Privacy Policy

1. Who we are

This Privacy Policy explains how we handle personal data when you visit motionkeyapp.com (the “Site”), buy or use the Motion Key device (the “Key”), or use the Motion Key app (the “App”) — together, the “Services”.

The data controller (and, for US purposes, the business responsible for your personal information) is:

We have not appointed a Data Protection Officer. For any privacy question, contact us at the email above.

“Personal data” / “personal information” means information relating to an identified or identifiable person.

2. Our privacy promise

What you block, and how you sleep, stays on your phone. Which apps and websites you block, your focus sessions, your sleep data, your night audio, and your Key’s tag number are stored locally, not on our servers. We never sell this data, and we never share it with advertisers.

Your night audio never leaves your iPhone, and your Apple Health data is not used for advertising and not stored in iCloud.

The only data that reaches us directly is what you give us when you buy from our store or contact support, plus what our subscription provider needs to keep Motion+ working. Our website separately uses advertising cookies, which you control and can refuse (see Sections 5 and 10).

3. What data we collect

a. Data you give us (store and support)

• Order data: what you bought, your name, email, delivery address, and order history. Payment-card details are handled by our payment provider — we do not store full card numbers.
• Support and communications: messages you send us and their contents.
• Feedback and content: reviews, survey answers, or posts you choose to share with us.

b. Data the App keeps on your device

• Account data: your Motion Key account is stored locally on your device. We do not hold a copy on our servers.
• Usage data: your focus sessions, schedules, modes, streaks, and time spent in focus mode. This is stored on your device (including in a shared app group, so scheduled focus can continue when the App is closed).
• App-blocking data: the record of which apps and websites you block is kept on your device, not on our servers. On iOS, your app selections come from Apple’s own picker and are represented by opaque tokens — by Apple’s design, these cannot be used to identify which specific apps you chose, not even by us. On Android, blocking uses each app’s package name. For websites, the App uses the web address you choose.
• Your Motion Key (NFC): the App reads your Key’s tag number (its serial number) so it can recognise your Key when you tap, and stores that number on your phone only. The App only reads the Key — it does not write anything to it, so the Key itself does not hold your personal data.

c. Health data (Apple Health)

If you use Sleep Tracking on iOS and grant permission, the App works with Apple Health (HealthKit):

• We read your sleep data, including sleep stages, from Apple Health so the App can show and analyse your nights.
• We write the nights the App tracks back to Apple Health as sleep records, so your data stays together in one place.

Health data is used only to provide the sleep features to you, on your device — we do not upload it to our servers, and we never store it in iCloud. We do not use health data for advertising or marketing, we do not sell it, and we do not share or disclose it to any third party. You control this permission in the iOS Health app or in Settings and can withdraw it at any time; the App keeps working without it, minus the sleep features.

d. Microphone and night audio (Sleep Tracking)

When you run Sleep Tracking, the App uses your device’s microphone to measure sound levels during the night:

• All analysis happens on your device. We do not receive a live audio stream.
• With Motion+, louder moments (for example snoring or noise) can be saved as short audio clips stored on your iPhone. You can play them back in the App and delete them whenever you want.
• Audio never leaves your iPhone. Clips are not uploaded to us or to anyone else, and are not used for advertising.

You control microphone access in your device Settings and can turn it off at any time.

e. Data collected automatically

• Website log data: when you visit our Site, our platform records technical data such as your IP address, browser and device type, and timestamps.
• Website analytics data: collected via cookies and similar technologies (see Section 5).
• App diagnostics: Apple and Google may provide us with aggregated crash and performance reports for the App through their developer tools. Our subscription provider receives the purchase data described in Section 5.
• Location: the App does not request access to your device’s location. From website visits we may infer only an approximate region from your IP address.

4. Why we use your data, and our legal bases (GDPR Art. 6 and Art. 9)

This section explains our purposes. For EU/EEA users, the legal bases are shown below; US residents, see Section 10 for your rights.

Where we rely on consent, you can withdraw it at any time (this does not affect processing before withdrawal). Where we rely on legitimate interests, you can object — see Section 9.

