Moonlighter Privacy Policy

Last updated: October 12, 2026

Moonlighter is a business organizer for side businesses and small service businesses, sold by Robstrackin. This policy explains what happens to the information you enter.

Your data stays with you

Everything you enter (clients, jobs, invoices, payments, expenses, mileage and subcontractors) is stored on your own device, in your browser. It is not sent to Robstrackin or to any server we run, except the encrypted estimate and invoice links described below. We do not use analytics, ads or tracking.

Optional Google Drive sync

If you choose Connect Google Drive, the app asks Google for permission to use a private app-data folder in your own Google Drive (the drive.appdata permission) and to see your email address so it can show which account is connected. The app saves one file, moonlighter-data.json, in that hidden folder so your devices can share the same records.

The app can only see the file it created in that app-data folder. It cannot see your other Drive files.
The data goes directly between your device and Google. Robstrackin never receives it.
Google's use of your data is covered by the Google Privacy Policy.

Moonlighter's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Estimate signing and invoice links

When you email an estimate for signature or an invoice, the app packs the details (your business info, your client's name and address, the job, line items, and your payment options such as your Venmo or Cash App name) into the link.

Short links. To keep links short, the app first encrypts those details on your device (AES-GCM) and stores only the encrypted copy with our link service at go.getmoonlighter.com. The key that unlocks it is in the part of the link after the # sign, which browsers never send to any server, so neither Robstrackin nor the link service can read it. When your client signs, their signature is encrypted with the same key and left at the link service so your app can pick it up on its own. Encrypted copies are deleted automatically after about 13 months. The service keeps no other record of who opened a link.

If the link service can't be reached, the app uses a longer link that carries everything inside it after the # sign, and nothing is stored anywhere.

Payments are made directly through the payment service your client chooses; Moonlighter never sees or handles payment details. Anyone you share a link with can read it, so send it only to your client.

Removing your data

To delete data on a device, use Backup & Settings › Erase everything or clear the browser's site data. To remove the synced file, open Google Drive on the web, go to Settings › Manage apps, find Moonlighter and choose Delete hidden app data. You can remove the app's access anytime at myaccount.google.com/permissions.

Contact

Questions? Message the Robstrackin shop on Etsy, or reply to your Gumroad receipt email. See also the Terms of Use.