Privacy notice

Effective October 8, 2026

Short version: the site needs a couple of cookies to work. Counting what people open (Analytics) and showing you our ads later (Marketing) are on unless you turn them off with one click on Do not sell or share my info; a Global Privacy Control signal from your browser keeps them off automatically. Where the law asks for your permission first (for example the EU, the UK and Switzerland), they stay off until you turn them on.

Who publishes this site

Sent by Moe is the publisher and operator of this site. We publish a community flyer for the towns we serve and run this site as its online home. Questions, corrections, or requests: moe@sentbymoe.com, or by mail: Sent by Moe, PO Box 4023, West New York, NJ 07093.

What we collect

• Visits. When you arrive: which town page you opened, which of the flyer's QR codes you scanned, the site that sent you, and general device information such as browser and screen size. We store this against a random ID we keep in your browser, not your name.
• Clicks, only if you turn Analytics on. Which pages you open and which event or business you tap or share.
• What you type in. When you RSVP, claim an offer, submit an event, or ask to be listed, we keep what you sent: name, email, phone if you give it, business details, and your message.
• Support requests. When you send a request from the help center or your account, or write to moe@sentbymoe.com, we keep your name (if you give it), email, the message and our replies, and which help article you were reading. A Yes or No on a help article is stored with your email only if you are signed in.
• When you sign an agreement or consent. We record your name, email, how you signed, the time, and the IP address and browser details (user agent) your device sent, as proof of who signed.
• Privacy requests. The request, your email address, and the full IP address it came from, as a record that we answered it.
• Email activity. Whether the emails we send you were delivered, and whether they bounced.

We do not ask for and do not want your Social Security number, financial account numbers, health details, or government ID. Please don't send them.

Why we collect it

• To run the calendar and the directory, and to answer you.
• To tell a host how many people said they're coming.
• To see which listings and events neighbors actually use, so the flyer is better.
• To show ads for the mailer and for participating businesses to people likely to care.

Cookies, in three groups

US visitors see a short notice with OK and Preferences; Analytics and Marketing are on unless you turn them off (the opt-out that New Jersey law gives you). Visitors from other countries, including the European Union, the EEA, the United Kingdom and Switzerland, choose first, with both off until they turn them on. We read your country from your connection and keep it in a moe_geo cookie for a day.

• Functional (always on). Needed for the site to work. A random visitor ID (moe_v, one year) so a visit is counted once and your choices stick, your cookie choices themselves, and your town (moe_town, 90 days) so the site opens your town's page the next time you come back; if you arrived through a referral link, that link's code (moe_ref, 60 days) and the place it was shared (moe_refc, 60 days) so the person who referred you gets credit; and, if you sign in, your sign-in session and any order you have started, kept in your browser. If your browser sends a Global Privacy Control signal with a page request, a one-day cookie (moe_gpc) remembers it so the signal is honored. Outside the US, until you turn Analytics on, no visitor ID is stored on your device. These never go to an ad company.
• Analytics (US: on until you turn it off; elsewhere: off until you turn it on). Lets us count which pages, events and businesses people open and share, so the flyer is more useful. This stays with us.
• Marketing (US: on until you turn it off; elsewhere: off until you turn it on). Loads advertising pixels from Meta (Facebook and Instagram), TikTok, Google (Google Ads and Google Analytics 4), LinkedIn, Microsoft Advertising (Bing) and Nextdoor. Those companies then know you visited this site and can show you our ads, or a participating business's ads, later. That is targeted advertising. They never load when Marketing is off, when your browser sends Global Privacy Control, or, outside the US, before you turn Marketing on. They set their own cookies (for example _fbp, _fbc, _ttp,_ga, _gcl_*, li_fat_id, _uetsid) on your device.

How we tell which ads work

• The link you arrived on. Our ads and links carry labels (campaign name, source, medium and the ad's name; these are the utm_ parts of an address). We keep the labels of the first and the latest tagged link you came from with your visit, and copy them onto what you later send us (a request, a sign-up, an order), so we can see which ads bring neighbors and businesses. When Marketing is on we also keep the click ID an ad platform adds to the address (gclid, fbclid, ttclid, li_fat_id,msclkid, ndclid). With Marketing off or Global Privacy Control on we keep only the plain labels, never the click IDs.
• Events sent from your browser. While Marketing is on, the ad tags are told when you open a page, view a town or business page, send a request, or sign up.
• Events sent from our server. While Marketing is on, when you make a request, sign up, open the page to agree and pay, or pay, our server also reports that event to the ad platforms we have connected: Meta, TikTok, Google, LinkedIn and Nextdoor (Microsoft Advertising gets the same from a file we upload). Each report holds: what happened and when; for a payment, the amount; your email address and phone number in scrambled form (a one-way SHA-256 hash, never the plain address or number); the ad platform's click ID and browser cookie values; and your IP address and browser type. The platform uses it to match the event to its own users, to measure our ads and to improve who sees them, under its own privacy policy. We do not send names, messages, card numbers or addresses. Nothing is sent for a visit that has Marketing off or Global Privacy Control on, or, outside the US, before you opted in.
• Their policies. Meta, TikTok, Google, LinkedIn, Microsoft, Nextdoor. Each one also lets you control its ads from your account on that service.
• Keeping and stopping. The record of what we sent is kept for 90 days, then deleted. Turning Marketing off, using Do not sell or share my info, or sending Global Privacy Control stops anything further from being sent. A privacy request deletes the visit and its ad records.

