Last updated 8 September 2026
Privacy Policy
Mossy is a macOS app made by one person. This page lists everything that leaves your Mac, and nothing is left out. If something here turns out to be inaccurate, write to hello@heymossy.com and it gets fixed.
No account, no tracking
There is no sign-up, no login and no password. The app contains no advertising or tracking SDK, and no third-party dependency of any kind. Nothing it sends identifies you, and the daily counters can be switched off. The version number is the one exception, and it is listed below.
Two clarifications about the website, which is not the app. It uses Cloudflare's own traffic measurement, which sets no cookie and makes no request to any third party. And if you are not on a Mac, it offers to take your email address for the waitlist — and, if you vote for the next plant, it keeps a scrambled fingerprint of your connection, described below. That is all the personal data this site ever collects, and only if you type or click it in.
The waitlist, only if you ask for it
Mossy runs on macOS. If you visit from another system, the page offers to tell you when that
changes. If you leave your address, three things are stored: the address itself,
the date you left it, and one word for your operating system
— windows, linux and so on — worked out from the browser identification
your request already carries. Nothing else. No name, no page you visited, no IP address.
That one word exists for a reason worth stating: the promise is a single email, so it has to go to the right people. Announcing a Windows version to someone on Linux would spend their one message for nothing.
It is stored by the same Cloudflare relay described above, in its database, and we send exactly one email — the day the version you are waiting for exists. No newsletter, no progress reports, no beta invitations. If it is never built, you never hear from us at all. The address is kept until that one email is sent, and deleted afterwards. Want out sooner? Write to hello@heymossy.com and it is removed the same day.
The vote for the next plant
heymossy.com/vote lets you pick the next plant, one vote per plant per connection. To keep it to one, the relay stores a fingerprint of your IP address: the address run through SHA-256 together with a secret key that only the relay holds. The fingerprint cannot be turned back into the address without that key, and the address itself is never written. Next to it: the plant and the date. No cookie, no account, no name. The table is deleted when the vote closes.
One thing does stay in your browser, and only there: once you have voted, this page writes a
single flag so the home page stops asking you again. Its value is a single 1 — not
which plant you picked, not when. Its name identifies the vote
(mossy-vote-2609). It never leaves your machine, and clearing your browser data
removes it.
What is stored on your Mac, and stays there
Your settings, the sentence you write for your breaks, your break counter and your event log
live in ~/Library/Application Support/Mossy on your own machine. Deleting that folder
erases all of it. None of it is uploaded anywhere.
If your Mossy was given to you, the first name and the note of whoever gave it live there too — that is what the settings window lets you read again. They arrived inside the link you were sent, after the hash: browsers never send that part of an address to the server, so we have never seen it and cannot see it. Offering a cutting sends nothing either: the link is made on your Mac.
The one thing Mossy changes outside its own folder
With your agreement, Mossy adds itself to your login items so it is there after a restart. macOS notifies you when it happens, the checkbox in Mossy's settings reflects the real system state, and unchecking it removes the entry. Nothing is sent.
What leaves your Mac — the complete list
Four requests. Two go to relay.heymossy.com, a small Cloudflare Worker operated by
the developer. The other two carry no identifier at all: they only ask "is there a newer version"
and, if you say yes, download it.
1. Asking for a break exercise
Sent when you take a break. It contains:
- The sentence you wrote for what your breaks are for, plus a short context (how long you have been sitting, and which exercises you were recently given so you do not get the same one twice). Capped at 4 000 characters.
- An anonymous install identifier — a random UUID generated on first launch. It is not derived from your Mac, your name, or anything about you. Its only purpose is a per-install daily quota, so a single installation cannot exhaust the shared API budget.
- The version of Mossy you are running — a string like
0.2.11+a1b2c3d. It says nothing about you: twelve machines share the same one. It exists so I can tell whether an update actually reached people, which the optional daily ping answered for only a third of installs.
The relay forwards this text to Anthropic, which generates the exercise and returns it. Anthropic's handling of that data is governed by its own privacy policy and its commercial terms, under which inputs are not used to train models. The API key lives only as a Cloudflare secret; it is never inside the app.
If Anthropic is unavailable, the relay writes the exercise itself. Anthropic refuses requests from some regions outright, and it can also fail; rather than fall back to one canned stretch, the relay then runs a model on Cloudflare's own machines (Workers AI) with the same text it would have sent to Anthropic. No new recipient is involved — Cloudflare already carries and hosts the relay — and Cloudflare states it does not use this content to train models. If that also fails, your Mac writes the exercise offline, with nothing leaving it at all.
The relay stores no request content in its database. Your sentence and the exercise are not written anywhere. Two things are recorded: a counter of how many generations that install identifier has used today, and the version above, written once a day. Two honest exceptions, because this page is meant to be exact rather than flattering:
- Your IP address is used as a rate-limit key — 6 requests per 60 seconds, to stop a script from draining the shared budget. It is handled by Cloudflare's rate limiter for the duration of that window and is not written to the database — the vote's fingerprint, described above, is the one derived exception. Cloudflare also processes it as the network provider carrying the request, as it does for any website you visit.
- If Anthropic returns an error, a diagnostic line is written to Cloudflare's short-lived Worker log: the HTTP status and up to 300 characters of Anthropic's reply, then — if the Cloudflare fallback runs — whether it succeeded, your two-letter country code, and, when it fails, the reason and the shape of what came back (which field names were present, never their contents). That is there to make failures debuggable. None of it contains your sentence.
2. The optional daily ping
Once a day the app can send a small summary of the previous day. It exists so the developer can tell whether people actually take their breaks, which is the only question this project is trying to answer. It contains:
| Field | What it is |
|---|---|
| install identifier | the same anonymous UUID |
| day | the date, e.g. 2026-08-15 |
| version | the app version you are running |
| shown / done / refused | how many breaks were offered, taken, declined |
| reminders | how many times Mossy asked |
| minutes | total minutes counted as sitting |
That is the whole payload. It never contains the sentence you wrote, the exercises you were given, or any text you typed.
You can switch it off in the app's settings — the counter toggle. Once off, no counts are sent. The version number above is not part of this ping and is sent either way, with each break request.
3. Checking whether a newer version exists
Every six hours, and whenever you ask, Mossy reads one small file:
version.json, hosted on GitHub at
raw.githubusercontent.com. It contains a version number, a one-line release note and
a download address — nothing about you.
Nothing is sent beyond what any web request carries: your IP address reaches GitHub, as it would for any page you open. No identifier, no counters, no version of your own. This request has always existed; it was missing from this page until 2 September 2026, and that was an omission on our part.
4. Downloading the new version
Only when a newer version exists and the update goes ahead — you clicked, or you left
"install my updates at startup" checked. Mossy downloads the package from
heymossy.com, the same address the button on the home page serves.
Nothing is sent beyond the request for the file. No identifier. Before replacing itself, Mossy checks the package is signed by us, notarised by Apple, and is a strictly newer version — otherwise it refuses and opens the download page instead.
The checkbox in the settings changes when this happens, never what is sent: at startup on its own, or after your click. Mid-day it always asks first.
Retention
Daily ping rows are deleted after 60 days, automatically, by the relay itself. Quota counters are deleted on the same schedule. There is no backup and no export of this data to anywhere else.
Who else sees it
Two processors, and no one else:
- Cloudflare — hosts the relay and the database (Workers and D1), and writes the exercise itself when Anthropic is unavailable (Workers AI).
- Anthropic — generates the exercise text.
Nothing is sold, shared with advertisers, or used for any purpose other than the two described above.
Your rights
Under the GDPR you may ask for a copy of what is held about your install, or ask for it to be deleted. Since the only identifier is the random UUID stored on your Mac, include it in your request — it is in the app's settings. Write to hello@heymossy.com and expect an answer within 30 days. Deleting Mossy's data folder also orphans the identifier for good, and the server rows expire on their own within 60 days.
Children
Mossy is not directed at children under 16.
Changes
If this policy changes, the date at the top changes with it. Anything that would widen what leaves your Mac will be announced in the app's release notes, not slipped in quietly.
Contact
Alban Bertolini, Bordeaux, France — hello@heymossy.com