Effective date: 2026-08-21
Contact: eric@moqiai.app
Last updated: 2026-09-19
MOQI transcribes and translates speech in real time. In online meeting mode it also generates a prompt card after the other party finishes speaking.
Audio captured by the device microphone is sent directly to Soniox (the transcription and translation provider) over an encrypted connection. MOQI's server only issues the device a single-use credential valid for 60 seconds and takes no further part in that connection.
The microphone picks up everyone around you, including the other party on speakerphone or the person you are talking to face to face.
On a Mac or Windows PC in online-meeting mode with "Meeting app" as the sound source, the other side's audio is read on your own computer from the sound output of the meeting app you pick (on Windows, if you pick no app, from everything the computer is playing). With "Speakerphone", and on iPhone and Android, the microphone is used. MOQI never joins the call as a participant, and no bot appears in the attendee list. Either way the audio goes straight to Soniox, as above.
When a prompt card is generated, the most recent finalized transcript segments (including what the other party said) and any materials you provided beforehand are sent to MOQI's server, which forwards them to a model vendor (currently one of OpenAI, DeepSeek or Anthropic; our server decides which, and that can change).
"Summarize this meeting" and "Translate" are two further sends. When you tap "Summarize this meeting" (or, in the archive, choose a "Summarize as" format and a language and tap "Generate summary" / "Regenerate"), MOQI sends the whole transcript of that meeting (including what the other party said) to MOQI's server and on to the model vendor to produce a summary in the format and language you chose; when you tap "Translate to (language)", it sends the text of that summary. Both happen only when you tap them; where the data goes, what we can see and what we do not store are exactly as in the prompt-card paragraph above. The translation is shown on this device only and is not written into the record.
Naming a meeting is an automatic send. After a meeting ends and its record is saved on this device (and when you open a meeting that has no title yet), MOQI sends the beginning and end of that meeting's transcript to MOQI's server and on to the model vendor to produce a short title, which is written into the record on this device. Where the data goes, what we can see and what we do not store are as above; it happens once per meeting, and a meeting without a title is listed as "Untitled meeting".
Analyzing pre-meeting material is a separate send, with its own consent. On a Mac or Windows PC, when you load a CV, a job description or similar material before a meeting and choose "Analyze and save", its full text is sent to MOQI's server and on to the model vendor. The meeting consent does not cover this upload, so the app asks you separately — it is a different decision from capturing audio: a CV carries an address, a phone number, an employer. The result is written to your device. Where the data goes, what we can see and what we do not store are as above.
The data passes through our server in transit — we can technically see it. We will not claim "we cannot see your session."
We do not store it. The server's database has no column capable of holding message content — not "we promise not to look", but "the place to put it does not exist". That is enforced by an automated per-table, per-column test (m4/relay/test/unit/schemaAudit.test.ts), and that test runs against the database backend we use in production, not only the one used in development.
What the database does hold falls into four kinds: subscription and quota (how much you may use), usage counts (how much you used), hashes of login and invite credentials (never the credentials themselves), and a temporary list (see below). Meeting audio and text are in none of them.
One exception, which we state up front: the temporary table used for beta applications holds your email address in plain text, and on the same row the name, app language and (if you gave them) phone and country / region you entered on the request form — a person reviews each request, and Apple requires a real address to send a TestFlight invitation, which a hash cannot do. That row is short-lived: it is deleted at once when a request is rejected; when a request is approved, Windows / Android rows are deleted as soon as the invite-code email goes out, and macOS / iPhone rows once you have been added to the TestFlight group (our development machine does that on its next sync). The table exists only for the beta; we will delete it once the beta programme ends, and we will update this page when we do. Once a request is approved, the name and email address you entered on the form are kept, in plain text, with the subscription that holds your invite code — solely so an administrator can tell whom a code was issued to; only administrators with that permission can see them, every view is recorded in the audit log, and they are deleted together with the subscription. Everywhere else in the database, email addresses are SHA-256.
A meeting archive is written after every meeting. Each meeting's record (including what the other party said), summary and title are kept in a folder on your device, whether or not the session log below is turned on. On a Mac or Windows PC the transcript is also saved as a plain-text file (in the app's own Documents folder on a Mac, in a Moqi folder in Documents on Windows). MOQI never uploads any of these. Their text leaves the device only in the sends described in 2.2, when you copy or share it yourself, or through a backup or sync service you use (for example iCloud Backup or iCloud Drive on Apple devices, or a Documents folder backed up by OneDrive), which keeps a copy under its own terms.
If you enable "Save this session on this device", the transcript, its translation, prompt-card content and any failures are also written to a separate log file on your device. MOQI never uploads it. Like the archive above, it leaves the device only if you copy or share it yourself, or if a backup service backs it up (for example iCloud Backup on an iPhone). Location on iOS: the Files app → On My iPhone → MOQI → logs. You can open, export or delete it at any time.
That file contains what the other party said.
We do not collect device identifiers, location, contacts or advertising identifiers, and we do not build profiles or serve targeted advertising. We do not sell data.
| Data | Where it lives | How long |
|---|---|---|
| Audio | In transit only (device → Soniox) | Per Soniox's documentation, real-time streams are not retained by default and are not used for training |
| Transcript text | Passes through our server in transit | We do not store it (see the schema check in 2.2); the model vendor retains it under its own policy |
| Pre-meeting material (CVs, job descriptions and the like; sent from a Mac or Windows PC when you choose "Analyze and save") | Passes through our server in transit | We do not store it (it takes the same forwarding path as the transcript; see the schema check in 2.2); the model vendor retains it under its own policy; the analysis result stays on your device |
| Usage counts (token counts, duration, timestamps, model name) | Our server | Used for quotas and billing |
| On-device session log | On your device (see 2.3) | Under your control; delete it at any time. A copy held by a backup or sync service is kept under that service's rules |
| Meeting archive (records, summaries, titles; plain-text transcripts on Mac and Windows) | On your device (see 2.3) | Until you delete it: with Finder, File Explorer or the Files app; on Android, by clearing the app's storage in system Settings. A copy held by a backup or sync service (see 2.3) is kept under that service's rules and has to be deleted there |
Vendor retention is not ours to decide. Absent a zero-retention agreement, major vendors typically keep inputs and outputs for up to ~30 days for abuse monitoring and do not train on them by default. That is the vendor's policy and may change — their documentation governs.
This is the single most important thing to be aware of in this product.
MOQI captures and transcribes in real time everyone within microphone range, most of whom are not MOQI users and have no opportunity to give us their consent.
To be precise, MOQI produces live captions rather than a recording (consistent with section 3):
That does not change the responsibility stated below, but it is the premise for understanding it.
In Australia this is governed by each state and territory separately — there is no single national rule. This is the point most easily misunderstood — do not assume that because something is allowed in one state it is allowed in the next.
This is general information, not legal advice. Your situation — which state you are in, who the other people are, what you use it for — changes the answer. Get your own advice if you need certainty.
The United States has the same shape as Australia: a federal floor, with states free to be stricter — and a number of them are.
This page deliberately does not list specific states. The lists change, and public sources disagree with each other on which states require all-party consent. A hard-coded list would eventually become a confidently wrong statement.
This is general information, not legal advice. Get your own advice if you need certainty.
MOQI is not directed to children under 13 and does not knowingly collect their information.
When the data flow materially changes, the in-app consent screen requires you to consent again. That is a mechanism, not a notice: a consent record is bound to the hash of the disclosure text, so changing the text invalidates the previous consent.
Privacy questions — and the deletion requests described in section 5 — go to eric@moqiai.app.