How to change your choice

• Where your region asks for permission first, open Cookie preferences at the bottom of any page and save a new choice.
• Use the switch on Do not sell or share my info at any time, on any device you use.
• Turn on Global Privacy Control in your browser or an extension. We detect it and keep Analytics and Marketing off for you automatically. You don't have to tell us anything.
• Email moe@sentbymoe.com to ask for this.

Every marketing email has an unsubscribe link and our mailing address. Once you unsubscribe we don't send you marketing again. Email about an RSVP or a listing you asked for is not marketing and will still reach you.

Who else sees your information

• The host or business you contacted. RSVP to an event and its host, and the business sponsoring it if there is one, sees your name, email, phone if you gave it, and party size. Claim an offer and that business sees the claim. That is the point of it.
• Our service providers, who only handle data to run the site: Supabase (database and functions), Vercel (hosting), Resend (email delivery), Stripe (payments and referral payouts), Expo with Apple and Google (app notifications), Spaceship (our domain name and DNS), and RigFresh (the server that hosts the moe@sentbymoe.com mailbox and keeps a nightly encrypted off-site copy of uploaded files). The automated screening described below runs through OpenRouter and its model provider TypeSafe, and so does the optional professional headshot (see "Professional headshot" below). A YouTube video loads from YouTube only when you tap it.
• YouTube, TikTok and Facebook, for posts a business chose to show. A business can turn on "Show my posts in Sent by Moe feeds" for its own YouTube, TikTok or Facebook Page link. Its posts then show on its card and in the feed of businesses it is connected to, played in that platform's own player and linked to the original. We keep only each post's address, id, a short caption and its date, read again about every hour and deleted after 30 days without a refresh, and at once when the business turns it off or removes the link. A YouTube post loads from YouTube when you tap it; TikTok and Facebook players load from TikTok and Facebook when you scroll to them, and their own privacy policies apply there. LinkedIn, Instagram, Facebook and Threads posts work the same way. When a business adds its LinkedIn profile link, we look for its own public posts through a web search service (OpenRouter with its search provider Exa) using only the profile name and link; we never sign in to LinkedIn. When a business connects an Instagram, Facebook Page or LinkedIn Page account, we receive read-only access to that account's own posts; the access key is kept encrypted and deleted when the business disconnects.
• Ad platforms (Meta, TikTok, Google, LinkedIn, Microsoft Advertising, Nextdoor), only while Marketing is on (in the US it is on until you turn it off; elsewhere only if you turned it on), so we can measure ads and reach similar neighbors. What is sent from our server, and what is not, is described under "How we tell which ads work" above.
• Anyone we're legally required to share with, which so far is no one.

We do not sell your information for money. Sharing data with ad platforms for targeted advertising can count as a "sale" or "share" under some laws, which is exactly why the opt-out above exists.

Automated screening

Content submitted for the calendar or the directory (event listings, offers, business details) gets automated risk screening of submitted content before it goes live, so we can catch things like raffles, medical or financial claims, or other content that shouldn't appear in a community mailer. The screening provider is OpenRouter (with TypeSafe). It only assigns a score a person then reviews — nothing is auto-published or auto-rejected by it, and it never sees your email or phone number.

Professional headshot

Listed businesses can choose "Make it a professional headshot" on their photo. If you use it, your photo is sent to OpenRouter's image model to create the headshot and is not kept by them beyond processing. We ask OpenRouter to use only providers that do not keep what they are sent. Nothing else about you goes with the photo. You see the new picture next to your original, and your original is replaced only if you choose to use the new one; if you do not, the new picture is deleted. You get 3 tries a day.

