alone, what it should show) and, when you ask for something else, the look it suggested before, never your name or anything else about you, so that it can choose the colours and the pattern from the site’s own lists, name the look and write what to draw for its header. We do not store your words.
  It is never sent your location, your email address, your LinkedIn, X, GitHub or Instagram profile, messages you send anybody but Skippy, a picture sent in a message (Skippy cannot be sent one), anything said in the Lounge unless somebody tags Skippy there or is talking with it (and never a picture said there, only the words), how anybody voted, or how any one member answered the Moonshot Dilemma.
• Cloudflare — DNS for the site, and storage for the pictures attached to posts, moonshots, blog posts and remarks in the Lounge, for the videos attached to posts and moonshots (made into the copies everybody sees on our own server, not by Cloudflare or anybody else), and for the recordings Listen plays of blog posts, Skippy’s morning briefs and the Lexicon. Never the pictures in direct messages, which stay in our own database.
• X, LinkedIn and WhatsApp — for your invitation, only if you press one of the buttons that share your invitation link, which opens their own page with your link in it, as following any link to them would. We send them nothing about it ourselves (X is asked for a post somebody links, below, and nothing else), and the QR code beside them is drawn in your browser.
• Websites you link to — when a post or an entry in Ignition has a link in it, our server fetches that page once to make the card under it: its title, a line about it and its picture (for a YouTube link, YouTube’s description of the video), or, for an entry whose page names no picture, the site’s icon. A link pasted into an entry is opened as soon as it is pasted, to check that it goes somewhere and to show you its card before you submit, and again when you submit if that was more than ten minutes earlier. An entry’s page is fetched once more when its week is judged, for its text. When you tag Skippy, or send it a message, with a link in it, or tag it under a post or a news story that has one, our server fetches up to two of those pages once, so that Skippy can read them (section 7); never a social network’s, which it does not open. The site sees a request from our server, not from you or anybody reading, and is sent nothing about you. We keep a copy of the picture with the post’s other pictures, so nobody’s browser asks the site for it. While Skippy writes its answer, Anthropic may open those links itself when our server did not read them (see Anthropic, above). A site that members link to may also be looked at as a news source (see Anthropic, above): our server then reads its home page and its news feed, and the site is sent nothing about you or anybody else.
• X — when you link a post on X where you ask Skippy something (a tag, the comment you were answering, the post it is under, or a message to it), our server asks X’s API for that post by its id alone, up to two in an answer. X sends back its words, its author’s name and handle and when it was posted, which Skippy reads and we do not keep. Each read is paid for out of the site’s monthly budget for X, so once that is spent the post is not read. X is sent nothing about you or anybody here. When you link a post on X in a post or a comment here, Skippy may count whose post it is among the accounts worth a look for From X (above): only that account’s handle and how many members linked it are kept, never who, and X is asked about that account, not about you.
• Google (Gemini) — draws the picture that goes with Skippy’s morning brief. It is sent only Skippy’s description of what to draw, which is written from that day’s public news headlines and nothing else: nothing about any member, and nothing anybody wrote here. It also draws a cover for a moonshot when its owner asks Skippy for one, and then it is sent only the description Claude wrote from that moonshot’s title, stage and summary: never who owns it or anything else about them. It draws the picture for Skippy’s own entry in each week of Ignition, and then it is sent only Skippy’s description of it, written from that week’s brief. It draws the picture of a building Skippy proposes for Luna, and then it is sent only Skippy’s description of that building. And it draws a profile picture for anybody who asks Skippy for one, a member or somebody joining, and then it is sent only what they picked from Skippy’s lists (who they are in the picture, an age and, for a person, a skin tone if they pick one, a style, a mood, what they wear, what is behind them and a colour) and, if they added one and Claude passed it, their own short line: never their name or anything else about them. We store neither their choices nor their line, and keep the picture only if they use it. And it draws the picture for a member’s entry in Ignition when they ask Skippy for one, and then it is sent only the scene Claude wrote from their conversation with Skippy, with how pictures here are drawn; when they add a final touch, it is sent that drawing back with Claude’s description of what to change. Never their own words, their name or anything else about them. We keep the drawing, with what Gemini was asked, as their picture, and delete it once the week is over if they did not use it. It also draws the header for a profile when its owner styles it with Skippy, and then it is sent only the description Claude wrote from their words: never their name or anything else about them. The drawing is kept as their own picture and, once they use it, is the header across the top of their profile. It also draws the illustrations our News page shows on a story that came without a picture of its own, a few for each kind of story, drawn once and shown on many, and then it is sent only the description Claude wrote from the kind of story it is for (a topic and a subject, such as space launches): never a story, a headline or anything about anybody. It also reads published blog posts, Skippy’s morning briefs and the words in the Lexicon aloud, so that Listen can play them with your phone’s screen off, while the people who run the site have that switched on. For a blog post, members-only or public, it is sent its title, its writer’s name and its words, with a picture’s description where the post has one; for a morning brief, its date, its title and its words; for a word in the Lexicon, the word, its meaning, its paragraph more and where it comes from. Never the comments on any of them, a draft, changes not yet published, who suggested a word, or anything else about anybody. What it sends back is kept as the recording (section 6).
• YouTube (Google) — the pictures of Moonshots episodes, on the Podcasts page and on posts that share an episode (Skippy’s post about each new one among them), are loaded by your browser from YouTube’s image server, which sees your browser’s address as any site you load a picture from does. We send it nothing about you.

