MovesBook is a personal breaking training app. Your privacy matters to us. This policy explains what data we collect, how we store it, where it goes, and your rights.
We collect the data you enter into the app: moves, sets, goals, habits, notes, battle plans, sparring sessions, calendar entries, profile information (nickname, breaking start date), and app settings. If you sign in, this also includes a profile photo if you choose to add one.
Injury, body-check and rest entries are health-related information. They stay on your device only. We do not collect them, do not store them on our servers, and do not sync them between devices. Our servers are set to discard them if an older version of the app tries to send them.
When you answer the age screen we work out which country's rules apply to you, from your device's language and region. If you sign in, we store that country code and your age group (not your date of birth) with your account, so we can apply the right rules and, if there were ever a security incident, tell the right people.
A little information about you reaches us from other companies rather than from you: Apple, Google Play and Stripe tell us (through RevenueCat) what you have bought so we can unlock it, and the app stores tell us your account's age range where the law requires it. Our hosting providers pass on the standard connection details of every request (your IP address and device type). We do not buy data about you from anyone.
Beyond the content you enter, we can collect anonymous usage data about how the app itself is used — for example which features are opened, where a screen flow is abandoned, and app errors. This is off unless you turn it on in Settings. It is recorded under a random device ID rather than your account name, and never includes what you write (your moves, notes, reflections, or profile). We use it only to fix problems and improve the app. You can turn it off again any time.
When you send a message through the Feedback form, the app adds its version, platform (iOS, Android or web) and app language to it. If you tick "You can reply to me by email", your account's email address is sent with the message so we can answer you. If you don't, we don't add your name or email address to it.
All data is stored locally on your device using the app's own storage. Without sign-in, your training content stays on your device. A few things still travel over the internet even without sign-in: messages you send through the Feedback form, backups you choose to export or share, and the standard connection data received by the services that host the app and its fonts.
If you sign in with Google, Apple or Email, your data is synced to Google Firebase Firestore for cloud backup and cross-device access. Firebase is operated by Google and subject to Google's security standards.
We use Firebase Authentication (Google sign-in, Apple sign-in and email/password). We do not store your password. Authentication tokens are managed by Firebase.
A small number of outside companies process data on our behalf so the app can run:
Feedback is not handled by a third-party form service. It is emailed straight to MovesBook's own address, which is a Gmail account, so Google's mail servers carry the message.
We do not use advertising networks, social media pixels, or any form of cross-site tracking, and we never sell your data. The anonymous usage data described above is stored in our own Firebase database and is never shared or sold.
This website sets no cookies. It stores three small values in your own browser, readable only by movesbook.app:
The first two persist until you clear your browser data; the third is discarded when you close the tab.
MovesBook is run from Australia. The companies that store or process data for us are in other countries. Here is the list, what each does, where, and what protects your data there.
Singapore has a comprehensive data-protection law (the Personal Data Protection Act) with an independent regulator; the United States has sector-based privacy laws and the EU-US Data Privacy Framework for certified companies; France applies the EU General Data Protection Regulation; Australia has the Privacy Act 1988. Each processor is bound by contract to protect your data to a standard equivalent to ours.
If you live in Switzerland, the same safeguards apply: the standard contractual clauses in these agreements include the changes Swiss law requires, and Switzerland recognises US companies certified under the Swiss-US Data Privacy Framework.
We do not sell your data, and we never share it for advertising. The service providers listed above process it on our behalf so the app can run.
Data also leaves MovesBook when you choose it: shareable cards, exported backups, sessions you share, and packs you publish to the catalog (which show your creator name).
If you join a class with a join code, your teacher sees the name you use in that class, whether you are under 18 or an adult, and only the homework you choose to send: the moves, the reps and the time of each set, any video link you add, and what you write in the three questions at the end of your homework (and, if you are under 18, the free box marked "Your teacher can read this."). Nothing else from your training, your email or your health entries is shown to them, unless you choose to send it (see "Sending to your teacher" below). You decide each time what to send, and you see exactly what will be sent before it goes.
What you write is optional, is limited to 280 characters per box, and cannot contain links, email addresses or phone numbers — our server checks this before the record is sent. Your teacher cannot reply to it, and if you are under 18 a teacher can only reply with a short set phrase. When you leave a class, your teacher can no longer see anything you sent. You keep your own records. If you make a PDF of a record, it is made on your device and you decide who gets it — we never see it.
Teachers are adults who bought a Teacher plan and agreed to our Teacher Terms. If a teacher keeps a copy of anything outside the app, they are responsible for it under their own privacy law.
