Privacy Policy – Movena AI
Last updated: 30 October 2026 · Version 1.0.1
Web version: https://movena.pro/privacy
This policy explains how Expertive OÜ processes personal data when you use the Movena AI iOS app (the "App"). Movena AI – Every Move Matters.
1. Controller and contact
Expertive OÜ, Ruunaoja tn 3, 11415 Tallinn, Estonia · Registry code 16734170 · Management board member: Ömer Faruk Bayram · [email protected]
We have not appointed a data protection officer because we are not legally required to do so. You can contact us about all data protection questions at the address above.
2. Summary
- Your camera image is analysed only on your device. Camera images and videos are not uploaded to us and not stored by us.
- We use your data only to run your account, your Movena Pro subscription status and support.
- No third-party advertising, analytics or crash-reporting SDKs, no tracking, no sale of data.
- Movena AI does not use Apple Health (HealthKit) and does not collect health data.
- You can request deletion of your account at any time by email or via Contact support in the App.
3. Data we process
| Purpose | Data | Legal basis (GDPR) | Storage period |
|---|---|---|---|
| Registration and sign-in with email | Email address, password (stored only as a hash by our authentication provider), user ID | Art. 6(1)(b) (contract) | Until you delete your account |
| Sign in with Apple | Apple user identifier; name and email address only if you choose to share them (Apple may provide a private relay address) | Art. 6(1)(b) | Until you delete your account; Apple sign-in tokens are revoked when you delete it |
| Movena Pro subscription | Apple processes all payments. Your subscription entitlement is checked on your device via Apple's StoreKit. We do not receive your payment card details and do not currently store App Store transaction records on our servers. | Art. 6(1)(b) | No server-side storage by us; Apple sales reports we download for accounting are kept as required by accounting law |
| Authentication emails (confirming your email address, resetting your password) | Email address, content of the email, delivery status. These emails are sent by Supabase Auth. | Art. 6(1)(b) | According to Supabase's retention periods |
| Security and misuse prevention | Technical log data such as IP address, time and action, processed by our hosting provider | Art. 6(1)(f) (legitimate interest: security of the service) | According to the provider's log retention |
| Support requests | Your message, email address and any details you provide | Art. 6(1)(b) or (f) | 12 months after your request is closed |
| Legal claims and requests from authorities | The data concerned | Art. 6(1)(c) or (f) | For the duration of the proceedings |
Camera and on-device movement analysis. The App uses your front camera to show live movement exercises. Google MediaPipe models run entirely on your device to estimate body and hand positions (for example, the position of joints) in real time, so that the App can count repetitions and give feedback on your exercise form. Camera frames and the estimated positions are processed in your device's memory only for this purpose and are discarded. Your camera feed is not recorded and never uploaded to our servers; it is not stored by us and not shared with third parties. No video ever leaves your device. You can withdraw camera access at any time in iOS Settings; the movement exercises then no longer work.
No biometric identification. The App does not recognise who you are. Position estimates describe how you move, not your identity, and are not used to uniquely identify a person. We therefore do not process biometric data for identification purposes within the meaning of Art. 9(1) GDPR. Because this analysis takes place only on your device and the data is not transmitted to us, we do not receive this data.
Camera. Activities use the live camera. Frames are analysed on your device only with Google MediaPipe and are not recorded, not uploaded to us and not stored by us. Movena does not access your photo library.
Performance log. The App can create a technical performance log on your device (for example processor load, frame rate and device temperature). It contains no camera images. It stays on your device unless you choose to share it yourself via the iOS share sheet.
Workout summary PDF. If you create a workout summary PDF, it is generated on your device and is not uploaded to us. You decide whether to share it.
What we do not do. The App contains no third-party advertising or tracking SDKs. We do not track you across apps or websites, we do not sell data, and we do not use your data for personalised advertising. The App contains no third-party analytics or crash-reporting SDKs.
4. Account deletion
You can request deletion of your account at any time by emailing [email protected] or via Contact support in the App. We will then delete your account data and, if you used Sign in with Apple, revoke the Apple sign-in token as part of completing the deletion. An in-app deletion control will be provided as soon as it is available. Deleting your account does not cancel your Movena Pro subscription – please cancel it in your Apple ID settings (see our Terms of Use). Data we must keep by law is retained only for as long as required.
5. Recipients and processors
We use the following service providers as processors under data processing agreements (Art. 28 GDPR):
- Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513: authentication, account database and authentication emails. We will set up the account database in a European Union region.
Supabase uses sub-processors, including Amazon Web Services.
Apple. Downloads, payments, subscriptions, trials and refunds are handled by Apple Distribution International Ltd. (Ireland) through the App Store. Apple processes this data as an independent controller under its own privacy policy (https://www.apple.com/legal/privacy/). The same applies when you use Sign in with Apple.
Google MediaPipe is a software library that runs on your device; Google does not receive your camera images through it.
We disclose data to authorities only where we are legally obliged to do so.
6. Transfers outside the EU/EEA
Supabase Pte. Ltd. is based in Singapore, and its group companies and sub-processors (for example in the United States) may access data from outside the EU/EEA, for example for support and operations. For these transfers, we rely on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR, Commission Implementing Decision (EU) 2021/914), which are part of Supabase's data processing agreement and, where applicable, on the EU–U.S. Data Privacy Framework (Art. 45 GDPR) for certified sub-processors.
7. Storage periods
We store personal data only as long as necessary for the purposes above. Account data is deleted when you delete your account. Support requests are deleted 12 months after they are closed. Data we must keep under statutory retention obligations (for example accounting records) is kept for the legally required period, generally up to 7 years under Estonian accounting law, and blocked for other uses.
8. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent with effect for the future (Art. 7(3)), where we rely on consent. To exercise these rights, write to [email protected]. We respond within one month (Art. 12(3) GDPR).
Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (Art. 6(1)(f)), you can object at any time on grounds relating to your particular situation.
Right to lodge a complaint: You can lodge a complaint with a supervisory authority, in particular in your country of residence or with our lead authority: Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate), Tallinn, Estonia, https://www.aki.ee.
9. Consent for camera access
Camera access is requested through the iOS permission dialog. Where consent is required for accessing your device's camera, the legal basis is your consent (Art. 6(1)(a) GDPR); the on-device processing itself serves to provide the exercises you requested (Art. 6(1)(b) GDPR). You can withdraw camera access at any time in iOS Settings.
10. Minimum age
Movena AI is intended only for adults aged 18 and over. We do not knowingly process data of persons under 18. If you believe a minor has created an account, please contact us and we will delete it.
11. Automated decisions
We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Exercise feedback in the App is generated on your device and is for your information only.
12. Security
We use technical and organisational measures appropriate to the risk (Art. 32 GDPR), including encrypted connections (TLS) and access controls.
13. Changes
We may update this policy when the App or legal requirements change. The current version is always available at https://movena.pro/privacy. We will inform you in the App of material changes.