Draft — last updated 24 October 2026

Privacy policy

This policy explains what personal data we collect when you use Molby, why, who we share it with, and the choices and rights you have.

1. Who we are

Molby is operated by Inchfield Technologies Limited (寸野科技有限公司), a private company limited by shares incorporated in Hong Kong under the Companies Ordinance (Cap. 622), company number 81236339, with its registered address at Unit 704, 7/F, Tower A, New Mandarin Plaza, 14 Science Museum Road, Tsim Sha Tsui, Kowloon, Hong Kong (“Inchfield”, “we”, “us”).

We are the data user under Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”) and the controller under the EU and UK General Data Protection Regulation (“GDPR”) for the personal data described here. This policy covers the molby.ai website and waitlist, the web workspace at molby.ai/app, the Molby mobile apps, and the prototype and tester pages at try.molby.app (together, the “Service”). Products that users launch with Molby on molby.app addresses are covered in section 10.

For any privacy question or request, email contact@molby.ai.

2. What we collect

When you join the waitlist

• Your email address.
• Your idea in one sentence, if you choose to share it.
• Whether you want a founding-member seat.
• How you found us: the website that linked to us, any campaign tags in the link, and the page of molby.ai you signed up on.
• Your approximate country, which our hosting provider derives from your IP address, and the time you signed up.

We don't store your IP address with your waitlist entry. To stop automated abuse we keep a one-way, salted hash of it for up to one hour, and then delete it.

When you visit molby.ai

We use Cloudflare Web Analytics to count visits and measure how fast pages load. It sets no cookies, stores nothing on your device, doesn't fingerprint your browser and doesn't follow you to other websites. For each page view it records:

• the page address and the website that linked to it;
• your browser, operating system and device type (for example, “Safari on an iPhone”);
• your approximate country, which Cloudflare derives from your IP address without storing the IP address for analytics;
• loading and responsiveness timings for the page, such as how long the largest image took to appear.

We only see these as totals, such as “120 visits to the examples page from Google this week”. We can't tell who you are from them. Like any website host, Cloudflare also processes your IP address briefly to deliver pages and block attacks.

When you use Molby

• Account data: your name, email address, the identifiers from Sign in with Apple or Google, and your settings.
• Project content: your ideas, your conversations with Mo (text and voice), answers to questions, and everything produced for your projects, such as research reports, designs, prototypes, code, files and decisions.
• Device and fraud-prevention data: device type, app version and device attestation results, used to keep free allowances to one per person and device.
• Connected accounts: if you connect an Apple, Google Play, Stripe or domain account, the access keys you give us, stored encrypted and used only for actions you authorise.
• Payment data: payments are processed by Stripe on the web and by Apple or Google for in-app purchases. We don't receive your full card number. We receive what we need for billing, tax and refunds: amounts, payment status, the last four digits of your card, and your billing country.
• Usage and technical data: server logs, error reports and basic usage events (for example, that a research report was opened), used to run and improve the Service.
• Messages: what you send us when you email or contact support.

When you test someone's prototype

• What you do in the prototype, notes you leave, and your answers to Mo's short interview. You don't need an account, and you can stay anonymous.
• Session recordings and tap or click heatmaps, only if you agree when the test starts. You can say no and still take part.
• Your email address, only if you choose to leave it to hear when the product launches or when your feedback has been acted on.

Your feedback is shared with the person who invited you to test (the creator), so they can improve their product.

Cookies

The molby.ai website sets no cookies at all: no advertising cookies, no analytics cookies, and no third-party trackers. Its visit counting (described above) works without cookies or local storage. The Molby apps and web workspace use essential cookies and local storage to keep you signed in and remember your settings. If we ever add analytics that need cookies or similar storage, we'll ask first where the law requires it.

3. How we use it

By joining the waitlist you ask us to email you about your invite, the beta and the founding-member offer. Every email includes a way to unsubscribe, and we will not use your data for direct marketing of anyone else's products. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

We never use your idea or project content to build products for other users, and we don't share it with other users unless you choose to (for example, by sending a test link).

4. AI providers

Molby uses AI models from third-party providers to do research, write, design, generate code and review work. To do this, we send the relevant parts of your project content to those providers. They process it on our behalf, as our processors or service providers, under contracts that limit their use of it to providing their service to us. We choose providers and settings under which your content is not used to train their general-purpose models.

The providers we use may change as better models become available. A current list is available on request at contact@molby.ai.

5. Who we share it with

We don't sell personal data, and we don't share it for cross-context behavioural advertising. We share it only with:

• Service providers who help us run Molby: cloud hosting and databases (Cloudflare), AI model providers, payment processors (Stripe, Apple, Google, RevenueCat), email delivery, and error monitoring. They may only use the data to provide their services to us.
• Platforms you ask us to act on, such as App Store Connect, Google Play or a domain registrar, when you authorise a submission or purchase.
• The creator of a prototype, if you take part in their test.
• Authorities or others when the law requires it, or when needed to protect the rights, safety or property of our users, the public or us.
• A buyer or successor, if Inchfield is involved in a merger, acquisition or sale of assets, subject to this policy.

6. International transfers

We are based in Hong Kong, and our service providers may store and process data in other places, including the United States and the European Union. Wherever data goes, we take reasonable steps to make sure it is protected to the standard in this policy. For data covered by the GDPR or UK GDPR, we rely on adequacy decisions or on the European Commission's Standard Contractual Clauses (with the UK addendum) or equivalent safeguards. You can ask us for a copy of the relevant safeguards.

7. How long we keep it

• Waitlist entries: until you ask to be removed or unsubscribe, or 24 months after the public launch if you haven't created an account.
• Abuse-prevention hashes of IP addresses: up to one hour.
• Website analytics: kept by Cloudflare as aggregated page-view and performance data, which doesn't identify you; we only view totals.
• Account and project data: while your account is open. Projects you pause stay saved. If you don't sign in for 12 months, we'll remind you before archiving. When you delete a project or your account, we delete its content within 30 days, apart from backups, which roll over within a further 30 days.
• Tester recordings: until the creator deletes the project, and in any case no longer than 12 months after the test.
• Payment and tax records: as long as tax and accounting law requires, generally seven years.

8. Security

We protect data with encryption in transit and at rest, access controls limited to staff who need it, and separation between projects. Keys you give us for connected accounts are stored encrypted. No system is perfectly secure; if a breach affects your personal data, we'll tell you and the relevant authorities as the law requires.

9. Your rights

Wherever you live, you can ask us to access, correct or delete your personal data, or stop sending you marketing emails. Email contact@molby.ai. We may need to confirm your identity first. We don't usually charge for requests, and we respond within the time the law requires, normally within 30 days.

Hong Kong

Under the PDPO you have the right to request access to and correction of your personal data, and to ask us to stop using it for direct marketing. Data access requests are answered within 40 days. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong.

European Union and United Kingdom

If the GDPR or UK GDPR applies to you, you also have the right to restrict or object to our processing, to receive your data in a portable format, and to withdraw consent at any time without affecting earlier processing. You can complain to your local data protection authority, or in the UK to the Information Commissioner's Office.

California

If you live in California, you have the right to know what personal information we collect, use and disclose, to delete it, to correct it, and to opt out of its sale or sharing. We don't sell or share personal information as those terms are defined in the California Consumer Privacy Act, and we don't use sensitive personal information for purposes that would give you a right to limit it. You can use an authorised agent to make a request, and we won't treat you differently for exercising your rights. The categories we collect are listed in section 2, the purposes in section 3, and the recipients in section 5.

10. Products you build with Molby

When we host a product you launched with Molby, at a yourname.molby.app address or your own domain, the personal data of that product's users belongs to you. For that data, you are the controller (or data user) and we process it only on your instructions, as your processor or service provider. You're responsible for your product's own privacy policy and for having a lawful basis for the data it collects. We draft a privacy policy and terms for your product as part of launch, but they are a starting point, not legal advice.

11. Children

Molby is for people aged 18 or over. We don't knowingly collect personal data from children under 16. If you think a child has given us their data, contact us and we'll delete it.

12. Changes and contact

We'll update this policy as Molby develops. If we make significant changes, we'll tell you by email or in the app before they take effect. The date at the top shows when it was last updated.

Email: contact@molby.ai (please put “Privacy request” in the subject line for requests about your data)
Post: Inchfield Technologies Limited, Unit 704, 7/F, Tower A, New Mandarin Plaza, 14 Science Museum Road, Tsim Sha Tsui, Kowloon, Hong Kong