MOVA Privacy Policy

1. Who we are and how to contact us

MOVA is an iPhone app, with its own server, built for independent professionals who work while traveling to organize their schedule, clients, trips, finances, and safety.

Data controller (who decides how your data is handled — LGPD (Brazil's General Data Protection Law), art. 9, III):

• Operator: MOVA is operated by an independent developer (an individual). Contact is by the emails below only.
• Support email: suporte@movapro.app
• Email for privacy matters: suporte@movapro.app
• Data protection officer (LGPD): Bruno, the person responsible for MOVA — suporte@movapro.app

This policy explains, in plain language, what data MOVA keeps, why, who it is shared with, for how long, what we never do, and what your rights are.

2. One-minute summary

• We keep on our server what you type into the app to do your work: your account, your clients, your schedule, your trips, and your finances. In normal use, only you (and anyone you authorize) see this data.
• Photos of clients and photos attached to reports never go to our server. They stay only on your iPhone and in your own iCloud.
• Our server and database are in the United States. If you use MOVA in Brazil, your data is sent outside the country (section 7).
• Sign-up, login, password change, and report submission keep your IP address and the time for 6 months and then delete them automatically (section 3.2).
• The history of the numbers you look up stays only on your iPhone and in your iCloud. Our server does not keep which numbers you look up.
• Call and SMS blocking uses a list that stays inside your iPhone.
• We do not sell data, we do not show ads, and we do not track you across other apps or websites.
• Community reports are anonymous to those who look them up. Internally, we know which account wrote each report, only to fight abuse and for moderation (and to comply with court orders). The author cannot delete the report on her own, but can ask for it to be withdrawn (moderation decides); and every report is reviewed after 2 years.
• The Owner (the platform's owner) can open your account to view it, without asking your permission first, when needed (security, support, abuse). Afterward, you see on the Activity screen that support accessed it. Changing data only happens with a ticket you opened. The Owner also has a panel where, for a given user, they see the names and phone numbers of the clients she recorded, always with a written reason recorded at each access (section 11). Everything is logged and the log cannot be deleted.
• You can delete your account inside the app: clients, schedule, trips, hotels, finances, profile photo, sessions, and password reset links are deleted from the server immediately (section 13). The IP record follows the 6-month period, because the law requires keeping it.

3. What data we keep and why

3.1 Your account data (you give it to us when creating the account and in your profile)

3.2 Your session data and access records (automatic)

Access records. The Marco Civil da Internet (art. 15) requires keeping the IP, date, and time of access for 6 months, in confidence. For this reason, the server keeps the IP and time (in UTC) only for the four events above, for 6 months, and deletes them afterward. These records are not used for advertising, profiling, or any other purpose, and are only handed to an authority with a court order (art. 15, § 3). We do not keep the IP on every use of the app. "Login" includes email and password and "Sign in with Apple"; automatic session renewal does not record the IP. The record is written together with the event itself, sits in a table that MOVA's system can only write to (it cannot read, change, or delete; deletion is done by a separate routine, after 6 months), and is not deleted when you delete your account, because the legal obligation is to keep it for 6 months. Legal basis: legal obligation (LGPD, art. 7, II) and regular exercise of rights (art. 7, VI). The hosting providers (section 6) keep their own technical server access records, according to their policies.

3.3 Your work data

Everything you note down to work is kept on our server, tied only to your account, so you can use it on more than one device and not lose anything if you change iPhones:

• Clients: name or nickname, phone (optional), city/region/country, source (website, Instagram, assistant, referral, etc.; the list of sources is yours and you can create and rename them), date of first contact, status (active or blocked), notes. The client's photo does not go to the server (section 5).
• Schedule (appointments): client, date and time, time zone, duration, city, amount, tip, commission, source, status (scheduled, confirmed, completed, canceled, no-show), reminder, and notes.
• Trips: city/region/country, dates, time zone, hotel (name, address, and note), check-in and check-out, transportation, default commission, and notes. The hotels where you have stayed are kept in a list of yours so the app can suggest them on your next trip.
• Finances: expenses and other income (each with description, amount, currency, and date), expense categories you create yourself, and advertising investments by source.
• Notes on appointments: short texts that you and your assistant exchange inside an appointment scheduled through collaboration (section 8).
• Export: you can export a spreadsheet (CSV) of your appointments and entries, with clients' phone numbers only if you check that option. The file is generated on your device and goes wherever you send it; from then on it is your responsibility.

