Movut Privacy Policy

Last updated: October 17, 2026 · Version: 3

Movut is an app for moving forward on what matters: your North Star, your goals, your projects and their steps, your habits and your focus sessions. This policy explains, in as much detail as possible and in plain language, what personal data we process when you use the app, the website and our emails, what we use it for, who we share it with, how long we keep it, how we protect it and what rights you have over it.

Summary

If you only read one part, make it this one:

• Your data is yours. No ads, no analytics, no recording of what you do in the app. We don't sell or share your data with anyone for commercial purposes, and we don't build profiles about you.
• You need an account to use Movut. What you write is stored in your account, on a server in the European Union (Ireland), and on your device so the app works offline.
• Photos never leave your device. Neither your goal photos nor your profile photo are uploaded to the server.
• AI is only used when you ask for it. If your iPhone has Apple Intelligence turned on, the suggestion is made on the iPhone itself and nothing leaves it. Otherwise, and only after you give us permission, we send the text of that project or step to our AI provider.
• Crash reports are off unless you turn them on.
• You can export everything or delete your account whenever you want, from the app itself, without writing to us.
• Movut is for adults 18 and over only.

1. What this policy covers

This policy applies to:

• the Movut app for iPhone and, when available, for Android;
• the website movut.app and its subdomains (legal.movut.app and ayuda.movut.app);
• the emails you send us or that we send you (for example, the code to confirm your account or change your password).

It doesn't apply to services from other companies that you use alongside Movut and that have their own policies: the App Store and Google Play (where you download the app and pay for the subscription), Sign in with Apple and Continue with Google, or your email client. We recommend reading their policies too.

2. Definitions

So we all mean the same thing:

• Personal data: any information that identifies you or could identify you, directly or indirectly (for example, your email or the content you write in your account).
• Processing: anything done with personal data: collecting, storing, viewing, syncing, sending or deleting it.
• Controller: whoever decides why and how the data is processed. For Movut, the app's owner (see §16).
• Processor: a company that processes data only on our instructions, to provide us with a service (for example, the server where your account is stored).
• Your content: everything you write or create in the app: your North Star, goals, projects, steps, tasks, habits, reviews and the rest of the items described in §3.2.
• Account: your personal access to Movut, linked to your email, your Apple ID or your Google account.
• Device: the iPhone (or, once available, the Android phone) on which you use the app.

3. What data we process and where it comes from

We only process the data Movut needs to work. You write almost all of it; a few items are generated by the app itself or given to us by Apple or Google when you choose to sign in with them.

3.1 Your account data

3.2 Your content

This is what you write and create when you use Movut, and the history of what you do with it inside the app:

• Your North Star and its previous versions (so you can see how it has changed).
• Goals: name, description, color, icon, what you think will change, how you'll know you've achieved it, and status.
• Projects and steps: name, description, priority, deadline and its extensions, status, the order of the steps, notes and what happened with each one (whether you made progress, completed it or postponed it).
• Habits and challenges: name, frequency, 21-day cycles, the days you marked and, for challenges, how far you got.
• Tasks with their date and reminders.
• Your daily plan, weekly reviews and focus sessions (duration and which step you worked on).
• Preferences: which reminders you want and at what time, the language and the theme.
• Activity history: a log of actions (create, pick for today, make progress, complete, pause…) with their date and time. It's what powers the Progress section.

Your content is stored in your account on our server (EU) and on your device, so the app works offline and syncs when the connection comes back. What you delete inside the app is marked as deleted and kept with its deletion date, so syncing works and so your data export includes it; it disappears completely when you delete your account.

Other people's data you write: if your content mentions other people (for example, "call Ana"), that information is up to you and is only used to show it to you (and, in a shared project, to its members).

3.3 Photos

You can add a photo to each goal and a profile photo. They are stored only on your device, protected by iOS encryption. They aren't uploaded to the server, so they don't appear on other devices and the members of your projects don't see them. Their metadata, including location, is removed when they're saved. We only access the photos you choose; the app has no access to the rest of your photo library.

3.4 Device identifier

Your account can only be open on one device at a time. To know this, the app generates a random identifier for that device and stores it in your account. It isn't the advertising identifier or the hardware identifier, and it can't be used to recognize you outside Movut. If you sign in from another device, the app asks whether to open the account there; if you accept, the new identifier replaces the old one and the session on the other device is closed.

