MOAI — PRIVACY POLICY Effective date: October 22, 2026 (replaces the version dated September 12, 2026) This Privacy Policy explains how Moai Social Inc, a Delaware corporation ("Moai," "we," "us"), collects, uses, shares, and protects information when you use the Moai mobile application, the website at moaisocial.com, and related services (together, the "Services"). This Policy is incorporated into our Terms of Service. By using the Services, you acknowledge this Policy. Contact: areihill@moaisocial.com · Moai Social Inc, c/o Corporation Service Company, 251 Little Falls Drive, Wilmington, New Castle County, Delaware 19808 The short version. Moai has three kinds of accounts — Students, Groups (clubs and student organizations), and Businesses — and this one Policy covers all three: Section 1 describes what applies to everyone, and Section 2 describes what is specific to each account type. We use your device's approximate location to show you nearby events and places, and your precise location only at the moment you check in to an event; our maps are provided by Apple Maps. We don't sell personal information, we don't share it for targeted advertising, and we don't use third-party advertising, analytics, or tracking SDKs. Businesses that honor Moai Pass offers never see a student's name — only an anonymous redemption code. The details, including some limitations you should know about, are below.

1. Information We Collect — All Accounts These practices apply to every account type. Information you provide Account credentials: email address, the verification code we send to it, and a password (passwords are stored in hashed form by our authentication provider — we never see them in plain text). Students must use a school email address; Groups and Businesses may use any email address. Account type: whether you register as a Student, Group, or Business. Content you create: posts, comments, photos, voice messages, chat and direct messages, event listings (including titles, descriptions, times, addresses, and cover photos), RSVPs, community memberships, and reports you submit about content or users. Communications with us: anything you send to our support, privacy, or other contact addresses. Information collected automatically Location and map data — described in full in Section 3. Usage information. We record events about how the app is used (for example: screens viewed, features used, actions taken, and timestamps), tied to your account, using our own in-house analytics. We do not use any third-party analytics service. Device and technical information: device type, operating system version, app version, language, time zone, and push notification tokens. Server and connection logs. Our app does not itself record your IP address. However, our infrastructure providers (Section 5) log IP addresses and standard connection data as part of operating their platforms — as essentially all internet infrastructure does — under their own retention practices. What we do NOT collect — any account type No advertising or tracking SDKs. The app contains no third-party advertising, attribution, marketing, or session-replay SDKs (no Meta SDK, no TikTok SDK, no AppsFlyer, no session recording tools, and similar). No cross-app tracking. We do not access your device's advertising identifier (IDFA) and do not track you across other companies' apps or websites. The app never requests App Tracking Transparency permission because it has nothing to ask for. No contact list access. The app does not request or receive access to your contacts. No biometrics. We do not collect or process facial recognition data, fingerprints, or any other biometric identifiers. Where we review a student ID for verification (Section 2), the review is performed by a person — we do not use facial recognition, face-matching, or automated ID-scanning technology.
2. Information Specific to Each Account Type The baseline practices in Section 1 apply to everyone. This Section describes what is different for each of the three account types. 2.1 Students Profile information: name, username, campus, and class year (or graduate-student status) are required; a profile photo and pronouns are optional. A second step offers further optional fields: major and gender. Date of birth is collected at signup and is required. We use it to enforce our minimum age of 17 (Section 8). Your date of birth is not displayed to other users. Interests: you select at least three interests from a fixed list (such as coffee, sports, music, study). We use them to rank the events and places shown on your campus map and feeds. Campus verification: by default we verify your school email address — we send a code to it, and entering the code confirms the address is yours. If you don't have a school email address, you can ask to verify another way, which involves submitting an image of your student ID for manual review by our team. ID images are used only to decide the verification request, are accessible only to the team members who perform the review, and are deleted within 30 days of the verification decision. We do not use ID images for any other purpose, and the review is human-only (no facial recognition or automated ID scanning). Visibility: your profile, posts, events, and community activity are visible to other users as described in Section 4. 2.2 Groups (clubs and student organizations) Group profile: group name, university, category, and a handle are required; a cover photo, logo, short description, meeting days/times and location, and links (group email, Instagram, website, Discord, Slack, GroupMe) are optional. Group profiles are public — they are displayed to students on the campus they belong to. The person who claims the group provides their name, verified through their own school email. We use it to administer the group and to review the claim; it is associated with the group account on our systems. Verification is retrospective: a group goes live when created, and claims are reviewed by our team afterward (typically within hours). Students can report a group they believe is misrepresented or inappropriate, and we may remove or reassign groups that fail review. 2.3 Businesses Business profile: business name, category, street address, campus, a map pin location, and a handle are required; a logo, description, phone number, website, Instagram, hours, and photos are optional. Business profiles are public — the business appears on the campus map and in discovery, and its listed contact details are visible to users. The address and map pin you provide locate your business on the map; they are business information you choose to publish, not tracking of any person. Verification is retrospective, as for Groups: listings go live when created and are reviewed by our team afterward, and users can report a business they believe is not legitimate. Offers and redemptions: Businesses publish offers that students redeem in person. The business-facing interface shows whether a presented code is valid, already used, or invalid, together with a pseudonymous redemption code — never the student's name, username, photo, or profile — and business analytics show activity about the business's own listing and offers (such as redemption activity) identified only by those pseudonymous codes. Businesses are contractually prohibited from attempting to identify any user from this data. Billing: during early access, business accounts are free and we process no payments. When paid subscriptions begin, billing will be handled outside the app and this Policy will be updated to name the payment processor before any payment information is collected. Business features do not include joining student activities, and business accounts have no access to student profiles or content beyond what any user of the Services can see.
