Privacy
Version 2026-10-09.
Mootstead is an ArcSystemsTechnology system, run by ArcGabriel Ltd (registered in England and Wales, company 17389329; Carlile Institute Business Centre, 54 Huddersfield Road, Meltham, Holmfirth HD9 4AE), which decides how your information is used (the controller), registered with the Information Commissioner's Office as ZC219485. Write to hello@mootstead.com.
What we keep, and why
- The name you choose
- Shown only to people you have been witnessed with. Needed to run your account (contract).
- Your devices
- A public key for each phone or browser you use, and when it was added or last opened. This is how Mootstead knows a device is yours. We never hold the private key (contract, and our legitimate interest in keeping accounts secure).
- Your Moments
- Who you were witnessed with and the day it happened, with the signed record of the exchange beneath it. That record carries the exact time, because both phones signed it; it is shown to the people in the Moment only, and in your own download. A Moment is shared by everyone in it (contract).
- Face ID to open Mootstead, if you turn it on
- A passkey your phone makes for this device: we keep its public key and when you last unlocked, so Mootstead can ask again after a few minutes away. Your face and fingerprint stay on your phone; we never receive them (contract).
- Your age check result
- That you passed, which provider checked, their reference and the date. We do not keep your photo, your ID document, your age estimate or your date of birth: they stay with the provider, and our server reads its result only to see whether you passed (legal obligation under the Online Safety Act 2023).
- Plans in a Circle, and photos
- What you write or add, shown only to the people in that Circle or Moment. Photos are checked before anyone else sees them (contract; legal obligation for the safety checks).
- Your profile, if you make one
- A photo, a line about you and ways to stay in touch: every part optional. Seen only by people you witnessed directly and chose to share it with (or everyone you witness, if you choose that), and only while you are still in a Moment together. You can stop sharing with anyone at any time. A profile photo goes through the same checks as every other photo (contract; legal obligation for the safety checks).
- Connections in common, if you turn it on
- Off unless you turn it on. When you, someone you have met and a third person have all turned it on, each of you can see that you both know that person, by name only, never when or where. It covers only people the viewer has met themselves, and only meetings the viewer was not part of. Names appear as Moments are made, so someone who looks often could guess roughly when. You can turn it off at any time, and you leave everyone's view at once (consent).
- In the Mootstead app: Bluetooth, NFC and the phone's lock
- While you witness someone and choose to hold your phones close, the app passes the same code a QR code shows to the phone in front of you, by Bluetooth for up to thirty seconds, to one phone only, or, between Android phones, NFC. As with a code on a screen, a phone nearby could try to read it, so both screens show the same short number to check before you confirm. Nothing about phones nearby is kept. If you turn on the app's lock, your phone checks it is you (Face ID, fingerprint or passcode) entirely on the phone (contract).
- Your recovery email, if you give one
- Used only to get you back in if you lose your phone (contract).
- Reports and complaints
- What you tell us and what we did about it (legal obligation; legitimate interest in keeping people safe).
- Security events
- That a device was added, removed or refused, and when. Never where from (legitimate interest in security).
- Daily counts
- How many Moments were made or declined today, as numbers with no person attached, and that you opened Mootstead on a given day, so we can tell whether it is useful (legitimate interest).
Places, and what we never collect
Mootstead asks your browser where you are only when you tap Add location on a Moment, never in the background, and does not store network addresses with your account. A place is optional and is seen only by the people in that Moment. You choose how exact it is: a name you type, a country, a town or city, or an exact place. For a country or a town, your phone works out the nearest town itself and only the name is sent to us.
An exact place is kept only if you have agreed to it (you can stop on the You page, and your exact places then go back to their towns), and the others in the Moment see it only once every one of them has agreed; until then they see the town. Anyone in the Moment can remove its place. A name you give a place is seen by everyone in the Moment straight away; only the exact position waits for everyone to agree. Your Constellation shows towns and place names, never exact positions. When you look at an exact place, the map pictures come from OpenFreeMap (openfreemap.org), which sees the area being shown, not who you are with (consent for exact places; contract for the rest). Town names come from GeoNames (geonames.org, CC BY 4.0).
Who else sees it
Only the people you have been witnessed with see your name and your Moments. Nothing on Mootstead is public. These organisations process information for us and nothing else: Didit (the age check, only during your check), Railway (hosting), Cloudflare (storage for photos and backups), Resend (email, only if you give a recovery address) and, for photos, Sightengine, which checks each photo for sexual imagery. ArcGabriel Ltd also accesses Shield by Project Arachnid (projectarachnid.ca), a program of the Canadian Centre for Child Protection Inc., to facilitate the detection and removal of child sexual abuse material and harmful-abusive material of children and survivors of child sexual abuse on its services; each photo is sent to it before anyone sees it. The Canadian Centre for Child Protection decides for itself how it uses what it receives (it is a separate controller, not our processor): it may keep it, and share it for that purpose with partner child-protection organisations, some outside the UK. The transfer to it is protected by the UK International Data Transfer Addendum to the EU standard contractual clauses (Module One, controller to controller), signed by ArcGabriel Ltd. Some of them are outside the UK; where they are, the transfer is protected as UK law requires.
How long
Your account and Moments last until you remove them. Withdrawing from a Moment takes you out of it for everyone at once. Removing your account deletes it at once from the live service; backups are overwritten within 35 days. Daily marks and security events go after 13 months. Reports and their outcomes are kept for 3 years, because the law may require them.
Your rights
You can see, correct, download or delete what we hold about you, object to some uses of it, and complain to the Information Commissioner's Office (ico.org.uk). Most of this you can do yourself on the You page. For anything else, write to hello@mootstead.com.
Decisions made by machines
A photo may be held back automatically while a person checks it. No decision with a legal or similarly serious effect on you is made by a machine alone; you can ask a person to look again on the Safety page.