That is the entire list. There is no email marketing platform, no customer data platform, no advertising network and no data broker involved.

8. Where your data is stored

The site and its database run in Amsterdam, in the Netherlands, inside the European Economic Area. Pictures and videos attached to posts and moonshots, and the recordings Listen plays, are stored in Cloudflare’s Western Europe region, and served through its global network. Resend, which sends our emails, is based in the United States, as is Anthropic, which is sent what section 7 lists. Google, LinkedIn, Cloudflare and Resend all operate globally and transfer data under their own safeguards, such as the UK International Data Transfer Addendum and Standard Contractual Clauses, which you can read in their privacy policies.

9. Why we are allowed to use it

Under the UK GDPR we rely on the following:

• Performance of a contract — creating your account, signing you in (on your phone from your computer too), showing your profile to other members, delivering your messages, keeping your Moonbucks, drawing a cover for your moonshot, the picture for your entry in Ignition, a profile picture or a look for your profile when you ask Skippy to, and telling you by email about activity you have not seen, which you can turn off at any time.
• Legitimate interests — keeping the community safe and usable. This covers moderation, reports, suspensions, rate limits, protecting the site from abuse, and fixing the bugs members report. We think members have a clear interest in a community that is moderated, and none of this involves profiling or advertising.
• Legitimate interests — ordering your timeline for you when you have chosen For You, from what has been on your screen in it (section 4). It is for you alone, kept a month, and choosing Latest stops it.
• Legitimate interests — helping the community grow: recording whose invitation somebody joined through, rewarding it with Moonbucks, and offering members the app on their phone, which they can turn down for good.
• Legitimate interests — welcoming new members, thanking members whose invitations bring them, answering moonshots, replying to members who ask it something, liking and now and then commenting on the posts it finds genuinely interesting, defining the words members suggest for the Lexicon, introducing members who share interests and running Ignition, through Skippy. The people who run the site oversee everything it writes. The only thing it decides is which entry wins Ignition, which earns Moonbucks and nothing more, and they approve that unless they have chosen otherwise. You can object at any time by emailing us (section 11) or simply block it.
• Legitimate interests — letting members listen to blog posts, Skippy’s morning briefs and the Lexicon, with a recording that goes on with the screen off. A blog post is one its writer chose to publish to the community, and only its title, its writer’s name and its words are sent to be read aloud. You can object at any time by emailing us (section 11), and the people who run the site can turn the recordings off.
• Consent — for the notify-me list we kept before the community opened, where you gave us your email address for that single purpose. The community is open now, so the list has been closed and every address on it deleted.

10. How long we keep it

We keep your account and its contents for as long as you are a member.

You can delete your account whenever you like, from Settings, by typing “delete my account” to confirm. It erases your account and everything in it straight away and for good: your profile and photo, your posts, comments, likes and other reactions, your moonshots and everything on them, your polls and votes, your answers to the Moonshot Dilemma and the reasons you gave, your remarks in the Lounge, your Ignition entries, every conversation you were in (both sides of it), your notifications, reports, blocks, whose posts you hid and Moonbucks, your settlement in Luna and the blueprints you bought, which advert brought you, if one did, whatever Skippy wrote to you, and anything you deleted before, which is otherwise kept marked as removed (see below). Comments other people left under yours stay, and Moonbucks other members earned from you stay with them. A fault you ran into stays in the error log without anything that links it to you. The site owner can delete an account in the same way, from the dashboard. If you sign in again afterwards, you start afresh as somebody new.

One thing to be clear about. When you delete a post, a reply, a moonshot or a message, it disappears immediately and permanently from the site — nobody can see it again. But the underlying record stays in our database, marked as removed, rather than being erased on the spot. We do it that way so that moderators can deal with a reported item after it has been deleted. Profile photos and the pictures in messages are the exception: deleting your photo, or a message, erases the picture itself straight away. A picture you add to a message and never send is deleted after a day, and so is a video you send and never post (or whose post could not go up). If you want your content genuinely erased rather than hidden, email us and we will do it — see section 11.