If you teach, we keep: your class and its homework, the notes and feedback you write (word for word, in a record only we can read, to keep students safe and look into reports), your student count, the date you accepted the Teacher Terms, and any report about you and what we decided.
How long: a closed class, its memberships and homework are deleted 30 days after it closes. Homework a student sent stays in that student's account until they delete their account. Reports are kept 12 months. The record of what a teacher did in a class is kept while we may still need it to look into a report about that class. Deleting your account removes your memberships and the homework you sent, and closes any class you teach.
Reports go only to MovesBook. We read them, decide within 7 days, and may pass information to the police or child-protection authorities if a child may be at risk.
Classes are not available in the United Kingdom yet.
A teacher can plan a show for a class: where each student stands on stage, scene by scene. When the teacher shares a show with the class, every member of that class can see it, with the name each member uses in the class on the stage — so your classmates see yours, and you see theirs. Nobody outside the class can see a show, and a show that is not shared is seen only by the teacher. You can change the name you use in a class at any time from the class screen; a show has your new name from the next time the teacher saves it.
To place dancers on stage, a teacher can record a level for each student (Advanced, Intermediate or Beginner). Only the teacher sees it: students never see their own level or anyone else's. It is used only to decide places on stage. You can ask us for a copy of the data we hold about you, including any level.
If you teach, the title of each show and when you created, renamed, shared or stopped sharing it are kept in the same record as your notes.
How long: a class's shows and levels are deleted with the class, 30 days after it closes, and a teacher can delete a show at any time. When you leave a class, or your teacher takes you out of it, you are removed from its shows and its levels at once. The formations a teacher saves for their shows hold no student data and are kept until the teacher deletes them or their account.
In a class, you can choose to send your teacher more of your own training record, from a list on the Send to teacher page: the homework you sent, a summary of My Book (training days, sessions, reps, your answers to the three questions and your monthly goal), and your battles (event name, date, number of rounds and result). Adults can also send their notes; nobody under 18 can. Only Homework is ticked until you tick more, the dates are the last 7 days unless you choose 30 days or your own dates (at most 30 days), and you see exactly what will be sent before you send it. Your teacher never sees anything you did not send.
Body check, injury and rest logs, videos and photos are never sent. Text that contains a link, an email address, a social handle or a phone number is left out. What you send is a copy frozen at that moment, not a live view. Your teacher sees it inside your profile in the class, with a progress view worked out on their screen from what you sent (training days, reps, homework sent) — no scores or rankings, and nothing about it is stored. Your teacher cannot export, print or reply to it, and cannot ask you to send one.
How long: you can delete a snapshot at any time. Your teacher loses access at once when you delete it, leave the class, are taken out of it, or delete your account. Snapshots are deleted with the class, 30 days after it closes, and with your account. Like the other class records, we keep a note that a snapshot was sent, deleted or closed to the teacher — not what was in it. You can ask us for a copy of your snapshots.
Packs that creators publish to the catalog are public. If you see published content that is illegal or breaks our terms, email hello@movesbook.app with the pack name and what is wrong. We read every report, act within 7 days, and tell you what we decided. If we remove or restrict a pack, we tell its creator why and how to object. Ordinary training notes and everything you keep in your own diary are private and are never reviewed by us.
Our single point of contact for authorities and for users under the EU Digital Services Act is hello@movesbook.app (English, Italian, French, Spanish, German or Portuguese).
Local data persists as long as you keep it on your device. Cloud data persists as long as your account exists. You can delete local data by clearing the app's storage; that does not delete cloud data — use Delete account for that. If you ask us to delete your data instead, we complete the deletion within 30 days.
Accounts that have not been signed in to for 3 years are deleted after we email you 60 days' notice.
Anonymous usage data is kept only for a limited time: each record is stamped to expire 90 days after it is written, and expired records are removed by an automatic cleanup that runs periodically.
Feedback messages are deleted 12 months after your question is closed, or sooner if you ask. Records that a single-use pack code was redeemed are kept for up to 12 months after the pack is gone. Payment and payout records are kept for 5 years because tax law requires it. Security logs expire after 30 days, and our provider's audit logs after 400 days.
You have the right to:
Deleting your account cannot be undone. It removes your profile, your synced training data, your entitlements, your purchase record with our subscription provider, your published packs, and your sign-in. There is no restore and no grace period, so export a Backup first if you want to keep a copy.
A few records are kept for a limited time where we need them: pack-code redemption records (so a single-use code cannot be claimed twice), payment records required for accounting, and server logs until they expire. Deleting your account does not remove copies you exported yourself, backups held by your phone's operating system, or the store's own record of what you bought.