Network (for listed businesses)

In Network a business keeps the people it meets, meets other Sent by Moe businesses in a 1-2-1, and writes to them. What that keeps: the people it adds (name, business, category, email, phone, town and its notes), its meeting notes, follow-ups and introductions it logs, the times it offers for a 1-2-1, its swipes on the businesses it is shown, the businesses it blocks or reports, and the points it earns. Its own people and notes are seen only by that business; the other business in a 1-2-1 sees that notes exist, never the words.

• Scanning a business card. If you take or pick a photo of a card, the photo is sent once to OpenRouter's model (or, if that is down, Anthropic or OpenAI) to read the name, business, phone and email off it. We do not keep the photo; only the details you then save are kept.
• Speaking a note. If you tap Speak, the recording is sent once to OpenRouter's model to turn it into words. We do not keep the recording; only the words you then save are kept. We ask OpenRouter to use only providers that do not keep what they are sent.
• Messages to another business. A message you send from a business's card is checked against the community rules, emailed to that business with your email as the reply address, and kept for 13 months.
• Posts in the feed. A caption that breaks the community rules (hate, threats, sexual content, harassment) is hidden automatically before anyone sees it.

Our app

The Sent by Moe app does two jobs: neighbors can browse their town in it, and listed businesses use it to run their card, offers, events and leads. Everything above about the site, your rights, and how long we keep data applies to the app too.

Neighbors in the app. You don't sign in. The app shows the same town pages and forms as this site. What it sends us: your town's ZIP code so it can open the right town; the pages and taps it counts the same first-party way the site does, with no lasting ID kept on your phone (turn on Do not sell or share my info in the app's More tab and it stops); what you type into a form you send, such as an RSVP or a message to a business; and, only if you turn notifications on, an anonymous push token for your phone so we can send you town alerts. Your use of the app is not linked to the email you type into a form: a form carries only what you typed in it.

Businesses in the app. Nothing about a neighbor's visit to a card is tied to their name: card visits are counted anonymously. What the app collects from a listed business:

• Account email. The email address on your listing, used to send your sign-in code and to recognise you.
• Profile and card content. What you enter for your business: name, category, hours, links, offers, events, answers and the other details on your card.
• Photos you upload. Your logo, headshot and gallery photos, stored with your card. The app only reads a photo you choose.
• Device push token. A token for your phone so we can send you alerts about new leads and decisions on your content. Turn alerts off in the app (or remove the device) and we stop using it; a token a phone no longer accepts is deleted.

Who handles app data: Supabase (database and functions), Expo (push delivery), Apple Push Notification service and Google Firebase Cloud Messaging (the last hop to your phone), and Resend (the sign-in and notice emails). The same automated risk screening described above scores what you submit; it is advisory only and a person decides. We do not use the app to track you across other apps or sites. Delete your account from the app, or make a privacy request.

Organizer accounts

Charities, schools, churches and other houses of worship, libraries, clubs and town government offices can open an organizer account to post their own events. This is what an organizer account holds:

• The organization. Its name, type, towns, address, website, logo, a short description, and the public contact email it chooses to show.
• The contact person. Their name, title, sign-in email and phone. We use them to sign the account in, to reach the organization about its events, and for the Event Listing Consent the contact signs once for all its events.
• Events. The events the organization posts, and where each one stands (waiting for review, live, or taken down).
• RSVP lists. For its own events the organization sees who RSVP'd: name, email, phone if given, and party size, the same as any host (see "Who else sees your information" above). It never sees the RSVPs for anyone else's events.

An organization or its contact can ask for a copy of this data, or for it to be deleted, with a privacy request or by writing to moe@sentbymoe.com. A deletion removes the contact's phones and alerts; the signed consent and the record of past events stay, because they are the permission we published those events under.

Contacts people share with us

When someone answers "Fill your town" they can name businesses, community groups and real estate agents they know, by typing, pasting a list, importing a spreadsheet, or picking from their phone's contacts. We use only the names and email addresses they choose to share, and only to send that person or group one invitation email (and at most one reminder), from the person who named them, with that person's referral link.

• What we keep. The name, organization, email, phone if given, who named them and when, whether the invitation was sent, opened or answered, and the reason we may write to them (a legitimate business interest in introducing local businesses to each other). We keep it for 13 months, then erase the details.
• Your phone's address book. The app never reads your address book. It shows your phone's own picker, and receives only the contacts you tap.
• If we wrote to you. Every message has an unsubscribe link that works with one click, and that address is kept on a do-not-email list. Sent by Moe sends no more than one marketing email to an address in a week. We do not send these invitations to addresses in the European Union, the United Kingdom or Canada unless the person asked us first. Sent by Moe does not text or phone anyone for this.
• Your rights. You can ask what we hold about an address, or ask us to erase it, with a privacy request. Unsubscribing also removes the details we were given.