3.5 Shared projects and invitations

If you share a project or join one:

• The members of that project see the project's content (name, description, steps, deadlines and their status) and who completed each step.
• They see your name or, if you haven't set one, the part of your email before the "@", and your role in the project (owner, admin or editor).
• They don't see the rest of your account: not your North Star, goals, habits or other projects.
• To invite someone, a link with a code is created that whoever receives it can use. The link expires and can be revoked.

Each member can leave the project whenever they want, and the owner and admins can remove others.

3.6 Artificial intelligence

Movut's AI has a single use: suggesting steps when you tap "Help me create the steps" or splitting a step when you tap "Split this step." It never turns on by itself.

• With Apple Intelligence: if your iPhone supports it and you have Apple Intelligence turned on, the suggestion is generated by Apple's model inside your iPhone. The text never leaves the device and no connection is needed.
• Without Apple Intelligence: we send our server the text of that project or step (title, description, the goal it serves, the days left until the deadline, the steps that already exist and the language), and the server passes it to our AI provider (see §7). We only do this after asking your permission the first time, and you can withdraw it in Settings › Privacy. Your name, your email, any account identifier, your North Star and anything from other parts of the app are not sent.

In both cases, the suggestion isn't saved automatically: you review it, edit it and decide what stays. Movut doesn't store the text sent or the provider's response.

3.7 Focus Mode and app blocking

During a focus session you can block the apps that distract you. For this we use Apple's Screen Time (Family Controls) feature. The apps you choose are stored on your device as opaque codes that only iOS understands: Movut doesn't know which apps they are, doesn't see how much you use them and doesn't access your Screen Time data. We only know how many you chose, to show it to you.

3.8 Reminders and notifications

Reminders (for example, for your steps or a task) are scheduled on your own device. We don't use a notification server or send your data to anyone to remind you. You only get them if you give the app permission, and you can remove it at any time in your iPhone settings.

3.9 Subscription and payments

Movut is paid for with a monthly subscription through the App Store (and, when available, Google Play). The payment is handled by Apple or Google: we never see your card or payment details. The app only asks the store whether your subscription or trial is active and when it renews, to know what you can do in the app. We don't store that status on our server. If you request a refund from the app, Apple handles it through its own process.

3.10 Age check

The first time you open the app, we check that you meet the minimum age. Where the law requires it, we use the age range Apple shares (not your date of birth); elsewhere, we ask for your date of birth. We don't store your date of birth or your age: only whether you meet the minimum age, when it was checked and where the information came from stay on your device.

3.11 Crash reports

If you turn on "Send crash reports" in Settings › Privacy (it's off by default), when the app quits unexpectedly or freezes we send the report iOS prepares: which part of the code failed, the app version, the iOS version and the device model. It doesn't include anything you write or data that directly identifies you. We only use it to find and fix bugs.

3.12 Technical and security data

When the app connects to our server (when you sign in, sync or ask the server AI for help), the server provider logs technical data such as the IP address, the date and time, the type of request and its result. It's used only to make the service work, for its security and to detect abuse.

3.13 When you write to us

If you write to hola@movut.app (with a question, to exercise your rights or to report content in a shared project), we process your email address and what you tell us, only to reply to you and, for reports, to review them. The email goes through our domain's forwarding service (see §7).

3.14 The movut.app website

The website doesn't use cookies, analytics or trackers, and doesn't load third-party content (the typeface is hosted on the website itself). There are no forms: if you want to know something, you email us. To serve the website, our hosting provider processes the IP address and technical data about the visit (browser, page requested), only to deliver it to you and protect it from attacks.

3.15 What we don't collect

• We don't ask for sensitive data (health, religion, political views, sexual orientation, ethnic origin…). If you decide to write something like that in your content (for example, a habit such as "take my medication"), it's only used to show it to you and sync it, never to build profiles or for anything else.
• We don't access your contacts, location, microphone or camera.
• We don't use the advertising identifier or track you across apps or websites.
• We don't do usage analytics or record your sessions in the app.