This data is used only to make the app work for you: showing your schedule, your totals by currency, your reports, and your daily summary. MOVA does not analyze this data for other purposes, does not cross-reference it with other accounts, and does not build a global client database: the same phone number in two accounts is two separate records, invisible to each other. The exceptions are described in this policy: what you share with an assistant (section 8), reports (section 9), and administrative access (section 11).

Do not write sensitive data about your clients in notes, descriptions, or category names (health, sexual orientation, religion, racial origin, political opinion, etc.). The law gives reinforced protection to this data (LGPD, art. 5, II, and art. 11) and MOVA was not built to store it.

3.4 Data that stays only on your iPhone (does not go to the server)

• Client photo and photo attached to a report (section 5).
• History of the numbers you look up: stays only on your iPhone and in your iCloud, until you delete a number or everything. The app uses this history to warn "you already looked up this number on <date>", show how many new reports have appeared since then, and indicate when the number belongs to one of your clients. MOVA's server receives the number (as a code) only to answer the lookup and does not keep which numbers you looked up; it keeps only usage counters (section 9). The assistant does not see your history.
• Call and SMS blocking: the numbers you mark as "Blocked" go into a list that the iPhone uses to not ring and to send SMS to the junk folder. This list stays on the iPhone itself (in the app's iOS extensions) and is not sent to anyone. The "Blocked" mark is private to you and is not a report to the community. The app does not block WhatsApp: it opens the conversation so you can block there.
• Appointment reminders: these are local notifications, scheduled on the iPhone itself; the text on the lock screen is only "Meeting at 1:00 PM", with no client name and without the word "appointment".
• Read copy of your data (cache) and queue of changes made offline, so the app opens and works without a network. The server is always the source of truth.
• Session key in the iPhone's secure vault (Keychain), only on this device.
• App lock with Face ID, Touch ID, or passcode (optional; comes turned off, you turn it on): uses the iPhone's system; MOVA never receives or stores biometric data.
• Location when creating a trip ("Use my location"): used on the iPhone only to suggest city, region, and country as text. The coordinates never leave the device.

3.5 Data MOVA does not collect

• Your iPhone's contact list.
• Photos from your gallery other than the one you choose as a profile photo (and client and report photos, which stay only on the device).
• Content of messages, calls, or emails you exchange with clients (the app only opens the other app for you).
• Payment or card data: MOVA does not charge anything and does not process payments.
• Usage data for advertising, behavioral profiling, or cross-app tracking.
• Third-party crash and performance reports: the app does not use any third-party analytics or crash service. If one is added, this section changes first.

3.6 Visits to this website

This website (movapro.app) counts visits in aggregate form: the page visited, the city, state and country (approximated by the network from the internet address, which is not stored), the domain the visitor came from, and whether the device is a phone or a computer. We do not use cookies for visitors, we do not store the IP address, we do not build a profile of anyone, and we do not share these numbers with third parties other than Cloudflare, which hosts the site. These records are deleted after 400 days. This applies to the website only; the app does not send this data.

4. What we use the data for and on what legal basis (LGPD)

The LGPD (Law 13,709/2018, art. 7) requires that each use of data have a "legal basis". Each purpose below has its own.

Legitimate interest, in short: (1) legitimacy — protecting accounts, preventing intrusion and scams, and maintaining a space for reports without abuse; (2) necessity — we keep only a hash of the IP/email to limit attempts, actions with no personal data other than the account code and, in reports, only the comment and the internal authorship; (3) expectations and rights — we describe everything in this policy before use, and none of it is used for advertising or any other purpose; (4) safeguards — append-only log, restricted access, notice to the user after Owner access, and the right to object.

Health data, sex life, and other sensitive data. MOVA does not ask for this data. The content you type in notes and comments is free-form, and for that reason we ask you not to record anyone's sensitive data (section 3.3).