5. Cookies, analytics, and SDKs

Website. Our Site runs on Shopify. We use cookies and similar technologies to run the Site, remember preferences, understand usage, and measure our advertising. The tools we use include Shopify’s own analytics (essential to run the store and checkout) and, for advertising and measurement, the Meta (Facebook/Instagram) Pixel, the TikTok Pixel, and Google Ads tags. The advertising and analytics cookies are non-essential and are set only after you give consent through our cookie banner, which you can change at any time in the cookie settings. A full, itemised list of the cookies we use (name, provider, purpose, and duration) is available in that banner or settings. Using these advertising cookies may count as a “sale” or “sharing” of personal information under some US state laws — see Section 10 for how to opt out.

App. The App uses RevenueCat to manage and validate your in-app purchases and subscription status (Apple and Google handle the payment itself). RevenueCat processes data on our behalf such as an app-generated user identifier, your purchase and receipt data, and basic device information, in order to run your subscription. RevenueCat does not receive your health data, your night audio, or your blocked-app data. Apart from RevenueCat, the App does not use third-party advertising or analytics trackers — marketing pixels run on the website only, not inside the App. The App may also send you notifications, for example focus reminders or alarms. If we later add other tools (for example, crash reporting or product analytics), we will list them here and update our app-store privacy disclosures accordingly.

Our cookie banner lets you refuse non-essential cookies, and where it recognises a Global Privacy Control (GPC) signal from your browser, we treat that as an opt-out (see Section 10).

6. Who we share data with

We share personal data only as needed to run the Services:

• Processors / service providers acting on our instructions, under data-processing agreements, including: Shopify (our e-commerce platform and store hosting), our payment service provider, RevenueCat (in-app purchase and subscription management), Meta, TikTok, and Google (advertising and measurement on our website, subject to your cookie consent), our email and marketing provider, and our shipping and fulfilment partner(s).
• App stores (Apple, Google) in connection with app distribution and subscription billing.
• Authorities or third parties where required by law, to respond to lawful requests, or to protect our rights or the safety of others.
• In a business transfer (merger, acquisition, or sale of assets), in which case we will notify you.

We do not sell personal information for money, and we do not share your health data, your night audio, or your app-blocking data with third parties or use them for advertising. Under some US state laws, our use of website advertising cookies may be treated as a “sale” or “sharing” — see Section 10, which explains how to opt out.

7. International transfers

We are based in the EU and aim to keep data in the EU/EEA where practicable. Some of our providers are based outside the EEA (for example, Shopify, RevenueCat, Meta, TikTok, and Google, in the United States or Canada). Where personal data is transferred outside the EEA, we rely on an EU adequacy decision where one applies, and otherwise on the European Commission’s Standard Contractual Clauses (and, where a provider is certified, the EU–US Data Privacy Framework), with additional safeguards where needed. Data that stays on your device — including your health data, night audio, and blocked-app data — is not transferred by us.

8. How long we keep data

• Data on your device (account, sessions, blocked apps, sleep data, audio clips): stays until you delete it in the App, or until you delete the App. You are in control of it.
• Order and payment records: as required by Belgian tax and accounting law (generally 7 years).
• Support messages: up to 24 months after our last interaction, unless a longer period is needed to handle a legal claim.
• Analytics and marketing data: up to 24 months, or until you withdraw consent, whichever is earlier.

When data we hold is no longer needed, we delete or anonymise it.

9. Your rights (EU/EEA and general)

Under the GDPR you have the right to: access your data; rectify inaccurate data; erase data (“right to be forgotten”); restrict or object to processing (including a right to object to direct marketing at any time); data portability; and to withdraw consent where processing is based on consent. We do not make decisions that produce legal or similarly significant effects about you solely by automated means.

For data stored on your device, the fastest route is direct: delete audio clips or sleep data in the App, revoke Health or microphone permission in your device Settings, or delete the App to remove everything. For data we hold (orders, support, marketing), email us at support@motionkeyapp.com. We will respond within one month (extendable by two further months for complex requests) and may need to verify your identity first.

