Last updated 25 October 2026

Privacy policy

This policy explains what personal data we collect when you use Molby, why, who we share it with, and the choices and rights you have.

1. Who we are

Molby is operated by Inchfield Technologies Limited (寸野科技有限公司), a private company limited by shares incorporated in Hong Kong under the Companies Ordinance (Cap. 622), company number 81236339, with its registered address at Unit 704, 7/F, Tower A, New Mandarin Plaza, 14 Science Museum Road, Tsim Sha Tsui, Kowloon, Hong Kong (“Inchfield”, “we”, “us”).

We are the data user under Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”) and the controller under the EU and UK General Data Protection Regulation (“GDPR”) for the personal data described here. This policy covers the molby.ai website and waitlist, the web workspace at molby.ai/app, the Molby mobile apps, and the prototype and tester pages at try.molby.app (together, the “Service”). Products that users launch with Molby on molby.app addresses are covered in section 10.

For any privacy question or request, email contact@molby.ai.

2. What we collect

When you join the waitlist

• Your email address.
• Your idea in one sentence, if you choose to share it.
• Whether you want a founding-member seat.
• How you found us: the website that linked to us, any campaign tags in the link, and the page of molby.ai you signed up on.
• Your approximate country, which our hosting provider derives from your IP address, and the time you signed up.

We don't store your IP address with your waitlist entry. To stop automated abuse we keep a one-way, salted hash of it for up to one hour, and then delete it.

When you visit molby.ai

We run our own analytics to learn which pages are useful and where people lose interest. It runs on our own infrastructure (a Cloudflare Worker and database in our account), sets no cookies, and uses no local storage or fingerprinting. Your browser keeps a random visit ID in session storage, which it deletes when you close the tab. The ID isn't linked to your identity, and a new tab or a later visit gets a new one. For each visit we record:

• the pages you view, which sections of a page come into view, how far down you scroll, and roughly how long you're active on each page;
• what you click or try: menu links and buttons, the stages of the demo, the comparison slider, the crew, FAQ answers, links to the example sites, and which apps you tick on the download page;
• whether you start or send the waitlist form, or get an error (never what you type into it);
• the website that linked to the site (its domain name only) and any campaign tags in the link, such as utm_source;
• your device type (phone, tablet or computer), browser and operating system, and the width of your screen;
• your approximate country, which Cloudflare derives from your IP address.

We don't store your IP address, your browser's full identification string, or anything you type, as part of analytics. If you join the waitlist, your entry is linked to that visit ID so we can see which pages lead people to sign up; your email address is never added to the analytics data. We look at the data as totals and as anonymous visit timelines, and only our team can see it.

If your browser sends a Do Not Track or Global Privacy Control signal, the site collects no analytics about your visit at all. Traffic from search engine crawlers, link previews and monitoring tools is filtered out.

We may also use Cloudflare Web Analytics to measure how fast pages load. It also sets no cookies and stores nothing on your device; it records the page address, the linking website, your browser and device type, your approximate country and page loading timings, and we only see totals. Like any website host, Cloudflare also processes your IP address briefly to deliver pages and block attacks.

Our free idea check, Is it worth building?, uses Cloudflare Turnstile to confirm that sign-ins come from a person and not a bot. It runs invisibly in the background and may process your IP address and signals from your browser and device. Cloudflare handles that data as described in the Turnstile Privacy Addendum.

When you use Molby

• Account data: your name, email address, the identifiers from Sign in with Apple or Google, and your settings.
• Project content: your ideas, your conversations with Mo (text and voice), answers to questions, and everything produced for your projects, such as research reports, designs, prototypes, code, files and decisions.
• Device and fraud-prevention data: device type, app version and device attestation results, used to keep free allowances to one per person and device.
• Connected accounts: if you connect an Apple, Google Play, Stripe or domain account, the access keys you give us, stored encrypted and used only for actions you authorise.
• Payment data: payments are processed by Stripe on the web and by Apple or Google for in-app purchases. We don't receive your full card number. We receive what we need for billing, tax and refunds: amounts, payment status, the last four digits of your card, and your billing country.
• Usage and technical data: server logs, error reports and basic usage events (for example, that a research report was opened), used to run and improve the Service.
• Messages: what you send us when you email or contact support.

When you sign in to “Is it worth building?” or buy credits

• Signing in. You can sign in with an email code, Google or Apple. From Google or Apple we receive only your email address, whether it is verified, a unique account ID, and (Apple, the first time only; Google, every time) your name. If you use Apple's “Hide My Email”, we only see the relay address Apple gives us, and our emails reach you through Apple.
• Credit reminders. If you have credits, we email you once when your balance drops below one check and once about 30 days before credits expire. Each of these emails has a one-click link to turn them off.
• Payments. When you buy credits, Stripe processes your payment. We never see or store your full card number. We receive and keep the pack, the amount, the currency, the payment method type, Stripe's payment and session IDs, and the date. Stripe's privacy policy is at stripe.com/privacy.

When you test someone's prototype

• What you do in the prototype, notes you leave, and your answers to Mo's short interview. You don't need an account, and you can stay anonymous.
• Session recordings and tap or click heatmaps, only if you agree when the test starts. You can say no and still take part.
• Your email address, only if you choose to leave it to hear when the product launches or when your feedback has been acted on.

Your feedback is shared with the person who invited you to test (the creator), so they can improve their product.

