Privacy Policy

DesignSpark Studio LLC ("we," "our," or "us"), an Ohio limited liability company, operates the MoveTogether mobile app and the website at https://movetogetherfitness.com (together, the "Service"). MoveTogether is a social fitness app: you track your activity, compete with friends, climb leaderboards and leagues, and get coaching from our AI coach, Mo.

This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices and rights you have. Because MoveTogether works with health and fitness data, please read Sections 1, 4, and 8 carefully.

By creating an account or using MoveTogether, you acknowledge and agree to this Privacy Policy, including as it is updated from time to time as described in Section 10. If you do not agree, please do not use the Service.

---

1. Information We Collect

Information you provide directly

• Account information. Email address, display name, and username. If you sign in with Apple, you may use Apple's Hide My Email relay address.
• Profile information. Optional bio, profile photo (avatar), your date of birth (used to confirm you meet our minimum age requirement and to tailor features), and fitness details you enter such as gender, age, height, current weight, and goal weight. We keep a history of weight entries to show progress over time.
• Phone number. If you choose to verify your phone number, we collect it (in E.164 format), the time and your IP address and device/browser at the moment you opted in (as a consent record), and the verification status. Verification is handled by SMS.
• Contacts (optional). If you grant contacts access to find friends, we use the phone numbers in your device contacts to match people who already use MoveTogether. We use them only for matching and do not store the contact details of people who are not MoveTogether users.
• Content you create. Messages you send in direct messages, competition group chats, and communities; your conversations with Coach Mo; reports you submit about other users or content; and other content you add to the Service.
• Voice. If you use voice features (such as talking to Coach Mo on Apple Watch or our voice support assistant), we capture and process your microphone audio to power the conversation, and we store transcripts of it. Audio is processed by our voice AI provider through a secure relay (see Section 4). We do not use your voice to create a biometric identifier or to identify you, and we do not sell voice data.
• Location. With your permission, we collect your approximate or precise location to provide location-based features such as local weather insights. We store your most recent location and share it with our weather provider to generate those insights. Location is collected only while you use the app, and you can turn it off in your device settings.
• Support requests. When you contact us (through the in-app support chat, through Mo on our website, or by email), we collect your messages and the information needed to help you.
• Waitlist sign-ups. If you join a waitlist on our website (for example, our Android waitlist), we collect your email address to notify you and send related updates.

Health and fitness data

With your permission, MoveTogether reads health and fitness data from Apple Health (HealthKit) and from any wearable or fitness account you connect. This may include:

• Steps, active energy / calories burned, resting and basal energy, exercise minutes, and Apple Activity ring / summary data
• Workouts, including type, duration, and distance
• Heart rate, resting heart rate, heart rate variability (HRV), and VO2 max
• Sleep analysis
• Body mass / weight
• From connected wearables (Fitbit, Garmin, WHOOP, Oura, Strava, Polar, and Google Health), the comparable metrics above plus, where available, blood oxygen (SpO2) and respiratory rate

We use this data to power your rings, streaks, scores, leaderboards, competitions, and AI coaching. Some of this data syncs automatically in the background so your stats stay current. We treat health and fitness data as sensitive. We do not sell it, and we do not use it for advertising.

Information collected automatically

• Usage and product analytics. We use analytics tools (including Mixpanel, Pendo, and PostHog) to understand how the app is used, such as which features you use, screens you view, and session length, so we can improve the Service. The specific tools depend on the version and platform of the app you use.
• Session replay. We may record app interactions to help us diagnose problems and improve usability. We configure masking for sensitive fields where supported.
• Diagnostics. Crash logs and performance data (via Sentry) to help us find and fix bugs.
• Attribution and marketing measurement. We use AppsFlyer to understand how people discover MoveTogether and how our marketing performs. Depending on your choices in the App Tracking Transparency prompt, this may involve device and advertising identifiers. You can decline tracking in that prompt and change it later in your device settings.
• Device information. Device model, operating system version, app version, and network and device characteristics.
• Cookies and website storage. Our website uses a small number of cookies and similar storage, such as essential session/security storage and cookieless analytics. See our Cookie Policy for details. The mobile app does not use browser cookies; in-app analytics and attribution are described above and governed by your App Tracking Transparency choice.

Information from third parties

• Sign in with Apple. If you sign in with Apple, we receive your Apple ID and, if you choose to share it, your name and an email address (which may be a private relay address).
• Sign in with Google. If you sign in with Google, we receive your Google profile name and email address.
• Connected wearables and fitness services. When you connect a wearable or fitness account, we receive the activity and health metrics listed above from that provider on your behalf.
• App stores and payment providers. Apple, our subscription manager (RevenueCat), and our web payment processor (Stripe) tell us your subscription and entitlement status so we can unlock features.

What we do not do

• We do not display third-party advertising inside the app.
• We do not sell your personal information.
• We do not use your health and fitness data for advertising.