5. Photos of clients and reports: only with you

By product decision, a client's photo and a photo attached to a report are never sent to MOVA's server and are never visible to the community, to assistants, or to the administration. They stay:

• in the app's private space on your iPhone (outside the photo gallery), with iOS file protection; and
• in the app's private space in your iCloud, so they come back when you reinstall the app or change iPhones. iCloud is an Apple service, in your Apple account, governed by Apple's terms.

The photo is reduced in size and loses its metadata (GPS location, device, date) before being stored. Signing out of the account keeps client photos on the device; deleting the account erases client photos from the iPhone, and also report photos, from the iPhone and from your iCloud.

Since a client's photo is third-party data, you are responsible for having a reason to keep it (Terms of Use, section 4). Remember that iCloud is yours: MOVA cannot delete, view, or recover these photos.

6. Who we share with

We never sell or rent your data. We share only with those necessary for the app to work:

There are no other third parties: no ad network, no analytics service, no data broker. The providers above are "processors" and, in the language of US laws, "service providers" or "subprocessors": they handle the data only to provide us the service, under a contract with data protection terms. If we change or add a provider, this list and the notice in section 19 change first.

7. International data transfer

Where the data is. The server, the database, the profile photo storage, and the sending of emails are with providers in the United States (section 6). The reason is that the audience that uses MOVA the most is abroad. MOVA starts out available only in Brazil and the United States.

• If you are in the United States: your data stays in your own country.
• If you are in Brazil: your data is sent outside Brazil. This is an international data transfer (LGPD, arts. 33 to 36, and Resolution CD/ANPD No. 19/2024).

On what basis we make the transfer. The transfer is necessary to perform the contract you asked for (art. 33, IX, combined with art. 7, V): storing your schedule and your clients so the app works. In addition, when creating the account, you receive a clear notice that the data is kept in the United States and you give your specific and prominent consent to this (art. 33, VIII). In the contracts with providers, we adopt the data protection clauses they offer, following the mechanisms of art. 33 of the LGPD: standard contractual clauses where providers offer them, performance of a contract, and specific and prominent consent.

• Country the data goes to: United States.
• What goes: everything the app stores on the server (section 3), the profile photo, and the app's emails. Client and report photos do not go (they stay on your iPhone and iCloud).
• You can ask for information about the transfer and exercise the rights in section 14 as usual.
• For users in the United States and other laws, see section 17.

8. Collaboration with assistants

Each person has their own account; the login is never shared. You decide whether to invite someone, with which permissions, and you can end access whenever you want. A professional can have several assistants, and an assistant can work for several professionals.

What the assistant sees of the professional who invited her:

• The professional's schedule only for the period allowed ("this trip only" or "no end date"). Appointments the professional scheduled herself appear to the assistant only as "Busy 3:00–4:00 PM", with no client name and no amount. She sees and edits the details only of those she scheduled.
• From the trip: city and dates; hotel, address, and transportation are allowed by default ("Trip" permission), and the professional can turn this permission off in the invitation.
• Money: the amounts of the appointments she scheduled (price, tip, commission) and what comes from them. The rest of the finances (general expenses, reports) only with a permission the professional turns on.
• The professional's client list only with the "Your clients" permission, which comes turned off.
• When access ends (the professional ends access, or the "this trip only" period expires), the assistant keeps seeing, read-only, what she herself scheduled (and the hotel of those trips, if she had the permission), so she can collect her commission.
• If the professional deletes her account: her data is deleted immediately, as in section 13, and the assistant stops seeing the schedule, trips, and hotel. The assistant keeps only a commission statement, with: date, city, her client (clients scheduled by the assistant belong to the assistant), and the amounts. Nothing else about the professional (other appointments, other clients, notes, hotels, finances) stays with the assistant. The statement does not identify the professional by name, @, or phone. The statement belongs to the assistant, who is the holder of these records and is responsible for them; it exists only so she can collect what is owed to her.
• If the assistant deletes her account: her clients and data are deleted; the appointments she scheduled stay on the professional's schedule (they belong to the professional), linked to an anonymous account and to the client name that already appeared ("João (via assistant)"), without the hidden phone number.

