Privacy Policy
MoveD is a social app for sport. It only works with some of your data – your workouts, your photos, your messages – so here is, in plain language, what we collect, why, where it is stored and what you can do about it. This policy follows the EU General Data Protection Regulation (GDPR).
1. Who is responsible
This is the "controller" in the sense of the GDPR. For anything about your data, write to the address above.
2. What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Account: email address, password (stored hashed), account ID | To create and secure your account and sign you in | Contract (Art. 6(1)(b) GDPR) |
| Profile: name, username, profile photo, town, sports, goal, privacy settings | So friends can find and recognise you | Contract |
| Workouts: sport, date, duration, distance, pace, calories, average heart rate, source device – read from Apple Health (iOS) or Health Connect (Android), or recorded with MoveD's own GPS tracker | To show you your workouts in your inbox and, only if you choose to share one, to post it | Your explicit consent (Art. 9(2)(a) GDPR – health data). You give it by connecting Apple Health / Health Connect or by starting a recording, and you can withdraw it at any time (see section 6). |
| GPS route of a run or ride (a simplified line of location points), and your live location while you record with MoveD | To draw the shape of your route on your post and on the map while recording | Your explicit consent (location permission on your phone) |
| Photos and videos you add to posts, stories or chats | To show them where you put them | Contract |
| Posts, stories, comments, props, tags, sessions, chat messages, voice messages | That is the app: sharing with the people you chose | Contract |
| Push notification token (a technical ID from Apple/Google for your device) | To notify you of messages, props, comments, tags and new followers | Consent (notification permission on your phone) |
| Reports and blocks: whom you reported or blocked, the reason you chose and what you wrote | To review reported content within 24 hours and keep blocked people apart | Legitimate interest (Art. 6(1)(f) GDPR) in a safe community – reports are never shown to the person reported |
| Technical data: IP address, device type, app version, crash reports | To keep the service running and fix errors | Legitimate interest (Art. 6(1)(f) GDPR) in a working, secure app |
3. What we do not do
We do not sell your data. We do not show ads and do not use advertising trackers. We do not post anything automatically: a workout detected on your phone stays private in your inbox until you share it. Your week/month/year totals can be hidden from others in your profile settings.
4. Who sees what
Other MoveD users see your profile, your shared posts, stories (for 24 hours), comments, props and tags. Sessions and chat messages are visible only to their participants. Nobody sees the workouts in your inbox, the ones you marked private, or the private activity list (who gave you props, who followed you) – that list is yours alone.
5. Where your data is stored – service providers
We use a small number of providers that process data on our behalf under data processing agreements:
| Provider | What for | Where |
|---|---|---|
| Supabase Inc. | Database, file storage (photos, videos, voice messages, map images), sign-in | Data centre in the European Union (Frankfurt, Germany) |
| Expo (650 Industries, Inc.) | Delivering app updates and relaying push notifications to Apple and Google | USA – transfer safeguarded by the EU standard contractual clauses in Expo's terms; only the push token and the notification text pass through |
| Apple Inc. / Google LLC | Apple Health, Health Connect, Apple Maps, push delivery, app distribution | Health data is read on your phone; Apple and Google act under their own privacy policies |
Apple Health and Health Connect data is read on your device. Only the workouts you see in the app (the summary numbers and, if available, the route line) are stored on our servers. We never write to Apple Health or Health Connect, and we never use health data for advertising, as required by Apple's and Google's health data rules.
6. Your rights and your controls
Under the GDPR you can ask for access to your data, correction, deletion, restriction, portability, and you can object to processing based on legitimate interest. You can also complain to the Luxembourg data protection authority, the CNPD.
Most of this you can do yourself in the app:
- Delete your account – Profile › Edit profile › Delete account. Your profile, workouts, posts, stories, comments, chats and files are deleted for good, immediately.
- Delete a post, story or comment – from its ⋯ menu.
- Withdraw health access – iPhone: Settings › Privacy & Security › Health › MoveD. Android: Health Connect › App permissions › MoveD. Already imported workouts stay in the app until you delete them or your account.
- Location – stop a recording at any time; revoke the permission in your phone's settings.
- Notifications – switch off in your phone's settings, or mute single chats in the app.
7. How long we keep data
As long as your account exists. Stories disappear from the app after 24 hours (you keep a private archive you can clear). View-once photos in chats can be opened once per recipient; the file itself stays with the conversation until the message, the conversation or your account is deleted. When you delete your account, everything is removed immediately; server backups are overwritten within 30 days.
8. Children
MoveD is for people aged 16 and over. We do not knowingly collect data from younger children; if you believe a child has created an account, write to us and we will delete it.
9. Security
All traffic is encrypted (TLS). Access to the database is restricted per user by row-level security, so you can only read what you are allowed to see. Passwords are stored hashed.
10. Changes
When this policy changes, we update the date at the top and, for important changes, tell you in the app.