4. What we use your data for

We only use your data for these purposes:

1. Providing the service: creating and maintaining your account, storing your content, syncing it between the app and the server, showing it to you and making the app work offline.
2. Keeping your account open on one device only and protecting your access.
3. Sharing projects with the people you choose.
4. Suggesting steps with AI, only when you ask.
5. Blocking apps during a focus session, if you choose to.
6. Reminding you of what you've decided (steps, tasks, reviews).
7. Managing your subscription and knowing what you can do in the app.
8. Checking the minimum age to use Movut.
9. Fixing bugs, if you turn on crash reports.
10. Keeping the service secure and preventing abuse.
11. Sending your account emails (confirmation and password reset codes).
12. Helping you when you write to us and reviewing content reports.
13. Complying with the law and responding to authorities when we're required to.

We don't use your data for advertising, commercial profiling or any purpose other than the above. If we ever wanted to use it for something else, we'd tell you first and, where the law requires it, ask for your permission.

5. Legal basis for each purpose

Where the basis is legitimate interest, we've checked that it doesn't override your rights: the data is minimal, technical and necessary for the service to be secure. You can object by writing to us (see §11).

6. Automated decisions and profiling

We don't make automated decisions that produce legal effects on you or significantly affect you, and we don't build profiles. The app's suggestions (for example, "this step has been open for a while") and the Progress metrics are calculated with simple rules, on your device, and only you see them. AI suggestions are just that, suggestions: you always decide what gets saved.

7. Who we share your data with

7.1 Processors

Companies that process data only on our behalf and following our instructions, under a contract that obliges them to protect it (Art. 28 GDPR):

• Supabase (database, accounts, sync and server functions). Data is stored on servers in Ireland (EU). Supabase Inc. (USA) and its sub-processors may access it to operate the service and provide support, under the European Commission's Standard Contractual Clauses included in its data processing agreement.
• Anthropic Ireland, Limited (artificial intelligence, only without Apple Intelligence and with your permission). Processes data in the USA, under Standard Contractual Clauses. It only receives the project or step text, without your name or email. It deletes requests and responses after 30 days (unless a usage policy violation or a legal obligation requires keeping them longer) and doesn't use them to train its models.
• Brevo (France), to send your account emails (the code to confirm your account and the one to reset your password). It processes your email address in the EU and only to send you those messages.
• Cloudflare (hosting of the movut.app website and forwarding of the emails you send to hola@movut.app). It processes the IP address of website visitors and the emails we receive, only to deliver them and protect the service. Cloudflare, Inc. (USA) may process them outside the EU, under Standard Contractual Clauses.

7.2 Independent controllers

Companies that decide for themselves about the data they process, under their own policies:

• Apple: App Store, payments and subscription, Sign in with Apple, the age range, Apple Intelligence (which runs on your device) and Screen Time.
• Google: Continue with Google if you choose it and, when available, Google Play and its payments.

7.3 Other people

The members of the projects you share see what's described in §3.5.

7.4 Authorities

We only disclose data to authorities, judges or courts when a law requires it, and only to the minimum extent necessary.

7.5 Change of ownership

If Movut passed to another person or company (for example, because a company is set up to run it), your data would go to them so they can keep providing the service under the same conditions. We'd let you know beforehand.

We don't sell or "share" your data (including in the sense of US privacy laws), and we don't give it to anyone for their own purposes.

8. International transfers

We store your account and content in the European Union. Some providers may process data outside it: Supabase and Cloudflare to operate and provide support, and Anthropic when you use the server AI. In every case they do so with appropriate safeguards: the Standard Contractual Clauses approved by the European Commission and, where applicable, additional security measures. For the server AI, we also only send the text with your explicit consent. You can ask us for a copy of these safeguards by writing to us.

9. How long we keep your data

After these periods, the data is deleted or anonymized so it can no longer identify you. We'd only keep it longer if a law required it or to defend ourselves against a claim, and blocked from any other use.

10. How we protect your data

• Encryption in transit: all communication between the app, the website and our servers is encrypted (HTTPS/TLS).
• Encryption at rest: our server provider encrypts stored data. On your device, your data and photos are protected by iOS encryption, and your session is stored in the system keychain, never in plain text.
• Access only to what's yours: on the server, each record is protected by rules that only let its owner read it (and, in a shared project, its members). Not even the app can read other accounts' data.
• Passwords stored irreversibly by the account service; confirmation and reset codes that expire after one hour.
• One device per account, so your account isn't open in places you don't control.
• Provider keys (such as the AI key) stored only on the server, never inside the app.
• Minimal internal access: only Movut's owner can administer the server, and they don't look at account content unless you ask for help or a law requires it.