Teammates on a business or organization

An owner of a business or an organization account can give teammates access by email. We keep the teammate's email, the name the owner typed, the role (owner or editor), who added them and when, and when they last signed in. We send them one email saying who added them. A teammate signs in with their own emailed code, and what they do is logged under their address. An owner can remove a teammate at any time, and a teammate can leave. A teammate can ask what we hold about their address, or ask us to erase it, with a privacy request. If two duplicate records are merged, the older record's sign-in address becomes a teammate seat on the one kept.

Referral program

If you join the referral program, this is what we keep and why.

• What we keep. Your email, your name if you gave it, your referral code, who you referred and where each referral stands, the reward amounts and whether you chose credit or cash, and payout records: your Stripe account ID and the IDs of the transfers we sent you. When you tap a share button we count the share, and when someone opens your link we count the click, each with the place it went (text, email, Facebook and so on). We do not see or keep the contacts you pick or the people you send to: your own phone or email app sends the message.
• What Stripe collects. To pay cash rewards, Stripe collects your identity, bank and tax details directly, under Stripe's privacy policy. Sent by Moe never sees or stores your bank account or Social Security details.
• Why. To run the program, pay your rewards, prevent fraud, and keep the tax records the law requires.
• How long. A referral account you never use is deleted after 13 months without activity. Void referrals are deleted after 13 months. Payout records are kept for seven years for tax purposes, and anonymised if you ask us to erase your data.
• To erase it. Make a privacy request.

How long we keep it

• Visit and click records: 13 months, then deleted automatically every night.
• The record of what our server reported to ad platforms (scrambled email and phone, click IDs, IP address): 90 days.
• RSVPs, offer claims and event submissions: 24 months after the event.
• Messages to businesses, questions to Moe and town requests: 24 months.
• Our copies of the emails we send: the text 13 months, the record 24 months.
• Support requests and Help-article feedback: 24 months.
• Privacy requests, including the IP address they came from: 24 months after we close them.
• Database backups: Supabase keeps 7 daily backups of the database. A deletion is carried out in the live database and reaches the backups as they roll off.
• Off-site copy of uploaded files: 30 nightly encrypted copies, then deleted. A deletion reaches these copies as they roll off.
• Business and organization accounts: while active, until you close the account.
• Signed agreements, invoices and payment records: at least seven years, because contract and tax rules say so. A deletion request doesn't remove these.

Every period, and what happens when you ask us to delete your data, is on the data retention page. Jobs run every night to enforce it.

If you are outside the United States

You can read this site from anywhere, and a business or organization abroad can buy a place in a U.S. town's mailer. The mailer itself goes only to U.S. addresses. This section is for visitors and customers in the European Economic Area, the United Kingdom and Switzerland (GDPR, UK GDPR), Canada (PIPEDA and provincial laws), Brazil (LGPD) and Australia (Privacy Act 1988). The rest of this notice applies to you as well.

Who is responsible. Sent by Moe, in the United States, decides why and how your data is used. Contact: moe@sentbymoe.com.

What we collect, why, and our legal basis

• Account and listing details (your email, name, business details, content you post) and orders, agreements and invoices, to open your account, list your business and take payment. Basis: performing our contract with you.
• Payment and referral payout details. Stripe collects and holds card, bank, identity and tax information; we keep only the record of what was paid and to whom. Basis: contract; legal obligation (tax and accounting records, sanctions rules).
• RSVPs, offer claims, event submissions, messages to a business, privacy requests. To do what you asked, and to pass it to the host or business you chose. Basis: contract or your request; legitimate interest in answering you.
• Visit counts and security logs (page opened, device type, approximate country from your connection, abuse limits). To run, secure and improve the site. Basis: legitimate interest.
• Analytics and advertising cookies and pixels (Meta, TikTok, Google, LinkedIn, Microsoft Advertising, Nextdoor), and the events our server sends them. They are off until you say yes in the cookie notice, and you can change your mind any time. Basis: your consent.
• Marketing email. To people in the EEA, the UK, Switzerland, Canada and Brazil we send marketing email only with their consent, or as the law otherwise allows for business contacts. Every one has an unsubscribe link. Basis: consent; legitimate interest where the law allows it for business contacts.

How long we keep it

As in "How long we keep it" above: visit records 13 months, RSVPs and claims 24 months after the event, messages and town requests 24 months, agreements, invoices and payment records at least seven years (tax and contract law), accounts until you close them. Referral payout records are kept seven years. Full table: data retention.