---

2. How We Use Your Information

We use the information we collect to:

• Provide MoveTogether's core features: activity tracking, rings, streaks, scoring, friends, competitions, leagues, leaderboards, communities, and direct messages
• Generate AI coaching, weekly reports, and personalized notifications through Coach Mo (see Section 4)
• Verify your phone number and protect account security
• Help you find friends who already use MoveTogether (contacts matching, with your permission)
• Send push notifications and service messages you have not turned off
• Process subscriptions
• Provide customer support
• Understand usage and measure how our marketing performs so we can improve the Service
• Detect, prevent, and address fraud, abuse, cheating, and violations of our Terms or Acceptable Use Policy
• Comply with legal obligations

We do not use your information to make solely automated decisions that produce legal or similarly significant effects on you.

---

3. How We Share Your Information with Other Users

MoveTogether is social, so some information is shared with other users by design:

• Public profile. Depending on your privacy settings, your username, abbreviated name, avatar, bio, subscription status, and fitness signals such as current and longest streak, ring progress, rings-closed counts, competition points, and achievements may be visible to others.
• Friends. People you add as friends can see your activity and ring progress and may see you in shared activity feeds.
• Competitions, leagues, and leaderboards. Your rank, points, and identity are visible to other participants, and may appear on global leaderboards.
• Communities and chats. Content you post in communities, group chats, and direct messages is shared with the participants of those spaces.

You can control much of this through your in-app privacy settings (for example, profile visibility). Please use them to set the level of sharing you are comfortable with.

---

4. Service Providers and Sub-Processors

We use trusted third parties to operate the Service. They may access only the data needed to perform their function, and are contractually required to protect it and to use it only on our instructions. Some providers apply only to specific versions or platforms of the app.

AI coaching. To provide Coach Mo, we send relevant fitness context (such as your goals, recent activity, streaks, and your messages) along with your first name and user ID to Anthropic and ElevenLabs. These providers process this data on our behalf to generate coaching responses and voice, and do not use it to train their own models. Conversation data sent to our AI providers may be retained by them for a limited period for safety, debugging, and quality purposes, then deleted, in line with their terms. We also use automated tools to help detect content that may indicate self-harm or crisis, so we can surface support resources. Coach Mo's responses are AI-generated and are not medical or professional advice (see our Terms). You can delete your Coach Mo conversation history in the app, and deleting your account removes it.

We may also disclose information:

• For legal reasons, if required by law, regulation, legal process, or a valid government request.
• For safety, to protect the rights, property, or safety of DesignSpark Studio LLC, our users, or the public, including to enforce our Terms and investigate abuse.
• In a business transfer, if we are involved in a merger, acquisition, or sale of assets, in which case we will notify you.

---

5. Data Retention

• Account and profile data: retained while your account is active.
• Health, fitness, social, and content data: retained while your account is active so the Service can function.
• Analytics, diagnostics, and attribution: retained for up to 12 months, then deleted or aggregated.
• Consent and verification records (e.g., phone opt-in): retained as needed to evidence consent and for security.
• De-identified or aggregated data: we may retain and use data that no longer identifies you (for example, aggregate usage statistics) indefinitely to operate and improve the Service.

When you delete your account, we delete or de-identify your personal data within 30 days, except where we must retain certain records to comply with law, resolve disputes, or prevent fraud and abuse. You can request data export and account deletion from within the app at any time.

---

6. Data Security

We use technical and organizational measures to protect your information, including:

• Encryption in transit (TLS/HTTPS) for all network communications
• Encryption at rest for stored data, and secure storage for credentials on device
• Strict server-side access controls; the app speaks only to our backend APIs, which enforce access rules
• Regular review of our data practices

No method of transmission or storage is completely secure, and we cannot guarantee absolute security, but we take commercially reasonable steps to protect your data.

Where your data is stored. We are based in the United States, and we and our service providers store and process your information primarily on cloud infrastructure in the United States (including Amazon Web Services). Some features rely on additional providers (for example, our feedback portal runs on separate hosting); see Section 4.

Security incident notification. If we become aware of a security breach affecting your personal information, we will notify you and any regulators as required by applicable law, generally by email to the address associated with your account.

---

7. Your Privacy Rights and Choices

Wherever you live, you can:

• Access / export your data (in-app data export)
• Correct your profile and account information
• Delete your account and associated data (in-app account deletion)
• Control sharing through your in-app privacy settings
• Control tracking through the App Tracking Transparency prompt and your device settings
• Manage push notifications in app and device settings, and connected wearables in the Connections screen

To make a request or ask a question, contact Mo, our support assistant, or use the in-app support chat. We respond within the time required by applicable law (generally within 30 days).

For residents of the EEA and UK (GDPR / UK GDPR)

• Data controller: DesignSpark Studio LLC. Contact via Mo.
• Lawful bases. We process your data to perform our contract with you (providing the Service), based on your consent (analytics and attribution where consent applies; reading Health data and connecting wearables; SMS verification; contacts matching), and for our legitimate interests (security, fraud prevention, and improving the Service).
• Your rights. Access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests, and withdrawal of consent at any time.
• International transfers. We are based in the United States, so your data is processed in the US. Where we transfer EEA/UK data, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
• Complaints. You may lodge a complaint with your local supervisory authority.