Cookies

The molby.ai website sets no cookies for visitors: no advertising cookies, no analytics cookies, and no third-party trackers. Its analytics (described above) uses only a visit ID in session storage, which your browser deletes when you close the tab. molby.ai sets a sign-in cookie only when you sign in to the free idea check, and another for our team's internal dashboard, which visitors never receive. If you pick a language with the EN / 中文 switch, your browser remembers it in local storage (molby_lang) so the site opens in that language next time, and a one-time note suggesting the Chinese site is remembered the same way (molby_lang_hint). Both stay on your device, are never sent to us, and you can clear them in your browser settings. The Molby apps and web workspace use essential cookies and local storage to keep you signed in and remember your settings. If we ever add analytics that need cookies or similar storage, we'll ask first where the law requires it.

3. How we use it

By joining the waitlist you ask us to email you about your invite, the beta and the founding-member offer. Every email includes a way to unsubscribe, and we will not use your data for direct marketing of anyone else's products. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

We never use your idea or project content to build products for other users, and we don't share it with other users unless you choose to (for example, by sending a test link).

4. AI providers

Molby uses AI models from third-party providers to do research, write, design, generate code and review work. To do this, we send the relevant parts of your project content to those providers. They process it on our behalf, as our processors or service providers, under contracts that limit their use of it to providing their service to us. We choose providers and settings under which your content is not used to train their general-purpose models.

The providers we use may change as better models become available. A current list is available on request at contact@molby.ai.

5. Who we share it with

We don't sell personal data, and we don't share it for cross-context behavioural advertising. We share it only with:

• Service providers who help us run Molby: cloud hosting and databases (Cloudflare), AI model providers, payment processors (Stripe, Apple, Google, RevenueCat), email delivery, and error monitoring. They may only use the data to provide their services to us.
• Platforms you ask us to act on, such as App Store Connect, Google Play or a domain registrar, when you authorise a submission or purchase.
• The creator of a prototype, if you take part in their test.
• Authorities or others when the law requires it, or when needed to protect the rights, safety or property of our users, the public or us.
• A buyer or successor, if Inchfield is involved in a merger, acquisition or sale of assets, subject to this policy.

6. International transfers

We are based in Hong Kong, and our service providers may store and process data in other places, including the United States and the European Union. Wherever data goes, we take reasonable steps to make sure it is protected to the standard in this policy. For data covered by the GDPR or UK GDPR, we rely on adequacy decisions or on the European Commission's Standard Contractual Clauses (with the UK addendum) or equivalent safeguards. You can ask us for a copy of the relevant safeguards.

7. How long we keep it

• Waitlist entries: until you ask to be removed or unsubscribe, or 24 months after the public launch if you haven't created an account.
• Abuse-prevention hashes of IP addresses: up to one hour.
• Website analytics: visit records (the random visit ID and what happened during the visit) are deleted after 90 days. We keep daily totals, such as “120 visits to the examples page from Google on 3 November”, which don't identify anyone. Cloudflare Web Analytics keeps only aggregated page-view and performance data.
• Account and project data: while your account is open. Projects you pause stay saved. If you don't sign in for 12 months, we'll remind you before archiving. When you delete a project or your account, we delete its content within 30 days, apart from backups, which roll over within a further 30 days.
• Tester recordings: until the creator deletes the project, and in any case no longer than 12 months after the test.
• Credits: a record of your credit purchases, spending, refunds and expiry for as long as your account exists, and longer where the law requires it for tax and accounting purposes.
• Payment and tax records: as long as tax and accounting law requires, generally seven years.

8. Security

We protect data with encryption in transit and at rest, access controls limited to staff who need it, and separation between projects. Keys you give us for connected accounts are stored encrypted. No system is perfectly secure; if a breach affects your personal data, we'll tell you and the relevant authorities as the law requires.

9. Your rights

Wherever you live, you can ask us to access, correct or delete your personal data, or stop sending you marketing emails. Email contact@molby.ai. We may need to confirm your identity first. We don't usually charge for requests, and we respond within the time the law requires, normally within 30 days.

Hong Kong

Under the PDPO you have the right to request access to and correction of your personal data, and to ask us to stop using it for direct marketing. Data access requests are answered within 40 days. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong.

European Union and United Kingdom

If the GDPR or UK GDPR applies to you, you also have the right to restrict or object to our processing, to receive your data in a portable format, and to withdraw consent at any time without affecting earlier processing. You can complain to your local data protection authority, or in the UK to the Information Commissioner's Office.

California

If you live in California, you have the right to know what personal information we collect, use and disclose, to delete it, to correct it, and to opt out of its sale or sharing. We don't sell or share personal information as those terms are defined in the California Consumer Privacy Act, and we don't use sensitive personal information for purposes that would give you a right to limit it. You can use an authorised agent to make a request, and we won't treat you differently for exercising your rights. The categories we collect are listed in section 2, the purposes in section 3, and the recipients in section 5.

10. Products you build with Molby

When we host a product you launched with Molby, at a yourname.molby.app address or your own domain, the personal data of that product's users belongs to you. For that data, you are the controller (or data user) and we process it only on your instructions, as your processor or service provider. You're responsible for your product's own privacy policy and for having a lawful basis for the data it collects. We draft a privacy policy and terms for your product as part of launch, but they are a starting point, not legal advice.

11. Children

Molby is for people aged 18 or over. We don't knowingly collect personal data from children under 16. If you think a child has given us their data, contact us and we'll delete it.

12. Changes and contact

We'll update this policy as Molby develops. If we make significant changes, we'll tell you by email or in the app before they take effect. The date at the top shows when it was last updated.

Email: contact@molby.ai (please put “Privacy request” in the subject line for requests about your data)
Post: Inchfield Technologies Limited, Unit 704, 7/F, Tower A, New Mandarin Plaza, 14 Science Museum Road, Tsim Sha Tsui, Kowloon, Hong Kong