Skip to content
Moonjar Help

AI consent

Moonjar uses three third-party AI providers under the hood. You agree to that the first time you sign in — the consent screen spells out which provider sees what data, and why. This page is the durable version of that screen.

The three providers

Section titled “The three providers”

Anthropic (Claude)

Section titled “Anthropic (Claude)”

What it receives: your captured documents and chat messages.

Why: classifies new captures into one of 15 document types, extracts structured fields, and runs the chat assistant.

Anthropic sees a document at capture time (for classification) and sees a chat message every time you send one. The chat assistant also calls back into Anthropic for various downstream tasks — a short Claude call rewrites chat content into a memory; another small call generates the daily summary. All AI calls go through Anthropic’s API.

Cohere

Section titled “Cohere”

What it receives: the text of your captured documents and your search queries.

Why: generates embeddings so you can search your knowledge by meaning, not just keywords.

Cohere only does embeddings. It never sees your chat, never sees the assistant’s output. Each capture’s text goes through Cohere once when the embedding is generated; each search query goes through Cohere once when you search.

OpenAI

Section titled “OpenAI”

What it receives: voice recordings and the assistant’s text when it speaks back to you.

Why: transcribes voice notes and synthesises spoken replies in conversation mode.

There’s a meaningful split here:

  • One-shot voice input (the mic button in the chat composer) and spoken replies (the TTS that reads chat answers): only audio goes to OpenAI. None of your captures, memories, or library are sent.
  • Conversation mode (live voice in the chat tab): the same context block the text chat sends to Anthropic — your collections, recent documents, last 20 memories, location, and custom instructions — is sent to OpenAI’s realtime model so it can answer without a tool round-trip every turn. See What the chat knows about you for the full data-flow.
Section titled “What consent covers”

When you accept, Moonjar records the timestamp on your account. Until you accept, the app is unusable — declining sends you back to the login screen. (You can come back later or delete the account.)

The consent covers:

  • Sending captured content to Anthropic for classification and field extraction.
  • Sending captured text and search queries to Cohere for embeddings.
  • Sending audio to OpenAI for transcription and TTS, and the context block to OpenAI’s realtime model in conversation mode.
  • Storing the resulting AI outputs (summaries, classifications, extracted fields, embeddings) inside your Moonjar library.

What it doesn’t cover

Section titled “What it doesn’t cover”
  • Your password is never sent to any AI provider (it’s hashed and only used for sign-in).
  • Your API key, if you have one for programmatic access, is never sent to any AI provider.
  • Other people’s data. A shared chat shares only that conversation’s context, never the participants’ full libraries.
Section titled “Revoking consent”

There’s no toggle. Moonjar is built on AI — without it, the app can’t classify captures, extract fields, search semantically, or chat. Revoking consent means deleting your account; both go together.

To revoke: see Delete your account. The deletion endpoint purges every user-owned row, including embeddings, memories, conversations, and AI cost telemetry. Nothing of yours stays.

See also

Section titled “See also”