Privacy

What Moodkin knows about you. Nothing that ties back to a name.

The pulse was designed for honesty, and honesty dies the moment a response can be traced back to a person. This page walks through exactly what lands in our database, what gets sent to the model, and what we delete on a timer — written so a founder can read it once and trust the product.

What we collect

Four things land in our database.

Identity is stripped at ingest. The rest is just enough to deliver the next pulse and keep the lights on.

Anonymous pulse responses
A short text answer, a score, or a multi-choice pick on each pulse question. Identity is stripped at ingest — the row that hits our database has no name, no email, and no channel-side handle attached.
Channel-side context (Slack / Teams)
The channel ID, the bot user ID, and the workspace ID — enough to deliver the next pulse back into the right room. Never the individual message author ID, never the per-user read receipt.
Team roster metadata
A list of who is on which team, so the pulse lands in the right slice of the company. Used for routing only — not for identification, not for cross-tying to a response.
Payment metadata (Stripe)
A subscription status, a seat count, and a billing email — handled by Stripe, never touching the response pipeline. We do not store card numbers or bank credentials; Stripe does.

How the anonymity actually works

A handle that rotates per pulse.

Rotating-handle mechanism
The shortest honest description of how Moodkin stays anonymous.

When a pulse opens, the system assigns each active teammate a fresh random handle for the duration of that window — something like otter-7.

There is no map from that handle back to a person. The mapping would have to exist somewhere — and it doesn't, on purpose. Even the people buildingMoodkin cannot reconstruct who said what.

The handle changes every pulse window. The person behind yesterday's otter-7 may be a different person next week. What reaches the model is per-team aggregate buckets — not the handle, not the response, not any identifier a third party could pivot on.

What the model sees

Aggregates go in. Raw responses stay out.

Prompts are scoped to team-level signals. We instruct the model that raw responses are never available, and we never ship a feature that requires them.

Sent to the model
Aggregates only, never the source.
  • Team-level aggregate sentiment score (one number per team per day)
  • Attrition-risk features computed from the aggregate score and pulse cadence
  • The pulse question text itself and the distribution of aggregate response buckets
  • The single daily "ask" output that gets drafted for the manager
Never sent
Held to the principle at the top of this page.
  • Raw response text — the exact string a teammate typed
  • Named individuals — no name, no email, no Slack/Teams user ID ever reaches the model
  • Freeform DMs that were not part of a scheduled pulse
  • Anything email-side — we do not ingest mailboxes, calendar, or contacts

Prompts are scoped to aggregates only — we instruct the model that raw responses are never available, and we never ship a feature that requires them.

Retention

What we keep. And what we delete.

Retention windows are enforced by the platform — there is no manual off-switch and no stored copy outside the timer.

Class of data

Raw response text
14 days

Used to draft the manager ask, then deleted once the daily digest has been published.

Class of data

Pulse metadata
90 days

Question text, timestamp, rotating handle. Kept so trends can be reconciled across windows.

Class of data

Team aggregate sentiment
Indefinite

Retained for as long as the team is a customer, in aggregate form only. This is the signal — not the source.

Class of data

Audit log
90 days

Admin actions, role changes, configuration edits — the trail Growth requires.

Class of data

Billing records
7 years

Required by accounting and tax law — handled by Stripe, not by us.

Talk to a person about your data
We read every privacy request ourselves — there is no outsourced triage team between you and the people building Moodkin.
Email the privacy team

Want the install playbook

See the pulse run on your own team.

Drop your work email below and we'll send the install playbook and book the 30-minute kickoff. Founder rate is locked for the first year for every early-access team.

Join the Moodkin waitlist