Giving us personal data is your choice. If you prefer not to, you can use MovesBook without an account: everything stays on your device, but cloud backup, sync between devices and other features that need an account won't be available.
You can also request deletion without the app: see movesbook.app/privacy/delete-account.
If you think we have handled your data wrongly, email hello@movesbook.app with "complaint" in the subject line. We will acknowledge your complaint within 30 days and tell you what we found and what we did about it. You can also complain to a data protection authority: in the UK the Information Commissioner's Office (ico.org.uk), in the EU the authority of the country you live in, in Australia the OAIC, in New Zealand the Privacy Commissioner, in Canada the Privacy Commissioner or, in Quebec, the Commission d'accès à l'information, in Singapore the PDPC, and in Japan the Personal Information Protection Commission. In Switzerland you can complain to the Federal Data Protection and Information Commissioner (FDPIC), in Hong Kong to the Privacy Commissioner for Personal Data (PCPD), and in Taiwan to the Personal Data Protection Commission (PDPC) or the government authority responsible for our sector.
This section is our Consumer Health Data Privacy Policy for the purposes of Washington's My Health My Data Act and similar state laws.
Consumer health data we handle: injury and body-check entries you make in the app (body part, severity, dates, notes) and your rest log.
Where it lives: on your device only. We do not collect it, do not store it on our servers, do not sync it between devices, and our servers are set to discard it if an older version of the app tries to send it.
Sharing and selling: we do not share or sell consumer health data with anyone, and we have no processors or affiliates who receive it.
Your rights: because we do not hold this data, there is nothing for us to give you access to, correct or delete — you control it in the app. If you believe we hold consumer health data about you, email hello@movesbook.app; we will confirm within 45 days and you may appeal our answer by replying to it. We will not treat you differently for exercising these rights.
How we decide. The first time you open MovesBook we ask for your month and year of birth. We ask once. We do not store the date — we work out which age group you fall into, store only that, and discard the date itself.
Which age group you fall into depends on the age of digital consent in your country. That age is not the same everywhere: it is 13 in the United States and the United Kingdom, 14 in Italy and Korea, 15 in France, 16 in Germany and Ireland, and higher in some countries. We apply the figure for your region.
If you are under that age, MovesBook runs entirely on your device. We do not create an account for you. Nothing you enter is sent to, or stored on, our servers. We do not sync anything between devices. We collect no analytics or usage data about you at all. We show you no way to sign in or sign up, because there is nothing for an account to do. Everything else in the app works normally: your move library, your sessions, your drills, your notes. It is all held in the app's own storage on your device, and it stays there. If you delete the app, it is gone — so keep your own backup if it matters to you. Because we hold nothing about you, there is nothing for us to sell, share, profile or advertise against, and no data of yours for us to hand to anyone else.
If you are over that age but under 18, you can create an account if you choose to. If you do, the same privacy policy applies to you as to everyone else. We do not show you advertising, we do not profile you, and we do not sell or share your personal information with anyone.
For parents and guardians. We cannot verify anybody's age. A young person can enter an adult's birth year on that first screen, and if they do, MovesBook will create an account for them as it would for an adult. We would rather say that plainly than pretend otherwise. So if you believe your child has an account with us, write to hello@movesbook.app. Tell us the e-mail address the account uses, if you know it, or the name the account is under. You do not need to prove anything to us beyond enough for us to identify the account. We will delete the child's account and everything stored with it — the training data, the profile, anything they have shared, and the sign-in itself — within 30 days of hearing from you, and write back to confirm it is done. There is no charge, no form and no account of your own required. One e-mail is enough. You can also write to that address to ask what we hold about your child before deciding, or to ask us to correct something instead of deleting it. If you would rather not e-mail, an account holder can delete their own account and all its data from inside the app, under Settings → Delete account. That erases the same things.
The section above describes a child under the age of digital consent in their country whose parent has not said yes. Such a child can also have a MovesBook account that saves their training in the cloud, if a parent or legal guardian agrees. That is the only thing this consent covers. Joining a class is a separate question, asked separately for each class — see "Classes for children" below. Everything else stays as described above.
How it works. In the app, the child types a parent's email address. We use it for one thing only: to ask that parent. Epic Games' Kids Web Services (KWS) emails the parent and checks that they are an adult. The parent then reads our notice, ticks "I am this child's parent or legal guardian" and says yes or no. We create the child's login only after the parent says yes. Until then we hold nothing about the child — no name, no email, no account.
What we record. When a parent says yes, our server records the date, the version of the notice they saw, the country, that the box was ticked, and KWS's reference for the adult check. We never see the card, ID document or face scan used for that check; KWS handles it.
