Privacy Policy

Last updated August 26, 2026 · Moonlighting is operated by Tsukino Software Solutions LLC (Ohio, USA).

The short version: your job search is yours. We collect what the product needs to work, we do not sell it, we do not run ads, and your data is not our product. The rest of this page spells that out.

What we collect

Account basics. Your email address and password (stored hashed), or your Google / Microsoft identity if you sign in with those. An optional profile picture if you upload one.
What you put into the app. Resumes, cover letters, job applications, interview records, contacts, notes, compensation figures, time tracking. Contacts are entered by you; we never buy, scrape, or enrich people data from anywhere.
AI provider keys. If you bring your own API key, it is encrypted at rest and shown back to you only by its last four characters. We use it solely to make the AI requests you ask for.
Usage metering. A per-generation record (provider, model, token counts, estimated cost) so you can see what your AI use costs. We keep the numbers, not the generated text beyond what you save.
Payments. Handled entirely by Stripe. Your card number never reaches our servers. We store your subscription status and a Stripe customer reference.

How AI generation works with your data

When you run an AI feature, the content involved (for example your resume and a job description) is sent to the AI provider you chose, on your key, under that provider's terms.
On the Managed plan, requests go to Anthropic on our key. We do not use your content to train models, and we have no model of our own to train.
Some features can optionally search the web (via the AI provider) to research a company. Those searches contain the company's name, not your personal details.
One honest caution, repeated from the app itself: some free models on OpenRouter may use submitted text for training. Think before sending a resume to a free model.

What is shared between users

Job postings from public boards and feeds are pooled for everyone; postings you import yourself stay private to you. Company research briefings share objective, public facts about companies. Company ratings are aggregated across users and only shown once enough people have contributed (at least five distinct contributors) that no individual's job search can be inferred from them. Nothing that identifies you, your applications, or your documents is ever visible to another user.

Cookies

We use cookies to keep you signed in, prevent request forgery, and remember preferences. There are no third-party advertising or analytics trackers.

Retention, export, and deletion

Your data stays as long as your account does. Letting a trial or subscription lapse never deletes anything.
You can export everything as JSON at any time from Account & Data.
You can have your account and all its data permanently deleted by contacting support@tsukinosoftware.com. Deletion is a real purge, including stored documents and encrypted keys, not a soft-hide.

Who else touches data

The short list of processors: our hosting provider (DigitalOcean, USA), Stripe for payments, Resend for transactional email, and the AI provider you select for generations. Company directory data includes the People Data Labs Free Company Dataset, used under CC BY 4.0 — that is data about companies, not about you.

The rest

Moonlighting is not directed at children under 16.
We will email account holders about material changes to this policy before they take effect.
Questions or requests: support@tsukinosoftware.com.