Cookie policy.

1. What is a cookie?

A cookie is a small text file placed on your device (computer, smartphone, tablet) when you visit a website. It allows the site to remember information about your visit, such as your preferred language, your display settings and other preferences.

Cookies can be set by the site you are visiting (first-party cookies) or by third-party services embedded in the site (third-party cookies). They can be temporary (deleted when the browser is closed) or persistent (kept for a set period).

2. Legal basis and regulatory framework

The placing of cookies on your device is governed by:

• The General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), in particular articles 6 and 7 on consent.
• The ePrivacy directive (2002/58/EC), transposed into French law by article 82 of the French Data Protection Act (loi Informatique et Libertés)
• The guidelines of the CNIL (France’s data protection authority) of September 17, 2020 and its recommendation of October 1, 2020 on cookies and trackers

Under these texts, a cookie or tracker that is not essential to the service you request may only be placed with your prior consent. The realmoon.ai site loads its ad networks’ trackers, and passes on the click identifier of a Google ad, only with this consent, asked for in the “Ad measurement” banner (see article 3). What the site stores in your browser, and the visit measurement its server performs without cookies, are described in article 3.

3. Full inventory of cookies

Below is the exhaustive list of the cookies and trackers used on realmoon.ai, organized by category and purpose.

Strictly necessary cookiesALWAYS ACTIVE

These items serve only what you ask for: remembering your choice of theme and your answer about ad measurement, or, for the Moon AI team, logging in to the site’s administration. On the site’s pages, the two preferences are written only after you make your choice. The two cookies are set only on addresses reserved for the team, including the administration pages, which also store their theme in moon-theme. None of them contains an advertising identifier or is passed on to a third party: they therefore do not require your consent.

Audience measurement without cookiesLEGITIMATE INTEREST

When you visit, our server records the page viewed, the date and time, the approximate location that Cloudflare infers from your IP address when it provides one (country, region, city, continent, time zone and coordinates), the technical request identifier assigned by Cloudflare and the code of its data center, the origin of the referring site (for example https://www.youtube.com/, without the rest of the address), the campaign parameters of the link you followed (utm_*), the browser family (for example Chrome on Android), an indication that the visitor is a bot where applicable, and a hash of your IP address. This hash is computed with a random key specific to the current month, which is destroyed during the first night of the following month: after that, no one, including us, can recover an IP address from the hash or link your visits from two different months (database backups keep the key for 30 days at most). Visits recorded before October 2, 2026 have been converted to the same format. No cookie is set for this. This data is pseudonymized, never passed on to third parties, and deleted after 13 months. Legal basis: legitimate interest (GDPR Art. 6(1)(f)), to measure site traffic and the effectiveness of our campaigns. You can object by writing to contact@stellarrstudio.com.

When you follow a short link on the site (an address starting with realmoon.ai/r/), the server records the click before redirecting you: the link followed, the date and time, the country inferred by Cloudflare, the origin of the referring site, the browser family, an indication that the visitor is a bot where applicable, and a hash of your IP address and browser, computed with the same monthly key. No cookie is set; these clicks follow the same retention rules and the same legal basis as visits.

During your visit, links to the chat.realmoon.ai app receive the main domain of the site you came from (for example youtube.com): links between the site’s pages carry it from one page to the next, and it is removed from the address bar as soon as you arrive on the page. If the address through which you arrive contains campaign parameters (utm_*, partner code mref) or a promo code, they are copied into the site’s links and into those of the app, so that the creation of an account records its origin (see “Origin of your sign-up” in the privacy policy). Nothing is stored in your browser for this: this information travels only in the address of the links. If you had refused audience measurement on the previous version of the site and that choice is still stored there (key moon-cookie-consent), the site you came from is not passed on. The click identifiers of a Google ad are added to them only with your consent, at the moment you follow the link (see “Ad measurement” below).

Marketing and advertising cookiesCONSENT REQUIRED

Ad measurementCONSENT

With your consent, given in the “Ad measurement” banner, every page of the site loads the Google tag (Google Ads). This tag measures how well our ads work (which ad led to a visit, then to a sign-up) and lets Google show you our ads on its services. When you follow a sign-up link to the chat.realmoon.ai app, it reports the sign-up to the network. It may read or set the cookies below. Without an answer, or after you decline, it is not loaded and the site sets none of these cookies.

Cookies on the realmoon.ai domain are set by the tag on this site: after you decline, the site deletes them as far as it can. The others belong to the ad network’s domains: the site can neither read nor delete them; you manage them in your browser (section 6) or with the network. To adjust the ads it shows you: Google My Ad Center.

What the network does with the data it receives is governed by its own policy: Google Privacy Policy. Purposes and durations are taken from the network’s documentation, as of November 14, 2026: Google.

Click identifier of a Google ad. When you arrive through a Google ad, Google adds a click identifier to the page address (gclid, gbraid or wbraid); the site’s own code reads only these. “Accept” also covers it: it is added to the site’s links and to those of the chat.realmoon.ai app only at the moment you follow them; a copied link address does not carry it. The app keeps it so that Google can read, on our servers, your sign-up and your first payment (details in the privacy policy). “Decline”, or no answer: it is added nowhere, and declining also removes it from the address bar.

Your answer is stored on this device under the key moon-ad-consent (the answer, its date and the version of the text, with no identifier), so that you are not asked again; it is valid for 13 months. To change your mind: “Appearance and privacy”, at the bottom of every page, then “Ad measurement” (accept or decline). After you decline, no tag is loaded on the following pages and the site deletes, as far as it can, the cookies they had set on realmoon.ai. In the app, the login page reminds you of this choice with a “Do not share” button, and Settings › Data and privacy › “Ad measurement” deletes the identifier already kept.

