Privacy Policy
Movd is built on a single privacy belief: the data about your body belongs to your body. This policy explains, in plain language, what we collect, where it lives, and what we will never do with it.
The short version: Your health data — workouts, heart rate, sleep, recovery — is read from Apple Health and scored entirely on your iPhone. Raw health data is never transmitted to us, never stored on our servers, and never sold. Ever.
Who we are
Movd (“Movd,” “we,” “us”) is a fitness motivation app for iPhone and Apple Watch, currently in private beta. We are the data controller for the limited personal data described below. You can reach us any time at hello@movd.day.
This policy covers both the Movd app and this website (movd.day), including the beta signup form.
What we collect
We deliberately collect as little as the product allows. Here is the complete list.
Your email address and three screening answers (whether you were a competitive athlete, whether you've abandoned a fitness app recently, and whether you own an iPhone). Used only to send your beta invite and select the test cohort.Stored: Supabase (EU/US region)
If you create an account, your Apple Sign-In identifier (and the relay email Apple provides). An account is optional and only required for push notifications and cross-device backup.Stored: Supabase
A device push token, only if you enable notifications, so we can deliver the small set of supportive nudges you opt into.Stored: Supabase
Your streak count, shield history, season progress, and milestones — so they survive a phone replacement. This is derived state, not raw health data.Stored: Apple iCloud (CloudKit private database)
Workouts, active energy, heart rate, heart-rate variability, and sleep from Apple Health — read with your explicit permission and processed on-device only.Stays on your device · never sent to us
Privacy-friendly, aggregate usage metrics for this website and the app (e.g. a signup completed). No cookies, no cross-site tracking, no advertising identifiers.Vercel Analytics — aggregated
Your health data stays on your device
This is the part that matters most, so we'll be explicit. When you grant Movd access to Apple Health, the app reads your activity data and computes your daily Effort Score, streak, and quests locally on your iPhone. The computation uses Apple's HealthKit framework and runs in the app's own secure storage on the device.
- We do not upload your HealthKit data to our servers.
- We do not store your heart rate, HRV, sleep, or workout details anywhere we can read them.
- What syncs to the cloud is only the outcome — your streak and season state — and that goes to your own private Apple iCloud, not to us.
- You can revoke Health access at any time in iOS Settings → Health, without losing your account.
Because scoring is on-device, the core of Movd keeps working with no network connection at all.
Where your data lives
On your device
Your workout credit log, score history, streak and shield state, quest progress, and milestone records live in app storage on your iPhone. Deleting the app deletes this data.
Apple iCloud (CloudKit)
Streak, season, and milestone state are backed up to your personal iCloud private database so they restore on a new device. We can't read your iCloud private data; Apple manages it under Apple's own privacy terms, including EU data residency.
Supabase
Our backend holds only the minimal account-and-messaging data above — auth identity, push tokens, beta signups, and the season/quest copy definitions the app downloads. It never holds raw health data.
How we use what we collect
- To send your beta invite and choose a balanced first cohort (signup data).
- To run your account — sign-in and restoring your streak across devices (account identity, CloudKit state).
- To deliver notifications you opt into — the small, forward-facing nudge set (push token).
- To improve the product using aggregate, non-identifying usage trends (analytics).
Our legal bases (where the GDPR/UK GDPR applies) are your consent (Health access, marketing-style invites, notifications) and our legitimate interest in operating and improving a service you asked to join. You can withdraw consent at any time.
What we never do
- We never sell, rent, or trade your personal data.
- We never transmit your raw Apple Health data off your device.
- We never use advertising trackers, third-party ad pixels, or cross-site cookies.
- We never share your data with data brokers, insurers, or employers.
- We never make medical or health claims about you — Movd frames activity, it does not give health advice.
Analytics & cookies
This website uses Vercel Analytics, which measures page views and a small number of product events (such as a completed signup) without cookies and without collecting personally identifying information. That's why you won't see a cookie banner — we don't set tracking cookies. We may use a single essential, non-tracking cookie or local value only where strictly required for the site to function.
Your rights & choices
Depending on where you live (including the EU/UK and California), you have some or all of these rights:
- Access — ask what personal data we hold about you.
- Correction — fix inaccurate data.
- Deletion — have your data erased (see below).
- Portability — receive your data in a portable format.
- Objection / withdrawal — opt out of notifications or withdraw consent at any time.
To exercise any of these, email privacy@movd.day. We don't sell data, so there is nothing to opt out of on that front — but we honor “do not sell/share” requests as a matter of policy.
Retention & deletion
We keep account data only while your account is active. When you delete your account, we remove your Supabase records and push token, and your CloudKit records are deleted, within 24 hours. Beta signup emails are kept until the beta ends or you ask us to remove them, whichever comes first. On-device data is deleted whenever you delete the app.
International transfers & age
We are based in the United States and use service providers that may process data in the US and EU. Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses. Apple manages residency for the iCloud layer.
Movd is not directed to children. You must be at least 16 years old to use Movd (or older where your country sets a higher age of digital consent). We do not knowingly collect data from anyone under that age.
Changes to this policy
As Movd moves from beta to public launch, this policy will be reviewed by counsel and may change. When it does, we'll update the effective date above and, for material changes, notify you in the app or by email. Continuing to use Movd after a change means you accept the updated policy.
Contact
Questions about your privacy, or want to exercise a right? Email privacy@movd.day or write to Movd, Lake Oswego, Oregon, USA. We read everything.
See also our Terms of Service.