No system is infallible. If there were a security breach affecting your data, we'd notify the data protection authority within 72 hours of becoming aware of it and, where it poses a high risk to you, we'd tell you without undue delay, explaining what happened and what you can do.

11. Your rights

You have these rights over your personal data:

• Access: to know whether we process your data and get a copy. You can do it yourself by exporting your data.
• Rectification: to correct inaccurate data. You can change almost all of it directly in the app.
• Erasure ("right to be forgotten"): to have your data deleted. You can delete your account in Settings › Data.
• Objection: to object to processing based on legitimate interest.
• Restriction: to ask us to stop using your data while a complaint is resolved.
• Portability: to receive your data in a structured, machine-readable format (the export is a JSON file) and take it to another service.
• Withdraw your consent whenever you want (for the server AI or crash reports), without affecting what was done before.
• Not to be subject to automated decisions with significant effects (we don't make them, see §6).
• Complain to a data protection authority (see "Additional information by region").

Exercising your rights is free, and we won't treat you differently for doing so.

12. How to exercise your rights

1. From the app, without writing to us: export your data (Settings › Data › Export my data), delete your account (Settings › Data › Delete account), withdraw AI permission and turn off crash reports (Settings › Privacy), and edit your profile.
2. By email: for any other right, write to hola@movut.app from your account's email address, saying which right you want to exercise. If we can't confirm the account is yours, we may ask for the minimum needed to verify it.
3. Without the app: if you no longer have it, ayuda.movut.app/en/delete-account explains how to ask us to delete your account.

We reply within the shortest period set by the law of your country and, at most, within one month. If the request is complex or there are many, the period may be extended by two more months; we'd tell you within the first month. If we don't fulfill it, we'll explain why and how to complain.

13. Minimum age

Movut is for adults 18 and over only. We check your age the first time you open the app (see §3.10) and don't store your date of birth or your age. We don't knowingly collect data from minors; if we learn an account belongs to a minor, we delete it. If you think a minor is using Movut, write to us.

14. Links to other services

The app and website may link to services from other companies (for example, the App Store, Google Play or Apple's subscription management). When you open them, their own privacy policies apply, not this one.

15. Changes to this policy

We may update this policy when the app, the law or our providers change. The date at the top shows the latest version. If the change is significant, we'll let you know in the app before it applies and, where needed, ask for your consent again. Previous versions are available on request.

16. Controller and contact

The controller of your data is:

• Owner: Gabriel Jesús Alcarra Bolívar
• Tax ID (NIF): 60435962N
• Address: Calle de Tucán 36, 4.º B, 28025 Madrid (Spain)
• Email: hola@movut.app (for anything related to your data)

We haven't appointed a data protection officer because it isn't required for processing like this. If you have any questions about this policy or your data, write to us and we'll reply.

Additional information by region

European Union and Spain

You can complain to the Spanish Data Protection Agency (www.aepd.es) or to the data protection authority of the EU country where you live or work, or where you think the infringement took place. We'd appreciate it if you wrote to us first: almost everything gets solved that way.

United States

• We don't sell or share personal information for advertising, or use it to profile you. There are no third parties collecting data about your activity in the app or across sites.
• "Do Not Track" and Global Privacy Control: the app doesn't track across sites or apps and our website doesn't use trackers, so there's nothing for those signals to turn off.
• You can know what data we have, access it, correct it and delete it, and we won't treat you differently for exercising your rights. If we deny a request, you can appeal by replying to our answer.
• Categories of data (under California and similar laws): identifiers (email, account and device identifier), information you write in the app, technical information (IP) and, only if you turn them on, crash reports. Sources: you, your device, and Apple or Google if you sign in with them. We don't use any "sensitive personal information" to infer characteristics about you.
• Consumer health data (Washington, Nevada, Connecticut): see the Consumer Health Data Privacy Policy (Consumer Health Data Privacy Policy).
• Children (COPPA): the app isn't directed at children under 13 (or under 18) and doesn't knowingly collect their data.

Mexico, Colombia, Argentina, Chile and the rest of Latin America

See the Spanish version (política en español), which includes each country's specific information (ARCO rights in Mexico, response times in Colombia and the authority in each country).