For California residents (CCPA/CPRA)

• Categories collected: identifiers (name, email, phone, user ID, device/advertising identifiers), account/profile information, health and fitness data (sensitive personal information), photos, user content, commercial information (subscription/purchase status), internet/usage activity, and inferences used for coaching.
• Purposes: as described in Section 2.
• We do not sell your personal information. We do not use your data for cross-context behavioral advertising beyond the attribution/marketing measurement described in Section 1, which you can decline through the App Tracking Transparency prompt. In the 12 months before the "Last Updated" date at the top of this Policy, we have not sold your personal information or shared it for cross-context behavioral advertising.
• Sensitive personal information (such as health data) is used only to provide the Service and the purposes described here.
• Your rights: to know, access, correct, delete, and limit use of sensitive personal information. We will not discriminate against you for exercising your rights.

To exercise these rights, contact Mo.

For residents of other U.S. states

If you live in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, or another state with a comprehensive consumer privacy law, you have the right to confirm whether we process your personal data; to access, correct, and delete it; to obtain a portable copy; and to opt out of targeted advertising, the "sale" of personal data, and certain profiling. We do not sell personal data and do not use it for targeted advertising or for profiling that produces legal or similarly significant effects. We process sensitive data (such as health and fitness data) only to provide the Service, with your consent where required.

To make a request, contact Mo. We may need to verify your identity before we act, and you may use an authorized agent to submit a request on your behalf. Right to appeal: if we decline your request, you may appeal by replying to our decision or contacting Mo. If you have concerns about our handling of an appeal, you may contact your state attorney general.

Do Not Track and Global Privacy Control

Some browsers offer a "Do Not Track" (DNT) signal. Because there is no common industry standard for DNT, we do not currently respond to DNT signals. Where required by law, we honor recognized opt-out preference signals such as Global Privacy Control (GPC).

Marketing communications

We send service and account messages necessary to operate the Service. We send marketing or promotional messages only where permitted, and you can opt out at any time using the unsubscribe link in those messages or your in-app and notification settings. Opting out of marketing does not stop essential service messages.

California "Shine the Light"

California Civil Code Section 1798.83 permits California residents to request information about our disclosures of personal information to third parties for their own direct marketing purposes. We do not share personal information with third parties for their direct marketing. You may contact us to confirm.

---

8. Health and Fitness Data

Health and fitness data is sensitive, and we handle it accordingly:

• Apple Health (HealthKit) data is read with your explicit permission and is used only to provide app features. We do not use HealthKit data for advertising or marketing, and we do not share it with third parties except the service providers in Section 4 that are necessary to deliver features you use (for example, AI coaching).
• You can revoke Health permissions at any time in the iOS Settings app, and disconnect wearables in the app. Connecting Health or a wearable is optional, but some features (such as rings, streaks, and competitions) will not work without activity data.
• To power features like leaderboards, competitions, streaks, and AI coaching, your health and fitness data is stored on our servers (US cloud infrastructure), not only on your device. It is protected as described in Section 6 and shared only with the Section 4 providers needed to deliver features you use.
• MoveTogether is a fitness and motivation product, not a medical device or medical service. Coach Mo and any insights we generate are for general fitness and motivation only and are not medical advice. See the Health & Fitness Disclaimer in our Terms.

Not HIPAA / not PHI. DesignSpark Studio LLC is not a "covered entity" or "business associate" under the U.S. Health Insurance Portability and Accountability Act (HIPAA), and the health and fitness information you provide through the Service is not protected health information under HIPAA.

Consumer health data (Washington, Nevada, Connecticut, and similar laws). Some states regulate "consumer health data" collected by apps that are not covered by HIPAA. We collect and use your health and fitness data only to provide the features you use, as described in this Policy, and with your consent where required. We do not sell consumer health data, and we do not share it except with the service providers in Section 4 that are necessary to deliver features you use. To exercise rights over your consumer health data, contact Mo, our support assistant.

---

9. Children's Privacy

MoveTogether is not intended for children under 13, and we do not knowingly collect or solicit personal information from anyone under 13. In the EEA and UK, where a higher digital-consent age applies (up to 16 in some countries), the Service is not intended for users below that age. By using the Service, you represent that you are old enough to do so, or that a parent or guardian has consented on your behalf where required.

If we learn that we have collected personal information from a child below the applicable age, we will deactivate the account and take reasonable steps to delete that information promptly. If you believe a child has provided us personal information, contact Mo, our support assistant and we will address it.

---

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date, post the new version at https://movetogetherfitness.com/privacy, and, where appropriate, notify you in the app or by email. Your continued use of the Service after changes take effect constitutes acceptance.

---

11. Contact Us

• Mo, our support assistant: use the Mo widget in the bottom-right corner on desktop, or tap "Talk to Mo" on mobile
• In-app: the support chat inside the app
• Company: DesignSpark Studio LLC (Ohio, USA)
• Mailing address: DesignSpark Studio LLC, 815 Superior Ave. E., Ste 1618-A2, Cleveland, OH 44114-2706, USA
• Website: https://movetogetherfitness.com