Right to complain. If you are unhappy with how we handle your data, you can lodge a complaint with your local supervisory authority. In Belgium this is the Gegevensbeschermingsautoriteit / Autorité de protection des données (www.gegevensbeschermingsautoriteit.be); in the Netherlands, the Autoriteit Persoonsgegevens. We would appreciate the chance to address your concern first.

10. United States state privacy rights

If you are a US resident, state privacy laws — including the California Consumer Privacy Act as amended by the CPRA, and comparable laws in states such as Virginia, Colorado, Connecticut, Texas, Oregon, and others — may give you the rights below. This section supplements the rest of this policy; where it conflicts with another section, this section governs for US residents.

Categories of personal information. We collect: identifiers (e.g. name, email, IP address, device and account identifiers); commercial information (e.g. products purchased); internet or other electronic network activity (e.g. website usage and interaction data); and information you choose to send us (e.g. support messages). The App additionally processes, on your device only, health information (sleep data), audio (night sound clips), and your blocked-app selections — we do not receive or retain these.

Sensitive personal information. Health information and audio recordings count as sensitive personal information under some state laws. We process them only on your device and only to provide the sleep features you asked for, such as working out your sleep stages and night score. We do not use or disclose sensitive personal information for other purposes, and we do not use it for advertising.

“Selling” and “sharing.” We do not sell your personal information for money, and we do not sell or share your health data, night audio, or app-blocking data. However, when you allow advertising cookies on our website (Meta, TikTok, and Google advertising tools), we share online-activity and device information with those platforms to measure and target ads. Under California and some other state laws, this may be considered a “sale” or “sharing” (cross-context behavioral advertising). We do not knowingly sell or share the personal information of consumers under 16.

Your right to opt out. You can opt out at any time by rejecting or withdrawing consent for advertising cookies in our cookie banner — this turns off the advertising pixels for you and is our opt-out mechanism for any sale or sharing. Where our cookie banner recognises a Global Privacy Control (GPC) signal from your browser, we treat it as such an opt-out.

Your other rights. Subject to identity verification and legal exceptions, you may: know/access the personal information we hold about you; delete it; correct it; obtain a portable copy; opt out of sale/sharing and of targeted advertising; and not be discriminated against for exercising your rights. Some states also let you appeal a decision on your request.

How to exercise your rights. Email support@motionkeyapp.com. We will verify your identity before responding and will respond within the time your state law requires (generally 45 days, extendable where allowed). You may use an authorized agent, with proof of authorization. If we deny your request, you may appeal by emailing support@motionkeyapp.com.

11. Marketing communications

We send marketing only in line with the law and your choices. In the EU/EEA we rely on your consent (or the limited “soft opt-in” for existing customers). In the US we comply with the CAN-SPAM Act for email — every marketing email has an unsubscribe link that we honor promptly. If we offer SMS/text marketing, we send it only with your express consent; message and data rates may apply, you can reply STOP to unsubscribe or HELP for help, and we follow the US TCPA and carrier requirements. You can opt out of marketing at any time; you will still receive service messages you need (for example, security or order notifications). We never use health data or night audio for marketing.

12. Security

We use appropriate technical and organisational measures to protect personal data. Data the App creates stays on your device, protected by your device’s own security (such as your passcode and the operating system’s app sandbox). Data sent to our store and support is encrypted in transit, and access is limited to those who need it. No system is completely secure, so we cannot guarantee absolute security. We will never ask you for your password. Tell us at support@motionkeyapp.com if you notice anything suspicious. If a data breach is likely to affect your rights, we will notify the relevant authority and, where required, you, as the law requires.

13. Children

The Services are not intended for children under 13. We do not knowingly collect personal information from children under 13 without verifiable parental consent (in the US, consistent with the Children’s Online Privacy Protection Act, COPPA). If you are under 18, you may use the Services only with the consent of a parent or legal guardian. If you believe a child has given us personal information without proper consent, contact us at support@motionkeyapp.com and we will delete it.

14. Changes to this policy

We may update this policy. For material changes, we will give at least 30 days’ notice by email or in the App before they take effect. The “last updated” date shows the current version, and we keep prior versions available on request.

15. Contact

For any privacy question or request: