Privacy Policy

1. What we collect

• Your account: the email address you sign up with, your name if you give it, your password (stored only as a one-way hash — we cannot read it), and which plan you are on.
• Billing records: the fact that a payment was made, its amount, date and status, and an identifier from Stripe. We do not receive or store your card number, expiry date or security code.
• Security and anti-abuse data: the IP address a request comes from, the number of failed login attempts, and per-account usage counters (how many times the app and its photos were requested). We use these to stop brute-force attacks and bulk copying of the reference data.
• Messages you send us: anything you email to our support addresses, kept so we can help you.
• Local notes: the notes you write in the app are saved in your browser's own storage on your device. They are never sent to us.

2. How we use it

• to create your account, sign you in, and give you the access you paid for;
• to take payments and manage renewals, cancellations and refunds;
• to keep the service secure: spotting brute-force logins and bulk extraction of the data;
• to support you when you ask for help, and to send essential service messages (a receipt, a password reset, notice of a meaningful change to these policies).

We do not use your data for advertising, and we do not build profiles of you to sell.

3. Payments

Payments are processed by Stripe. When you pay, your card details are entered with Stripe and go directly to them — they never pass through our server. Stripe is an independent controller of some of that data; you can read Stripe’s privacy policy for how they handle it.

4. Cookies

Moto uses only the cookies needed to work:

• a single first-party session cookie, so you stay signed in and the app knows you are a member;
• a short-lived cookie used only during the login or password-change step to protect against cross-site request forgery.

There are no advertising cookies and no third-party analytics on this site today. If that ever changes, we will say so here and, where the law requires it, ask you first.

5. Who we share it with

We share the minimum necessary with the suppliers that run the service, and only for the purposes above:

• Stripe — payments, subscriptions, invoices and refunds;
• Cloudflare — the hosting, content delivery and database the site runs on, and the security filtering in front of it;
• Resend — the transactional email service that delivers receipts, password resets and service notices.

These companies act on our instructions as processors and may not use your data for their own marketing. We may also disclose information if we are legally required to, or to protect the service and its users.

6. How long we keep it

• Account and subscription data: while your account is open, and for a reasonable period afterwards so we can deal with billing questions.
• Payment and tax records: as long as the law requires us to keep them.
• Security counters and login-attempt logs: they expire automatically, normally within 24 hours.
• Support emails: kept while they are useful, then deleted.

7. We do not sell your data

We do not sell, rent or trade personal information, and we do not share it for anyone else’s advertising.

8. Your rights

Wherever you live, you can ask us to:

• tell you what personal data we hold about you, and give you a copy;
• correct anything that is wrong;
• delete your account and the data that goes with it (we will keep only what the law requires);
• stop certain processing, or object to it.

If you are in the UK or EU, these are your rights under the GDPR; if you are in California, they are rights under the CCPA/CPRA. Either way, email [email protected] and we will deal with it. If you are not satisfied you can complain to your local data protection authority.

9. Security

The site runs over HTTPS. Passwords are stored hashed, access to the server is restricted, and we limit how often an account can pull the data so that bulk copying is visible to us. No system is perfect, but we do not hold your card details at all — which is the part that would hurt most.

10. Children

Moto is a professional tool and is not intended for children. We do not knowingly collect data from anyone under 16.

11. Where your data lives

Moto runs on Cloudflare's global network. Your account and subscription data is held in Cloudflare's managed database, whose primary region is Western North America (United States). So if you use Moto from outside the United States, your data is transferred to and processed there. The suppliers listed in section 5 may also handle data in other countries, always under appropriate safeguards.

12. Changes to this policy

If we change how we handle personal data we will update this page and change the effective date, and we will email subscribers about any meaningful change.

13. Contact

For anything to do with privacy, your data, or these rights, email [email protected].

© 2026 KeyToolRescue. Licensed for personal use — not for redistribution.