Who processes your data, and where

Our processors act on our instructions: Supabase (database and functions), Vercel (hosting), Resend (email delivery), Stripe (payments and payouts) and Expo, with Apple and Google (app notifications). We and these providers are in, or process data in, the United States, so your data is transferred there. Where the law requires a safeguard we rely on the European Commission's Standard Contractual Clauses and the UK addendum, which are part of each provider's data processing terms, and on the EU-US Data Privacy Framework where a provider is certified. Ad platforms (Meta, TikTok, Google) receive data only if you turned Marketing on. You can ask us for a copy of the safeguards at moe@sentbymoe.com.

Your rights

Depending on where you live you can ask us to: confirm what we hold and give you a copy; correct it; delete it; restrict or stop using it; give it to you in a form you can move; stop marketing or profiling; and take back a consent you gave. You can also object to use based on our legitimate interests. In Brazil you can also ask about who we shared it with and ask for anonymization. Make a privacy request (we email a code to your address first so nobody else can use your name), or write to moe@sentbymoe.com. Requests are free of charge and handled as the law requires.

If you are unhappy with our answer you can complain to your data protection authority: in the EEA, the authority in your country; in the UK, the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner; in Canada, the Office of the Privacy Commissioner (or your province's); in Brazil, the ANPD; in Australia, the Office of the Australian Information Commissioner.

If someone gave us your name

A neighbor, a business or an organization may give us your name and email so Sent by Moe can invite you to take part (for example, a business a neighbor recommends, or a person at an organization that holds community events). We then send one invitation, and at most one reminder, that says who suggested you. We don't send those invitations to people in the EEA, the UK, Switzerland or Canada unless they have opted in. To stop, click the unsubscribe link in the email or reply "stop". We keep only your address on a do-not-contact list so no further email is sent. To see or delete what we hold about you, make a privacy request.

Your state privacy rights (California, Colorado, Connecticut, Virginia, Texas, Oregon, New Jersey and others)

If you live in a state with a consumer privacy law, such as California, Colorado, Connecticut, Virginia, Texas, Oregon or New Jersey, this section tells you what the law asks us to tell you. The New Jersey section below applies the same way.

• Categories we collect. Identifiers and contact details (name, email, phone, the random visitor ID, IP address); what you type into forms and messages; business and listing details; signatures and agreement records; payment and referral payout records (card and bank details stay with Stripe); device and visit information; and approximate location (your town or ZIP code, and country).
• Where it comes from. You; your device and browser; a neighbor or organization who named you; and our service providers.
• Why. The purposes listed under "Why we collect it" above, plus taking payment, keeping legally required records, and preventing abuse.
• Who receives it. The hosts and businesses you contact, our service providers named above, and the ad platforms Meta, TikTok, Google, LinkedIn, Microsoft Advertising and Nextdoor only while Marketing is on.
• Sale and sharing. We do not sell personal information for money. Marketing pixels can count as a "sale" or as "sharing for cross-context behavioral advertising" while Marketing is on; the cookie choices above and Do not sell or share my info turn that off. We honor the Global Privacy Control signal as that choice. We do not knowingly sell or share the personal information of anyone under 16.
• Sensitive information. We do not ask for it and do not use it to infer characteristics about you.
• Your rights. To know and get a copy of what we hold, correct it, delete it, move it, and opt out of sale, sharing, targeted advertising and profiling. We do not treat you differently for using them.
• How to ask. Use the privacy request form or email moe@sentbymoe.com. We email a code to your address first. An authorized agent can make a request for you; we may ask the agent for your written permission and ask you to confirm it.
• Appeal. If we decline your request, reply to our response to ask for a review of the decision. If you are still unhappy you can contact your state attorney general.
• Financial incentive. The referral program offers a reward (account credit or cash) when someone you refer places a first paid order. To take part you give us your email and payout details through Stripe; you can stop any time and ask us to delete your data. The value of the data is not calculated separately from the program itself.

Your rights in New Jersey

Under the New Jersey Data Privacy Act you can ask us to: confirm whether we hold data about you and show it to you; correct it; delete it; give you a copy you can take elsewhere; and stop using it for targeted advertising, sale, or profiling.

Make a privacy request. We email a six-digit code to the address you give, so nobody can see or delete your data by typing your email. You can also write to moe@sentbymoe.com. Requests are handled as the law requires. Sent by Moe does not charge you or treat you differently for asking. If we say no, reply to that message to appeal; appeals are answered as the law requires.

Events we list

We list an event on this site only after its host gives us written permission, which they can take back at any time. We publish the event's name, date, time, place and description, and the host's name.

Children

This site is for adults in and around town. We don't knowingly collect information from anyone under 13. If your child sent us something, email us and it's gone.

Changes

A changed notice is posted here with a new effective date at the top.