3. Location and Map Services This Section describes all of our location and map practices, for all account types. What we collect, and at what precision: Approximate (coarse) location — the default. With your permission (iOS "While Using the App"), we use your device's reduced-accuracy location — a general area of roughly 1–3 km, not your exact position. The app requests reduced accuracy by design. Precise location — one situation only. When you check in to an event, the app requests your precise location once, to confirm you are actually at the event (fraud prevention for check-ins and related features). We do not collect precise location at any other time, and we never track your location in the background. What we use location for: Local discovery: showing and ranking nearby events, groups, and businesses on your campus map and feeds (approximate location). Check-in verification: confirming event attendance (precise location, at check-in only). We do not use location data for advertising, and we do not sell it or share it with data brokers. Geotagged content is different from your device location. When a host creates an event or a business sets its address and map pin, the location they enter is content they choose to publish, and it is displayed to users as part of the listing. That is information about the event or business — not collection of any person's device location. Our map provider is Apple. Maps in the app are provided by Apple Maps (MapKit). When a map loads, your device communicates directly with Apple to fetch map content, and Apple may process device and location-related data in connection with providing the map, under Apple's privacy policy. We do not send the location data we hold to any other third-party map provider, and we use no map service other than Apple's. Your controls: location access is optional and controlled in iOS Settings at any time. The app works without it, but nearby-discovery features will be limited.
4. How We Use and Disclose Information We use the information described above to: provide, operate, and maintain the Services — including the campus map, events, communities, chat, profiles, and push notifications you've enabled; verify campus affiliation and account claims, and enforce our minimum age requirement (Section 8); operate Moai Pass, including validating offer redemptions; moderate content, investigate reports, enforce our Terms of Service and Community Guidelines, and keep the Services safe; understand how the Services are used, fix problems, and improve and develop features, using our in-house analytics; communicate with you about the Services; and comply with legal obligations and protect the rights, safety, and property of Moai, our users, and others. We do not use your information for third-party advertising, and we do not make decisions producing legal or similarly significant effects about you by automated means. With other users, at your direction. Your profile, posts, events, RSVPs, and community activity are visible to other users according to the feature you're using and your account type (Section 2). Direct messages are visible to their recipients. Content you post publicly may be seen by any user on your campus network (or more broadly, depending on the feature). Anonymous posting. Some features let students post without their name or username shown to other users. Anonymous posts hide your identity from other users only. They remain linked to your account on our systems, and we may use that link for moderation, safety, enforcement of our Terms, and legal compliance. For legal reasons. We may disclose information if we reasonably believe it is required by law, subpoena, or other legal process, or is necessary to: enforce our Terms; detect, prevent, or address fraud, abuse, or security issues; or protect the rights, property, or safety of Moai, our users, or the public. Where legally permitted and practical, we will attempt to notify you before disclosing your information in response to legal process. In a business transfer. If Moai is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to this Policy's commitments or successor commitments no less protective. We do not sell your personal information, and we do not share it for cross-context behavioral (targeted) advertising. We have not done either in the preceding 12 months. If our practices ever change, we will update this Policy first and provide any opt-out rights required by law before any new practice begins.
5. Service Providers We use a small number of companies to run the Services. They process personal information on our behalf, under contracts limiting their use of it to providing services to us. We confirm that each third party with whom we share user data is required to provide the same or equal protection of user data as stated in this Privacy Policy. Supabase — hosting, database, authentication, file storage, and realtime infrastructure for the entire Service. Processes: all Service data, including account, profile, content, verification, and usage data. See Section 7 on where this data is stored. Resend — sending transactional email (e.g., verification codes and onboarding emails). Processes: your email address and the content of those emails. Vercel — hosting our website and event share-link pages. Processes: standard web server data from visitors to those pages, such as IP address and browser information. Apple — push notification delivery (APNs) and maps (Apple Maps / MapKit — see Section 3). Processes: push tokens and notification payloads; map content is loaded from Apple's services, and Apple may process related device and location data under Apple's privacy policy.
6. Data Retention — Please Read This Section We aim to be straightforward about retention, including its limitations at our current stage: We do not currently apply fixed, automatic retention or deletion schedules, with one exception: student ID images submitted for alternative verification are deleted within 30 days of the verification decision (Section 2.1). Account information, content, and usage records are otherwise retained while your account exists and, as described below, after deactivation. Account deactivation is not erasure. When you deactivate your account in the app (the option labeled "Delete Account" in Settings), your profile and content are hidden from all other users, and your account can no longer be used. However, the underlying data — your account record, content, messages, and usage history — remains stored on our systems and is not automatically erased. Messages you sent remain with their recipients, just as an email you sent remains in the recipient's inbox. Backups. Our infrastructure provider maintains database backups on its own cycle; deactivated data may persist in backups. Moderation and safety records relating to violations, bans, and reports may be retained even where other data is removed, so that bans are effective and repeat abuse can be identified. If you want more done with your data than deactivation provides, contact us at areihill@moaisocial.com — see Section 9. We will honor requests where applicable law requires, and we consider all requests in good faith.