What the professional sees of the assistant:

• The clients the assistant schedules belong to the assistant (calls come to her number). On the professional's schedule, the client appears with the name only ("João (via Mariana)"), without phone and without notes. The assistant can show the phone number on a specific appointment, if she wants; the professional can then save that client in her own list (it becomes a copy of hers).
• Scheduling done by the assistant shows the professional nothing about reports.

For those who work as an assistant: the professional sees what you scheduled for her. Each professional has a color on your screen (you can change the color; initials and name always appear). You see only the professionals who invited you, and each one does not see the others.

Invitations: by exact @name, or the assistant asks and the professional approves; the search never reveals anyone's email or phone. Inviting and accepting require a confirmed email; the invitation and the request expire in 7 days. There is only one partnership per pair.

Notices: the professional receives a notification when the assistant schedules, changes time/amount/client, cancels, or marks "no-show"; the assistant is notified when the professional changes what she scheduled. On the lock screen the notice uses neutral text ("Mariana scheduled a meeting at 1:00 PM"), without client and without amount. The other actions are on an Activity screen for the last 90 days.

Notes on appointments. Inside each appointment scheduled through collaboration, the professional and the assistant can leave short notes. It is not a free chat.

• What is stored: the text of the note, who wrote it, and the time. The Activity screen shows that a note was left, but the action log does not copy the text (section 12).
• Who sees it: the professional and the assistant of that appointment, while the collaboration is in effect for it. Other assistants of the same professional, regular administrators, and the community do not see it. The Owner sees it only through account access, with a recorded reason (section 11).
• Notice: the lock-screen notification uses neutral text ("Mariana left a note"), without the text, without client name, and without amount.
• When it is deleted: with the appointment it belongs to and, on account deletion, together with the data of the deleted account (section 13).
• Caution: do not write clients' sensitive data in notes (section 3.3). Abusive notes can be reported and lead to account suspension (section 9, "Moderation").

Who is responsible for what: each person is responsible for the data they enter (Terms, section 6). By inviting an assistant, the professional starts to share her data and her clients' data with that person; the professional must have a reason for this.

9. Community reports

The safety module lets you look up whether there are reports about a phone number and submit a report. Reports are about people who generally do not use MOVA — which is why this section matters for them too.

What we keep about a report: a code (hash, made with a server secret) of the phone number, the category (scam, suspicious behavior, identity inconsistency, no-show, false information, other), the comment (required: 10 to 300 characters), the creation date and, internally, which account wrote it. The number's code is still personal data (LGPD, art. 13, § 4: pseudonymized data), because with the secret and the number someone could recreate the code; for this reason it is handled with maximum security and the secret is kept outside the database.

What the person looking it up sees: only the comment and the date (fixed in UTC at creation; never "3 days ago", so as not to reveal the region of the person who wrote it). The category stays only for moderation. The author never appears to the community, nor to assistants, nor to regular administrators. The app presents reports in neutral language ("there are reports associated with this number") and never as proof of anything.

Lookup: it only happens when you tap "Look up number" (in the Look up tab, on the client's page, or in the app icon shortcut). The app never sends your client list to the server. The lookup is by exact number only; there is no listing, partial search, or export. The server keeps only usage counters to limit abuse (about 30 lookups per hour and 100 per day, adjustable) and does not keep which numbers you looked up (the history stays only on your device — section 3.4). The number looked up does not appear in the server's logs.

Who can report: an account with a confirmed email and at least 7 days old, up to 5 reports per day; one report per author per number. Reports from different authors about the same number remain independent and accumulate.

Permanence and withdrawal. Once submitted, the report cannot be edited or deleted by the author on her own. But: (a) the author can ask for her own report to be withdrawn through support, and moderation decides (it withdraws it, for example, if the report was a mistake or no longer makes sense); (b) every report is reviewed after 2 years: moderation checks whether it still makes sense and, if not, it is removed; (c) anyone can ask for removal (below). If you delete your account, your reports remain visible (they are already anonymous) and, internally, are linked only to an anonymous code for abuse control. If the account is suspended, the reports are hidden for as long as the suspension lasts.

