← BACK

Privacy Policy

Last updated: April 7, 2026

This Privacy Policy describes how One Moments LLC (“Moments,” “we,” “us,” or “our”) collects, uses, discloses, and protects your personal information when you use the Moments website, applications, and related services (the “Service”).

By using the Service, you consent to the data practices described in this policy. If you do not agree with our practices, please do not use the Service.

1. Information We Collect

Information You Provide

  • Phone number. Required for account creation and login via SMS one-time password (OTP) verification.
  • Profile information. Name, handle (username), profile photo, bio, and birthday. This is collected during onboarding.
  • Taste selections. Your favorite songs, albums, movies, TV shows, and books, including cover art, titles, and metadata retrieved from third-party APIs.
  • Impulse responses. Your graduation year, major, personality vibes, interests, intents, pronouns, relationship status, and any free-text responses provided through the Impulse Engine onboarding flow.
  • Event interactions. RSVPs, going/maybe status, solo/group indicator, and song requests.
  • Communication. Any information you submit when contacting us via email, forms, or direct messages.

Information Collected Automatically

  • Authentication session tokens. Stored in your browser's local storage to keep you signed in.
  • Log data. IP address, browser type, operating system, referring pages, pages visited, timestamps, and similar diagnostic data.
  • Device information. Screen size, device type, and user agent.

Information We Derive

  • Vector embeddings. We use OpenAI's text-embedding-3-small model to generate a numerical vector representation of your profile for similarity search. This embedding is derived from your self-provided taste and Impulse data. It is stored on our servers and used only to power matching features.
  • Impulse insights. An AI-generated personality synopsis, MBTI estimate, team color, and radar chart statistics derived from your Impulse responses.

2. How We Use Your Information

We use your information to:

  • Provide, operate, maintain, and improve the Service.
  • Authenticate users and secure accounts.
  • Display your public profile to other users.
  • Power the Impulse Engine's matching and recommendation features.
  • Send transactional SMS for login and account security (via Twilio).
  • Manage event RSVPs and attendee lists.
  • Detect, prevent, and investigate fraudulent, abusive, or illegal activity.
  • Enforce our Terms of Service.
  • Comply with legal obligations.

3. Legal Bases (GDPR)

For users in the European Economic Area, we process personal data under the following legal bases:

  • Contract. Processing necessary to provide the Service you've requested (account creation, RSVP handling, profile hosting).
  • Legitimate interests. Improving the Service, preventing fraud, and ensuring security.
  • Consent. Optional features such as Impulse setup, marketing communications, or location-based features.
  • Legal obligation. When required to comply with applicable law.

4. How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

Publicly Visible by Design

  • Your profile (name, handle, photo, bio, school, taste items, and Impulse insights if generated) is publicly visible at havemoments.com/@your-handle.
  • RSVP status (going/maybe), your name, handle, and photo are visible to anyone viewing an event you've RSVP'd to.

Service Providers

We share data with third-party service providers that help us operate the Service. Each is bound by their own privacy policies and data processing agreements.

  • Supabase — database, authentication, file storage.
  • Twilio — SMS delivery for OTP verification.
  • OpenAI — vector embeddings and Impulse insight generation. Data sent to OpenAI is subject to their API data handling policies. OpenAI has committed to not training on API data by default.
  • Anthropic — AI-powered features within the Impulse Engine.
  • Vercel — hosting, deployment, and serverless functions.
  • Deezer, OMDb, Open Library — third-party APIs for music, film/TV, and book search. We pass your search queries to these APIs to return results.

Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency), or to protect our rights, property, or safety or that of others.

Business Transfers

If we are involved in a merger, acquisition, or asset sale, your information may be transferred as part of that transaction. We will notify you via prominent notice on the Service before your information becomes subject to a different privacy policy.

5. Data Retention

We retain your personal information for as long as your account is active and as long as needed to provide the Service. After account deletion:

  • Profile data, taste selections, Impulse data, embeddings, and RSVPs are deleted from our production database.
  • Backup copies may persist for up to 30 days as part of standard disaster recovery practices.
  • Anonymized aggregate data may be retained indefinitely for analytics and service improvement.
  • Certain records may be retained longer if required by law (e.g., financial records, fraud prevention logs).

6. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights:

  • Access. Request a copy of the personal information we hold about you.
  • Correction. Update or correct inaccurate data via the profile edit screen or by contacting us.
  • Deletion. Delete your account and associated personal data via the profile settings, or by contacting us.
  • Portability. Request your data in a structured, machine-readable format.
  • Objection. Object to certain types of processing, such as for direct marketing.
  • Withdrawal of consent. Withdraw consent at any time for processing that relies on consent.

To exercise any of these rights, contact us at team@havemoments.com. We will respond within 30 days.

California residents: You have the right to request information about the categories of personal information we collect, the purposes for which we use it, and the categories of third parties with whom we share it. You also have the right to opt out of the sale of personal information, though we do not sell personal information.

7. Security

We implement industry-standard technical and organizational measures to protect your information, including:

  • HTTPS encryption for data in transit.
  • Row-level security policies on our database to restrict access to your data.
  • Authentication sessions stored using secure browser storage mechanisms.
  • Third-party providers (Supabase, Vercel) with SOC 2 compliance.
  • Regular security reviews and updates.

However, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

8. Children's Privacy

The Service is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13 without verified parental consent, we will take steps to delete that information.

9. International Data Transfers

Moments is based in the United States. If you are accessing the Service from outside the US, your information will be transferred to and processed in the US and other countries where our service providers operate. By using the Service, you consent to the transfer of your information to these countries, which may have data protection laws different from those in your country.

10. Cookies and Tracking

The Service uses local storage and session storage (similar to cookies) to:

  • Keep you signed in between visits.
  • Remember your preferences during multi-step flows (such as the RSVP flow).
  • Cache data for performance.

We do not currently use third-party advertising or analytics cookies. If this changes, we will update this policy and notify users accordingly.

11. AI and Automated Processing

The Service uses AI in the following ways:

  • Face detection. When you upload a profile photo, we run client-side face detection (using an on-device machine learning model via face-api.js) to verify that the image contains a face. No image data leaves your device during this process.
  • Impulse insights. Your Impulse onboarding responses are sent to OpenAI's GPT-4o-mini model to generate a personality synopsis, MBTI estimate, team color, and radar stats.
  • Vector embeddings. Your profile data is converted into a numerical vector by OpenAI's text-embedding-3-small model for similarity matching.

Impulse insights are approximations and should not be treated as professional psychological assessments. You may opt out of Impulse by skipping the setup flow or by deleting the data from your account.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by a revised “Last updated” date at the top. For material changes, we will make reasonable efforts to notify you via the Service or the contact information on file.

We encourage you to review this Privacy Policy periodically. Continued use of the Service after changes constitutes your acceptance of the updated policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us at:

One Moments LLC
New Brunswick, NJ
team@havemoments.com