Simon Morley · last updated 19 October 2026
A few people have asked me how safe it is to keep a mood diary on your phone, and what happens when you share it with your doctor. This is my attempt to explain it in plain English. Where I use a technical word, I explain what it means.
The short version: your diary is kept on your phone, and in your phone’s own backup if you have one. If you choose to share it with a doctor, it is locked before it leaves your phone, and only the person holding the link can unlock it. Not even I can read it.
When you fill in Moomoni each evening, your answers are saved on your phone. They are never sent to me, to the Moomoni website or to anyone else.
You don’t need an account to use Moomoni. You don’t give me your email address or a password, and you don’t even have to give your name. If you type your name in Settings, it is only used to put at the top of your own reports.
Very little. Once a day, when the app is opened, it sends a single anonymous tally to the Moomoni website. Think of the clicker a steward uses to count people coming through a door: it counts heads, it doesn’t take names.
The tally says only:
It never includes your answers, your name, or any code that could tell your phone apart from anyone else’s. Two tallies from the same phone on different days can’t be matched up. You can switch the tally off in Settings.
Why count at all? Simply to understand how many people are using Moomoni, and for how long. That tells me whether the research side of Moomoni, described below, is worth pursuing. That is all the tally is for, and counting heads is the only way to find it out without knowing who anyone is.
The app also checks now and then whether a newer version is available. That is all. There are no adverts, no tracking companies, and nothing is ever sold.
The Moomoni website runs on computers owned by a company called Cloudflare. A lot of the internet runs this way: rather than owning my own computers, I rent space on theirs. A computer that holds a website like this is called a server.
Cloudflare is a bit like a sorting office. It handles the delivery of messages to and from the Moomoni website. Like any delivery service, it can see where a message came from, in the form of an internet address (a number that identifies a connection, rather like a postmark). The Moomoni website doesn’t record these addresses. The only exception is a short-lived, scrambled version used to stop someone creating thousands of links at once, and that is thrown away after two days.
If you want to, you can give your doctor a private link to your mood report. It updates by itself whenever you fill in the app, so your doctor always sees the latest version.
The best way to picture it is a locked box and a key.
You can switch the link off at any time in Settings. That deletes the box from the server straight away, and the link stops working. Reports that haven’t been updated for 400 days are deleted automatically.
The page your doctor sees has a coloured strip at the top saying when the report was last updated, and it turns amber and then red if it is getting old, so nobody mistakes an old report for a current one.
You can also make a link that works once only. As soon as it is opened, the report is deleted from the server, and anyone who tries the link again is told it has already been used. A one-time report hides the buttons for saving and printing. It can’t stop someone taking a photo of the screen, and it doesn’t pretend to.
You can ask one person close to you to be your buddy: now and then they say, on a web page, how your mood has seemed to them, with a note if they like. You invite them by sending them a link from the app, once, by any means you choose. The link carries a key; your phone and their page both work from that key, and what they write is scrambled on their phone and unscrambled only on yours. Moomoni’s server holds the scrambled observations for at most a week until your app collects them, and the scrambled form of your buddy’s name. It never holds the key and cannot read any of it.
Your buddy never sees your diary, your chart or anything about you through that page, and is not told when you open the app. You can pause the connection without them knowing, or end it, at any time; the app’s Clinician tab has the switches. Their observations stay on your phone, are shown on your own chart if you want, and go with a chart you share only if you turn that on; it is off to begin with.
If you set up reminder emails for your buddy, their address stays on your phone. When one is due, your phone asks the server to send it; the server sends that one email and does not keep the address. Every reminder has a link to stop them, and if your buddy uses it the server keeps a scrambled form of their address so it will not write to them again. The reminder says nothing about you.
This is not a way to get help. What a buddy writes is read when you next open the app, and nobody else sees it. The buddy’s page says so, and says where to turn if they are worried about your safety now.
For an appointment there is a simpler way than a link: the app shows a ten-character code in two groups of five, you read it out, and your doctor types it in at moomoni.com/view. The chart opens on their screen and the code is then deleted: it is designed to work once.
The code is not a password that the server checks. Your phone turns the code into both the name a small locked box is stored under and the key that opens it, using a deliberately slow calculation, and the server receives only the box. The box holds nothing but the address and key of a one-time chart, which is itself locked with a key as strong as any link’s. Your doctor’s browser does the same calculation from the code you read out, asks for the box by that name, and unlocks it on their screen. The code itself is never sent anywhere.
A code lives for one minute and works once. The server limits wrong guesses from any one connection, from any one network, and overall, so guessing online is not practical in the time available. To be clear about the limit: someone who obtained a copy of the box from the server during its minute of life could try codes against it offline. With the six-digit codes used until October 2026 that was feasible within a minute on one graphics card, which is why they were replaced; a ten-character code has about six hundred million million possibilities and the same card would need centuries. If a code is not used in the minute, the box is simply deleted. If your doctor wants to keep looking after the appointment, the page they see offers to copy the full link or email it to themselves; both of those carry the key, so the same care applies as for any link.
Because the key is inside the link, anyone who has the whole link can read your report. Treat it like a house key.
Since this page was first written the app has grown, so here is what each addition keeps and where it goes.
Moomoni can also make a PDF, an Excel spreadsheet, a report file and a backup file. These are ordinary files, like a photo or a letter. Once you send one, it is as private as wherever you put it.
If you’d like to know more, tap the Research button in the Moomoni app. It explains why I’m excited that Moomoni might one day become an amazing resource: a way for people like me to use our mood monitoring data to understand mood disorders better, and to help each other.
You are in control of all of it from the app: back up, restore, delete every entry, switch the backup and the daily tally off, and switch any clinician link off. Because the server only ever holds reports it cannot unlock, and keeps no record of who made them, I can’t look up, correct or hand over anyone’s diary. Only you can.
If you have any questions, email me at hello@moomoni.com.
Simon