Moderation and reporting abuse: any user can mark a report as "Inappropriate report"; there is also an automatic alert for what appears to contain a name, address, contact, insult, or threat. The administrator sees the comment, the category, the date, how many reports the author has made, and the account status, without name or email. Only the Owner can find out who wrote it, and each such lookup is recorded. Accounts that abuse are suspended or terminated. We respond to complaints within 72 hours when there is a threat, data exposure, or serious offense, and within 7 days in other cases.

For the person reported (or anyone mentioned): the phone number is your personal data. You can, at any time, ask for information, correction, or removal of reports about your number by writing to suporte@movapro.app, stating the number. To prevent someone else from asking on your behalf, we will confirm that the number is yours: support sends a code to the number itself (by SMS or WhatsApp) and you reply by email. We review within 15 days and remove what is false, offensive, illegal, identifies someone beyond the number, or violates the Terms. We do not tell the person who reported that you asked for removal, and we do not reveal who wrote it, except by court order.

Responsibility for third-party content. The report is another user's content. MOVA does not verify the truth of reports. Under the Marco Civil da Internet (art. 19) and the interpretation of the Supremo Tribunal Federal (Brazil's Supreme Federal Court), the platform can be held liable if, after being notified, it does not remove unlawful content; that is why the channel above exists and is taken seriously.

The author is anonymous to the community, not to the courts. If a judge orders it, MOVA hands over the data of the account that wrote the report and the access records it has (section 3.2).

10. Safety check-in

Optional feature. When going to an appointment, you turn on a timer and choose a trusted contact, who must also use MOVA and accept this function. If you do not confirm "I'm OK" on time, MOVA notifies that contact through the app itself (no SMS) and the notice carries the starting location (the place you left from for the appointment). The starting location is deleted when you confirm you are OK.

• While the timer runs, the starting location stays on the server (in the United States), only until the end of the check-in. If you do not confirm, the location is deleted 7 days after the notice; the contact sees nothing more once you confirm or the period ends. There is only one contact, who must have a confirmed email and accept beforehand.
• The trusted contact receives your name/@ and the location; for this reason they must accept the function and you should let them know. You can change contacts or turn the feature off whenever you want.
• This feature does not replace emergency services and can fail (Terms, section 7).

11. Administrative access: what the Owner and administrators can see

This section exists because we think you need to know this before trusting your data to MOVA.

The Owner (the platform's owner). The Owner can open any account when needed, without asking your permission first, to view data: profile, schedule, trips, clients, finances, collaborations, notes, reports, and activity. The purpose is support and security: solving a problem you reported, investigating abuse or fraud, or acting on a risk to your safety.

• You see it afterward: each access appears on your Activity screen ("support accessed your account on <date>"). Only if an immediate notice could interfere with the investigation of a crime or an authority's order, the notice may be postponed; this will be an exception and will be recorded.
• Changing data: only with a ticket you opened.
• Log: each opening is recorded (who opened it, when, and why), in an identified access session, and all actions inside it go into the action log, which cannot be deleted or altered (section 12).
• Owner panel: only the Owner sees, for a given user, a summary and the names and phone numbers of the clients she noted in her schedule, so as to know who visited her in case something happens to her. At each access the Owner must write a reason, and the reason is recorded (who, when, which account, why), with no possibility of deletion. Regular administrators do not have this access.

Why this requires care (an honest warning). A user's clients are people who do not know they are in MOVA. Seeing their name and phone is a different use from just storing the data for her, and the law and Apple's rules give special attention to this (LGPD: purpose and necessity, art. 6; Apple 5.1.2(ii)). For this reason:

1. In routine use (support), the Owner does not need to see clients' names and phones and does not open them. The panel only shows clients after the recorded reason.
2. The legal basis is legitimate interest in security and abuse prevention (LGPD, art. 7, IX) and, in case of concrete risk to life or physical integrity, protection of life (art. 7, VII).
3. Each access is a "processing" of yours and of MOVA's: the recorded reason serves to prove, afterward, that there was a purpose. Access without a concrete reason would be abuse.

The Owner is a single person, defined on the server (never through the panel); they create and remove administrators, and an administrator cannot suspend another. The panel requires a second verification (authenticator app code) in addition to the password. When creating the account there is a prominent acceptance of this access (Terms, section 9).

