Privacy

Who is responsible

Azri Putra, Denpasar, Bali, Indonesia, who runs Moonarc, is the controller of the personal data described here, under Indonesia's Personal Data Protection Law (UU PDP, Law No. 27 of 2022) and, for people in the EU and the UK, the GDPR and UK GDPR. Write to hello@moonarc.dev about anything on this page.

This site

The site sets no cookies, runs no analytics and loads nothing from other domains. It is hosted by Vercel, which receives each request's IP address, URL and browser details in order to serve it, and keeps them in a request log for up to a day. We read that log only to fix problems and do not use it to identify visitors.

Stored in your browser

A few settings are kept in your browser's storage. They never leave your browser, and clearing site data removes them.

• ma-theme (localStorage): your light or dark choice.
• ma-motion (localStorage): your motion setting.
• ma-catalog (sessionStorage): the catalogue filter, so the breadcrumb returns to it.
• ma-demo-curtain (sessionStorage): the transition picked on the demo pages.
• Some component demos write what the component itself writes: ma-banner:<id> for a dismissed banner, ma-preloader:<id> for a preloader shown once, and ma:form for a demo form's result. The demo forms send nothing anywhere.

The components in your own site

The free and Pro components set no cookies and send no data to us. They write browser storage only for the features that need it: the theme choice (ma-theme, or the key you set), a remembered banner, a preloader shown once, and a form's result. A form built with the form library sends its data to the endpoint you configure; that data is yours to handle, and we never see it.

The MCP server

The free MCP server runs on your machine and reads a bundled catalogue. It makes no network requests unless you point it at a catalogue URL or set a license key. With a key, it sends the key to Polar once per run to check it, so Polar receives the key and your IP address. It sends us nothing.

The Pro registry

A request for a Pro item carries your license key. Our server sends the key to Polar to check it and keeps Polar's answer in memory for up to ten minutes, so parallel installs do not ask again. Our code writes no key and no item to any log; it logs only setup errors, which contain neither. Vercel's request log records each URL, so send the key in the Authorization header, as your account page shows; a key in the URL would land in that log. Polar records when a key is checked, and the refund policy reads that record.

Buying a plan

Polar Software, Inc. is the merchant of record and handles the checkout, payment and tax. For that it is the controller of your data, under its own privacy policy. We never see your card details. The customer records Polar keeps for us it holds as our processor, under its data processing addendum. From Polar we receive your name, email address and country, what you bought and when, the amount and tax, your subscription status, your license key and when it was last checked, and whether you downloaded the template zip.

If you connect GitHub for the template repository, Polar invites your GitHub account, and we see your GitHub username as a collaborator on that private repository until your access ends. GitHub records whether you accepted the invitation. GitHub's own privacy statement covers your GitHub account.

Email

Mail to hello@moonarc.dev is hosted by Apple's iCloud. When you write to us we have your address and what you wrote. Joining the Founding list is an email to us too, and we use that address only to tell you when Founding opens.

Why we use it

• To deliver a plan, issue and check keys, answer support and handle refunds: to perform our contract with you.
• To keep the order records tax law requires: a legal obligation.
• To keep the site and the registry running and stop abuse, using request logs and key checks: our legitimate interest.
• To email you about Founding when you asked us to: your consent, which you can withdraw at any time.

We do not sell personal data, use it for advertising or make automated decisions about you.

Who else handles it

• Polar (United States): checkout, payment, tax, license keys, template downloads and the GitHub invitation.
• Vercel (United States): hosting and request logs.
• GitHub (United States): the private template repository.
• Apple iCloud (United States): our email.

This means your data is handled outside Indonesia, and outside the EU and the UK. Each transfer rests on binding safeguards, as UU PDP Article 56(3) allows:

• Polar, Vercel and GitHub: data processing terms that include the EU standard contractual clauses.
• Apple: its privacy policy, which follows the Global Cross-Border Privacy Rules system, and standard contractual clauses for data from the EU, the UK and Switzerland.

How long we keep it

• Order and subscription records: for as long as you are a customer, then for 10 years, the period Indonesian tax law sets for business records.
• Support email: for 2 years after the last message, unless it is part of an order record.
• The Founding list: until 30 days after Founding opens, then deleted.
• Key check answers: up to ten minutes in server memory.
• Vercel's request log: up to a day.

Your rights

You can ask us to tell you what data we hold and why, give you a copy in a common format, correct it, delete it, or stop or limit using it. You can object to a use based on our legitimate interest and withdraw consent you gave. Email us from the address on your order, or tell us which address to look for, so we can check the request is yours.

Within 3 × 24 hours, as UU PDP requires, we act on a request to see your data, correct it, stop a use you consented to, or pause or limit a use. We answer any other request, such as deletion or a copy, within a month. If you are unhappy with our answer, you can complain to a data protection authority: in the EU, the one in your country; in the UK, the Information Commissioner's Office; in Indonesia, the authority set up under UU PDP.

If data leaks

If personal data we hold is exposed, we tell the people affected and the authority in writing within 3 × 24 hours of confirming it, as UU PDP requires, and say what happened and what we are doing about it.

Changes

We announce material changes in the changelog and update the date at the top.