What we collect from the child, and why. What they enter in the app — training logs, moves, notes — plus a display name and the email they sign in with. We use it only to save their training and show it back to them on their devices. We do not collect their date of birth or any analytics or usage data about them. We show them no ads, we do not profile them, and we never sell or share their data.
Who receives it, and where. Only companies that run the service for us. Google Firebase stores the account and its data: the database in Singapore, sign-in and our server in the United States. Resend, in the United States, delivers our emails to the parent. KWS receives the parent's email address, the country and the app language — never the child's data. The Feedback form is not shown on child accounts.
Kids Web Services. KWS is run by Epic Games. It handles the parent's email address for us to carry out the check; for that job it is our processor, under its data processing addendum. KWS also keeps its own record that the address belongs to a verified adult — its "AgeGraph", which stores the address in scrambled (hashed) form and can reuse it when another service that uses KWS asks the same parent. For that record KWS is an independent controller: its own privacy policy applies, not ours.
How long we keep it.
For parents: see, download, delete. Once the child has set up their login, we email the parent a private link to a page where they can see what we hold, download a copy and withdraw consent at any time. Withdrawing deletes the cloud copy; what is on the child's phone stays there, and the app goes back to working on the phone only. The same page can send the parent a new link. A parent can also write to hello@movesbook.app for any of this.
Complaints. A parent who thinks we got something wrong can write to us, or complain to a data protection authority — for example the FTC in the United States, the ICO in the UK, the OAIC in Australia, or the authority in their EU country.
A child under the age of digital consent who has an account with a parent's consent can also join a teacher's class — but only if a parent says yes for that class. The parent is asked separately for each class; a yes for one class never covers another.
How it works. The child types the class's join code. Nothing is shared with the teacher yet, and the teacher cannot see that the child asked. We email the parent at the address they gave for the account consent, naming the class and its teacher. The parent reads our notice, is checked again by Kids Web Services (a parent it already knows sees one screen), ticks "I am this child's parent or legal guardian" and says yes or no. If they say no, or do not answer within 30 days, the request is deleted and the child's account keeps working.
Who receives what. The teacher of that class is the only recipient. They see the name the child uses in the class and that the child is under 18 — never their age or email — and only what the child chooses to send: homework for that class and, if the child sends one, a snapshot of their training summary and battles. A child can never send notes, video links, body check, injury or rest logs, photos, contact details or location; our server refuses them. Text a child writes is limited to 280 characters and cannot contain links, email addresses or phone numbers. The teacher can only reply with a short set phrase, cannot message the child, and cannot export or rank anything. We collect no analytics about the child.
What we record. For each class: the date, the version of the notice, the country, that the box was ticked, Kids Web Services' reference for the check, and the answer. Our record of teacher actions is kept as for every class.
How long, and how to stop. What a child sends is kept while they are in that class. After the parent says yes, we email a link to a page that lists each class they approved, each with its own Withdraw button. Withdrawing a class takes the child out of it and deletes, at once, everything they sent to that teacher; their other classes and their account keep working. Withdrawing the account consent ends every class. After a class ends for a child, we keep only the status and dates of the consent for it. Classes are not available in the United Kingdom.
We may update this policy occasionally. Changes will be reflected in the "Last updated" date. If a change means we would use your data in a new way that needs your permission, we will ask you before doing it, not just update the text.
MovesBook is operated by Giuseppe Monteleone, 405/105D Willarong Rd, Caringbah NSW 2229, Australia, who is the data controller. For privacy questions or requests, use the Feedback form in the app or email hello@movesbook.app.
Giuseppe Monteleone is also our privacy officer under Quebec's Law 25 and our Data Protection Officer under Singapore's Personal Data Protection Act — hello@movesbook.app.
If you are in the European Economic Area or the United Kingdom, you can also contact our appointed representative: IT.LAW GmbH – Giuseppe Monteleone, sole trader trading as MovesBook –, Colmantstraße 15, 53115 Bonn, Germany, art-27-rep-movesbook@it.law (EU) and Rickert Services Ltd UK – Giuseppe Monteleone, sole trader trading as MovesBook –, PO Box 1487, Peterborough PE1 9XX, United Kingdom, art-27-rep-movesbook@rickert-services.uk (UK). Our legal representative under the EU Digital Services Act is IT.LAW GmbH – Giuseppe Monteleone, sole trader trading as MovesBook –, Colmantstraße 15, 53115 Bonn, Germany, art-13-rep-movesbook@it.law. You can write to them about anything in this policy, and any data protection authority can too.
← Back to MovesBook