Regular administrators. They handle support, moderation, and tickets. They see the general counts (active users, new users, appointments, trips, reports, tickets) and, for each user, only: @name, display name, account status, sign-up date, and last activity. They do not see email, phone, photo, clients, amounts, notes, or anything about her work. In moderation, they see the report without the author's identity. They can suspend an account, always with a recorded reason; reactivation restores everything.

Support. Through the Help screen (under "More"), you write and the replies appear there. The ticket's content stays on the server and is seen by the support team. No attachments.

12. Action log (audit log)

MOVA records relevant actions: who acted (you, an assistant, or an administrator), what they did (e.g., "signed in", "changed the language", "created an appointment", "deleted the account", "login attempt failed"), on what, when, and a short context, with codes and field names, without copying the content (names, phones, amounts). The log is written together with the action itself and is append-only: MOVA's system does not have permission to delete or alter its rows.

It serves for: security, support, moderation, and proving what was done in the Owner's access sessions. The Activity screen shows you the collaboration's actions for the last 90 days and support's accesses to your account. Retention period: see section 13.

13. How long we keep data and what happens when you delete the account

What happens when you delete the account (inside the app, in More → Settings):

• Immediately: your session on all devices is terminated; email, username, name, phone, profile photo (the file is deleted from storage), password, Apple identifier, country, region, and city are removed or replaced with an anonymous code; the account becomes "deleted". The email is freed immediately; the username stays reserved for 30 days.
• Immediately: clients, appointments, trips, hotels, finances, categories, and sources are deleted from the server. Client photos are deleted from your iPhone.
• Accounts created with "Sign in with Apple": the link with Apple is revoked.
• Collaborations: they end. If the one deleting is the professional, the assistant keeps only the commission statement (date, city, her client, and amounts); the notes and the professional's other data are deleted (section 8). If the one deleting is the assistant, the appointments she scheduled stay on the professional's schedule, linked to an anonymous account.
• Report photos are also deleted from your iPhone and from your iCloud.
• What remains: community reports (anonymous, linked to an anonymous code); the action log (codes, no content); the minimal account row with the anonymous code and the dates, so the action log keeps pointing to something; and the data the law requires us to keep.
• Also immediately: old sessions (including already revoked ones, with device identifier and description) and password reset links are deleted.
• Access records (IP and time) are not deleted on deletion: they leave automatically after 6 months.
• Deletion is immediate and cannot be undone.

14. Your rights and how to exercise them

14.1 Rights (LGPD, art. 18)

You can, at any time: confirm that we process your data and access it; correct incomplete or wrong data; ask for anonymization, blocking, or deletion of unnecessary data or data processed unlawfully; portability; delete data processed with your consent; know who we share with; know that you can refuse consent and the consequences; withdraw consent; object to processing based on legitimate interest; review a decision made solely by automated processing (MOVA does not make automated decisions about you, and the automatic report alert only forwards to human moderation); and complain to the ANPD (Brazil's data protection authority) (www.gov.br/anpd).

14.2 How to exercise them and in how much time

Inside the app: profile and settings (access and correct); "Export my data" in Finances; deleting a client, appointment, trip, expense, or income; deleting the account. Through support: the Help screen or email suporte@movapro.app. We confirm the existence of processing immediately when done through the app, and give the complete answer within 15 days (LGPD, art. 19). We may ask for proof that the account is yours so as not to hand your data to another person. It is free.

Some requests have limits that this policy already explains: submitted reports only leave through the moderation channel (section 9), the action log cannot be altered (section 12), and data shared with an assistant follows section 8. If the law requires us to keep something, we will tell you.

14.3 Data protection officer (DPO)

The LGPD (art. 41) requires the appointment of a data protection officer and the publication of a contact channel. Officer: Bruno, the person responsible for MOVA — suporte@movapro.app. Contact: suporte@movapro.app.

14.4 Your clients and other people mentioned

If you are a client of a MOVA user, or were mentioned in some other way, and want to find out, correct, or delete your data: speak first with the professional (she is the one who decided to note your data and is responsible for it — section 15). You can also write to suporte@movapro.app and we will help forward the request or, when the data is under our responsibility (reports, section 9), handle it directly.