7. Security, and Where Your Data Is Stored We take reasonable measures designed to protect personal information, including: Encryption in transit: all traffic between the app and our servers uses HTTPS/TLS. Encryption at rest: our database and file storage are encrypted at rest by our infrastructure provider. Access controls: content stored in private storage buckets is accessible only through signed, expiring links; production access is limited to the founding team; student ID images submitted for verification are additionally restricted to the reviewers who need them. Please note: direct messages and chat are not end-to-end encrypted. Like most social platforms, messages are stored on our servers in a form we can access — this is what makes moderation, abuse investigation, and legal compliance possible. Do not use Moai to send information you need to keep completely confidential. Where your data is stored. Our infrastructure provider hosts our database and storage on servers located in India (Mumbai region, operated on Amazon Web Services infrastructure). This means personal information collected in the United States is transferred to, stored in, and processed in India, where data protection laws may differ from those of your state. Our provider applies the same platform-level security measures — including encryption in transit and at rest — regardless of region. By using the Services, you acknowledge this transfer and storage. No security is perfect, and we cannot guarantee that unauthorized access will never occur. If a breach affecting your personal information occurs, we will notify you and regulators as required by applicable law, including Indiana Code § 24-4.9.
8. Age Requirements The Services are for people 17 and older and are offered to users in the United States. We collect date of birth at signup and block accounts computing to under 17. The Services are not directed to children under 13, and we do not knowingly collect personal information from anyone under 17. If we learn that an account belongs to someone under 17, we will terminate it. If you believe a user is under 17, contact us at areihill@moaisocial.com.
9. Your Choices and Rights Profile and content. You can edit your profile and delete individual posts and content in the app at any time. Optional fields (including photo, pronouns, major, and gender) can be left blank or removed. Location. Control location access in iOS Settings at any time (Section 3). Push notifications. Control notifications in iOS Settings or in the app. Email. Transactional emails (like verification codes) are part of the Service. Any marketing email we send will include an unsubscribe link, and we will honor opt-outs. Account deactivation. Available in the app (Settings). See Section 6 for exactly what deactivation does and does not do. Access, correction, deletion, and portability requests. Depending on where you live, you may have rights under state privacy laws to request access to, correction of, deletion of, or a portable copy of your personal information, and a right to appeal a refusal. You can submit any of these requests to areihill@moaisocial.com from the email address associated with your account (we verify requests this way to protect your data from imposters). An authorized agent may submit a request on your behalf with proof of authorization. We will respond within the time required by applicable law (typically 45 days, extendable once where permitted), will explain the reason for any denial, and will tell you how to appeal. We will never discriminate against you for exercising a privacy right. A note on scope: Moai is an early-stage company, and several state privacy laws apply only to businesses above certain size or revenue thresholds that we do not currently meet. Where a law does not yet apply to us, we still consider requests in good faith — but Section 6 describes what our systems do today, and we will not represent capabilities we do not have. Global Privacy Control and Do Not Track. We do not sell personal information or share it for targeted advertising, so there is currently nothing for an opt-out-preference signal to opt you out of. If that ever changes, we will honor Global Privacy Control signals as required by law. Because we do not track users across third-party websites or services, we do not respond to browser "Do Not Track" signals, for which no common industry standard has been adopted.
10. California and Other State Disclosures For residents of California and other states with comprehensive privacy laws, in the last 12 months we have collected the categories of personal information described in Sections 1–3 (identifiers; customer records information; protected classification characteristics only if you volunteer them, such as optional gender; approximate and, at check-in, precise geolocation; audio (voice messages) and visual (photos, and student ID images submitted for verification) information; internet or network activity limited to in-app usage; and inferences limited to in-app interests you select). We collect them from you and your device, for the purposes in Section 4, and disclose them only as described in Sections 4 and 5. We do not sell personal information and do not share it for cross-context behavioral advertising, and we have no actual knowledge of selling or sharing the personal information of consumers under 16. We do not use or disclose sensitive personal information for purposes other than providing the Services and the other purposes permitted by California Civil Code § 1798.121(a) and its regulations.
11. Changes to This Policy We may update this Policy as the Services evolve. If we make material changes, we will notify you — for example, by in-app notice or email — before the changes take effect, and we will update the effective date above. If a change materially expands how we use or share previously collected personal information, we will provide any notice and obtain any consent required by law before applying the change.
12. Contact Us Privacy questions, requests, and support: areihill@moaisocial.com Mail: Moai Social Inc, c/o Corporation Service Company, 251 Little Falls Drive, Wilmington, New Castle County, Delaware 19808 © 2026 Moai Social Inc. All rights reserved.