The people who run the site can clear a member’s settlement and blueprints from the dashboard, or everybody’s at once to start the game again, which gives back every Moonbuck spent on them. Taking somebody out of the test, or shutting Luna to everyone but the testers again, keeps what they built, and it is there if they are let back in.

Error reports (see section 4) are deleted automatically after 30 days. So is For You’s record of what has been on your screen, a month after you last saw each thing. The lines in your notification bell are deleted three months after they were added. A bug report you send is kept until it is marked fixed, and deleted 30 days after that. The record of a code that signs your phone in from your computer, and of its short code, is deleted within a day, like an emailed one, and so is the record of a code to change your email address, which goes as soon as the change is made.

Whose invitation you joined through is kept for as long as you are a member, with the Moonbucks it earned them. If you are suspended, those Moonbucks are taken back. When you first opened your own invitation is kept for as long as you are a member too, since it is what lets your link name you.

Your answers to the Moonshot Dilemma, and the reasons you gave, are kept for as long as you are a member, since the totals are made from them. A reason you or a moderator deleted is kept marked as removed, like a deleted comment, and your answer still counts.

The words of Skippy’s drafts that were turned down or never used are deleted 30 days after they were decided, and the notes and pages behind the ones that were posted are cleared then too, as is what it made of each post it read and why it liked it or not. What it posted stays like any comment, post or message, and its morning briefs stay at their public addresses for as long as they are up in the timeline. A cover Skippy drew for you that you did not use is deleted when it draws you another, or a week after it was drawn. A header Skippy drew for your profile is the same: unused, it is deleted when it draws you another or a week after it was drawn, and one you stop using is deleted then; the words you asked for it with are never stored. The days you styled your profile are kept for that card in the timeline until you go back to the usual look. A profile picture Skippy draws you is not kept here at all unless you use it, and what you picked for it, with any line of your own, is never stored here; only your browser keeps the last skin tone you picked (section 5). A picture Skippy drew for your entry in Ignition that you did not use is deleted once the week is over, and so is what you wrote to it that week and what it said, whether you used the picture or not; one you used is kept like any picture on your entry, with the description it was drawn from. Your entries in Ignition are kept like posts, for as long as you are a member, and stay at their own address and among the Ignition page’s past weeks until you withdraw them or a moderator takes them down. Your votes in Ignition are kept with the week they were cast in, for as long as you are a member. The text of your website, or of any page Skippy reads, is never stored; which pages it opened for an answer is kept with the answer, for the people who run the site. A word you suggested for the Lexicon keeps your name beside it for as long as you are a member.

A record of each request we make to an AI model — which model, what it was for, how many tokens it used and what that cost, and for Skippy which of its drafts it was for, or for a recording which blog post, morning brief or word in the Lexicon it was of — is kept for a year, so that the people who run the site can see what the AI costs. It holds no words: nothing anybody wrote, and nothing the model wrote.

A recording of a blog post, a morning brief or a word in the Lexicon is kept for as long as it is up and its words are as they were when it was made: an update with changes replaces it, and deleting it, a moderator taking it down, or deleting your account (for your blog posts) deletes it. Turning the recordings off keeps the ones already made, though no page hands them out, for when they are turned back on.

The record of what earned your Moonbucks, the days you came in among it, is kept for as long as you are a member, because your total and your level are made from it. When something you made is deleted, the Moonbucks it earned are taken off the record with it. Moonbucks you sent or were sent, who to or from, how many and the note, are kept for as long as you are a member, even once the post showing them is deleted, since the totals are made from them.

Records of moderation — reports, suspensions and the notices we send when we remove something — are kept while they are needed to keep the community safe.

11. Your rights

Under the UK GDPR you have the right to ask us for a copy of the personal data we hold about you, to have it corrected, to have it erased, to restrict or object to how we use it, and to receive it in a portable form. You can also withdraw consent where we rely on it.

To have everything erased, you can delete your account yourself in Settings (section 10). For anything else, email me@deanwild.co.uk and we will deal with it. There is no form and no ticketing system; it is a small site and the request comes straight to a person. We will respond within one month.

If you think we have handled your data badly, you can complain to the Information Commissioner’s Office at ico.org.uk. We would rather you told us first so we can put it right.

12. Security

Sign-in is handled by Google or LinkedIn, by a single-use code emailed to you, or by a single-use, two-minute code your own signed-in computer shows your phone (or the short code beside it, typed), which only our page, open on your phone, can use, so we never hold a password of yours to lose. The connection to the site is encrypted, the database is not reachable from the public internet, and access to it is limited to the person running the site. No system is perfect, and we will tell you promptly if something happens that puts your data at risk.

13. Changes to this policy

If we change this policy we will update the date at the top. If a change materially affects what we do with your data, we will tell members rather than quietly changing the page.