15. Who is responsible for your clients' data

• The clients you register are people whose data you decided to keep. In that case, you are the controller of that data and MOVA is the processor: it stores and organizes it for you, only for you, according to your instructions (LGPD, art. 5, VI and VII, and art. 39). If you use MOVA only for personal and not professional purposes, the LGPD does not even apply to you (art. 4, I); but MOVA was built for professional use.
• MOVA is the controller (decides on its own) of what is in the platform's interest: your account, security, reports, moderation, access records, and the administrative access in section 11.

16. Security, incidents, and backup

• Passwords stored only as an Argon2id hash; blocking of the 10,000 most common passwords; minimum of 10 characters.
• Communication always encrypted (HTTPS, with HSTS).
• Session with a short access key (15 minutes), only in the app's memory, and a rotating renewal key stored in the iPhone's Keychain; reuse of an old key terminates the device's session.
• Limit on login, sign-up, and recovery attempts per IP and per account; failed attempts are logged with an internal alert when above normal.
• Each private piece of data has an owner, and the server checks the owner in all operations; changing an identifier in the request never gives access to another account's data (tested automatically).
• Profile photo checked by the real content of the file, not just by the extension.
• Append-only action log, enforced by the database.
• On the iPhone: Keychain, file protection, and optional lock with Face ID/Touch ID/passcode, with the app's image hidden in the app switcher.
• The server refuses to run against a database from the wrong environment.
• Server and database with providers in the United States (section 6), under a data protection contract.
• Access records (IP): a table that the system can only write to; reading and deletion are handled by a separate, restricted routine.
• Backups: daily, in the United States; deleted data leaves the backups within 30 days (section 13).

No system is 100% secure. If there is a security incident that may cause relevant risk or harm to you, we will notify you and the ANPD within 3 business days after we become aware (Resolution CD/ANPD No. 15/2024), saying what happened, what data was affected, the risks, what we did, and what you can do. We will also keep an internal record of all incidents for 5 years. For users in the US, state data breach notification laws also apply (section 17).

17. Countries and other laws

In the first version, MOVA is offered on the App Store only in Brazil and the United States. The app has five languages (Portuguese, English, Spanish, Russian, and Simplified Chinese), but the language does not determine the law: what determines it is the country where the app is offered and where the users are.

• Brazil: LGPD, Marco Civil da Internet and, for the Terms, the Código de Defesa do Consumidor (Brazil's Consumer Protection Code).
• United States: there is no general federal privacy law. State privacy laws (such as the CCPA/CPRA, of California) apply only to companies above certain revenue or consumer-count thresholds, which MOVA does not reach today; MOVA does not declare itself subject to them at this time and reassesses this periodically. Even so, we give all users, including those in the US, what these laws usually require: to know what data we keep and why, to access and download it (through the app and support), to correct it, to delete it (deleting the account in the app), and to not suffer discrimination for exercising these rights. We do not sell personal data, we do not share it for cross-context behavioral advertising, and we do not use "sensitive personal data" to infer characteristics. If a state law starts to apply to us, this policy will be updated with the required procedure. To make a request: the email in section 20. State data breach notification laws and the federal law against deceptive practices (FTC) apply regardless of size, and we comply with them. For users in the US, the data stays in their own country (section 7).
• Outside this list (European Union, United Kingdom, Russia, China, the rest of Latin America and the world): not offered in the first version. A Brazilian or American user who travels can keep using the app with the account they already have.

18. Minors

MOVA is only for people over 18. People under 18 cannot create an account (Terms of Use). The app is not directed at children or teenagers; for this reason we do not collect their data on purpose. If we discover a minor's account, it will be suspended and the data deleted (LGPD, art. 14).

19. Changes to this policy

When we change this policy, we will notify you in the app and by email before the change takes effect, with the date of the new version. Changes that expand the use of your data only take effect after notice and, when the law requires, your new consent. Previous versions are available upon request to support.

20. Contact

• Support: Help screen in the app and email suporte@movapro.app.
• Privacy and rights, reporting a community report, removal request: suporte@movapro.app.
• This policy is published at https://movapro.app/privacy/ and is accessible inside the app.