What leaves the platform

Data leaves Moonbrush by two paths: campaign packages and workspace exports. They carry different things and are controlled differently.

Campaign packages

The standard way audiences leave.

• Built on Moonbrush servers.
• Identifiers are SHA-256 hashed (NIST, 2015). Raw emails and phone numbers are never written into a package.
• Each row carries an export-scoped row key, never Moonbrush’s internal person ID.
• People withheld for any reason appear in the manifest only as counts.
• Every package writes a send record before it is returned.

See Delivery for the layout and the hashing rules.

Workspace exports

Members with export rights can download an audience from the workspace as a file.

• The file is assembled in the signed-in user’s browser from records already loaded there.
• It can be downloaded hashed, readable or both. A readable export contains contact details and the Moonbrush ID.
• View-only members cannot export.
• Hashed exports write a send record.

Choose the hashed mode for media

For any destination that matches on hashed identifiers, use a campaign package or the hashed export mode. A readable export is for a client’s own systems, such as its CRM, under the client’s agreement. A hashed email or phone number is a pseudonym, not an anonymous value (Demir et al., 2018); the controls on this page apply to hashed files as well. See research note 5.

Where hashing happens

Path	Where identifiers are hashed
Site tag	In the visitor’s browser, before anything is sent. The collection server refuses any event that carries a raw email.
Opt-out form on moonbrush.com	In the visitor’s browser
Client file uploads	Inside Moonbrush, on intake, after normalization
Campaign packages	On Moonbrush servers
Workspace export, hashed mode	In the signed-in user’s browser

What never leaves in a package

• The Moonbrush ID. Packages and hashed exports carry an export-scoped row key instead. A readable workspace export carries the Moonbrush ID.
• A per-person identifier in any ad link. Links carry an audience-group code and a creative reference only.

Suppression applies to every path

Every export path, enumerated from the code, withholds suppressed people. If the suppression list cannot be read, the export fails closed rather than shipping without it. Suppression includes the client’s own do-not-contact lists, opt-outs and people whose browsers sent Global Privacy Control. See Privacy and permitted use.