Privacy policy

What we collect, and why

The moula extension sends the minimum needed to serve and account for an ad. Each field, and the reason it exists:

• Account API key. Sent as a bearer credential so we know which developer to credit. It resolves to your account id server-side; the key itself is stored only as a one-way hash.
• Event id (request id). A fresh random UUID the extension generates per ad request. It de-duplicates network retries so you are never double-counted, and it ties a later click back to the impression that earned it.
• Impression / campaign ids. Generated on our side to record which sponsored line was shown and clicked. When you open a sponsored link, the signed impression id travels with the click so it can be credited to you.
• Coarse network metadata that any HTTPS request necessarily exposes (timestamp, approximate request source). See the note on IP addresses below.

The complete, field-by-field schema — including signals reserved for future viewability checks that are not collected today — lives in docs/telemetry.md.

What we never collect

moula does not read, transmit, or store your source code, your prompts, your keystrokes, your file names or paths, your open documents, your workspace or project names, your git history, or the list of your other extensions. The extension never asks the editor for any of it, so there is nothing to leak.

IP addresses

We do not keep raw IP addresses. If and when we persist network metadata for abuse prevention, an IP is stored only as a salted, non-reversible hash — never in raw form — so it cannot be turned back into your address or used to track you across services. Our current rate limiting keeps no IP log at all.

Retention

Impression and click records are kept because they are your earnings ledger — they are what lets you (and the advertiser) audit every cent. You can export your own ledger to CSV at any time. If you close your account, we delete your profile and API keys and disassociate your ledger from your identity. API keys are never stored in a usable form: only a one-way hash is kept, so a database leak cannot yield working credentials.

VS Code telemetry setting

moula honors VS Code's global telemetry setting. If you have telemetry turned off (or set to a level below what moula would report), moula treats that as the ceiling and does not send optional telemetry. The ad request itself still needs your account key and an event id to pay you — that is the product, not analytics — but no separate usage telemetry is collected against your wishes.

How to opt out

You can stop all data flow at any time by snoozing moula, enabling presentation mode, clearing your API key, or uninstalling the extension. Opting out simply pauses your earning — it never breaches our Terms, and there is no penalty of any kind for turning moula off.