4. Third-party cookies and subprocessors

Without your consent, the pages of the realmoon.ai site load no external resources: fonts, scripts, styles, images and videos are served by the site itself.

Only with your consent, pages also load the Google tag (Google Ads), from its ad network’s servers (see “Ad measurement” in section 3):

• Google: www.googletagmanager.com, www.googleadservices.com, googleads.g.doubleclick.net

One third-party service is involved in the path of all your requests:

The fonts (Plus Jakarta Sans, JetBrains Mono) are hosted locally on our servers and generate no requests to third-party CDNs (no Google Fonts). Stripe is loaded only in the paid part of the app (chat.realmoon.ai), not on this site.

The administration login page and the site’s administration pages, reserved for the Moon AI team and still served by the previous version of the site, load external tools: Tailwind CSS (cdn.tailwindcss.com), TinyMCE (cdn.tiny.cloud) and libraries from jsDelivr (cdn.jsdelivr.net).

5. Information and preferences

The site asks for your consent before loading any ad tracker, and lets you choose how the site is displayed:

1. 1

   Question

   Until you answer, a banner at the bottom of the screen asks for your consent to ad measurement. “Accept” and “Decline” have the same size and style; “Preferences” opens your preferences and “Learn more” leads to this policy. Nothing is loaded or set before you answer, and scrolling the page does not count as consent.

2. 2

   Storage

   Your answer is kept on this device for 13 months (moon-ad-consent); after that, or if the banner text changes, you are asked again.

3. 3

   Changing your mind

   “Appearance and privacy”, at the bottom of every page, then “Ad measurement” shows your answer and lets you accept or decline at any time. After you decline, no tag is loaded on the following pages and the site deletes, as far as it can, the cookies they had set on realmoon.ai; those on the ad networks’ own domains are managed with them or in your browser (article 6).

4. 4

   Display

   The appearance selector in the navigation, the “Appearance and privacy” link at the bottom of every page and the button at the top of this policy let you choose the theme: light, system or dark (moon-theme).

6. Managing cookies in your browser

You can set your browser to refuse or delete cookies. Here are the instructions for the main browsers:

• Google Chrome

  Settings > Privacy and security > Cookies and other site data

• Mozilla Firefox

  Settings > Privacy & Security > Cookies and Site Data

• Apple Safari

  Preferences > Privacy > Manage Website Data

• Microsoft Edge

  Settings > Cookies and site permissions > Manage and delete cookies and site data

Please note: clearing this site’s data deletes the chosen theme and your answer on ad measurement, which you will then be asked for again; for the team, it also closes the administration session.

Cookies that ad networks set on their own domains (see article 3) are cleared the same way, or from your settings with them.

7. The chat.realmoon.ai application, Moon CLI, Moon Desktop, the extension and the mobile apps

The chat.realmoon.ai application only sets cookies needed for it to work, which do not require your consent: your sign-in token (token, not readable by the page’s scripts), the server session (owui-session), cookies linked to a sign-in with Google, Apple, Microsoft, GitHub or an organization’s SSO (oauth_session_id, oauth_id_token) and, while you connect a connector, a cookie specific to this browser (__Host-moonai_cflow_…). It also keeps your sign-in token and your display preferences in your browser’s local storage. It sets no advertising or audience measurement cookie. Payment opens on Stripe’s page, which follows its own rules.

Moon CLI (a coding agent in the terminal) uses no cookies and includes no tracker, audience measurement or crash reporting. It keeps on your computer its sign-in tokens (which can be revoked at any time with moon sessions or from your account), the history of its sessions and its settings; the details are in article 4 septies of the privacy policy. Moon Desktop keeps the chat.realmoon.ai session, its cookies and its storage, in its own profile on your computer, and adds no tracker. Moon AI for Chrome sets no cookie: what it keeps is described in article 4 quinquies of the privacy policy.

The iOS and Android apps (App Store, Google Play) as well as the version installed from the browser display the chat.realmoon.ai platform: the cookies involved are those of the application described above. The apps add no advertising or audience measurement tracker; they keep a few settings on the phone and check for their updates with Expo (see article 4 nonies of the privacy policy).

8. Retention period and expiry

The moon-theme and moon-ad-consent preferences remain in your browser until you make a new choice or clear the site’s data; after 13 months, the moon-ad-consent answer is no longer valid and you are asked again. Ad tracker cookies, set only with your consent, have the durations given in article 3. The moon_admin_sess and PHPSESSID cookies expire when the browser is closed. Pseudonymized visit and click data is deleted after 13 months; the monthly key used to compute their hashes is destroyed on the first night of the following month.

9. Your rights

Under the GDPR, you have the following rights regarding your data:

• Right of access (Art. 15)

  Obtain confirmation that your data is being processed, and a copy of it

• Right to rectification (Art. 16)

  Have inaccurate or incomplete data corrected

• Right to erasure (Art. 17)

  Request the deletion of your personal data

• Right to object (Art. 21)

  Object to the processing of your data at any time

• Right to restriction (Art. 18)

  Suspend the processing of your data in certain cases

• Right to data portability (Art. 20)

  Receive your data in a structured, readable format

• Right to withdraw consent (Art. 7)

  Withdraw your consent at any time

10. Contact and complaints

For any question about our use of cookies, or to exercise your rights:

If you believe that the processing of your data does not comply with the rules, you can file a complaint with the CNIL (Commission Nationale de l’Informatique et des Libertés, France’s data protection authority): www.cnil.fr/fr/plaintes