Privacy Policy

• ✓ We collect only what we need to run your account and the features you use.
• ✓ We never sell your data, and we run no third-party advertising or tracking.
• ✓ Passwords are hashed, sessions and two-factor secrets are encrypted, and everything travels over HTTPS.
• ✓ You can view, correct, or delete your account and data at any time.

Account information — your display name and email address, and a securely hashed version of your password (we never store your actual password).

Two-factor authentication — if you enable it, your authenticator secret and recovery codes, stored encrypted.

Your activity on the site — quiz scores, saved transfer routes, favorited guides, and the games/services you mark as part of your collection.

Technical request data — for security and basic analytics we log each request: IP address, browser/user-agent, the page visited, the response status, and a timestamp. See Request & security logs.

We use your information to: create and secure your account; remember your saved routes, scores, favorites, and collection; send essential account emails (verification and password resets); and keep the site safe by detecting and blocking abuse.

We do not use your data for advertising, profiling for marketing, or any automated decision-making that affects you.

We use a single, essential session cookie to keep you logged in and to protect forms against cross-site request forgery (CSRF). That cookie is encrypted, HTTP-only (not readable by scripts), marked Secure (HTTPS only), and set to SameSite=Lax.

We do not use advertising cookies, third-party analytics cookies, or cross-site trackers.

To protect the site from attackers and to understand basic traffic, we keep a request log that records the IP address, browser/user-agent, requested path, response status, and time of each visit. We use this to spot and block malicious activity (for example, automated probes and brute-force attempts).

These logs are kept for a limited retention window (90 days by default) and are then automatically deleted. They are never sold or shared for marketing.

We send transactional emails (email verification and password resets) through our email provider, Resend. We only send email that's necessary to operate your account — no newsletters or marketing unless you explicitly opt in to something in the future.

To cut down on abuse and spam accounts, we block sign-ups from known disposable/temporary email domains.

We do not sell, rent, or trade your personal information. We share data only with the small number of service providers required to run the site:

• • Resend — to deliver verification and password-reset emails.
• • Our hosting provider — the server that runs the application and database.

We may disclose information if required by law, or to protect the rights, safety, and security of our users and the service.

We keep your account data for as long as your account exists. Request and security logs are retained for a rolling window (90 days by default) and then deleted automatically. If you delete your account, your personal data is removed.

You can:

• • Access & update your name, email, and security settings from your account dashboard.
• • Enable two-factor authentication for extra protection.
• • Delete your account and associated personal data — contact us and we'll remove it.

Depending on where you live, you may have additional rights (such as access, correction, deletion, or portability) under laws like the GDPR or CCPA. We honor these requests — just reach out.

MovingMon is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we'll delete it.

We may update this policy as the site evolves. When we make material changes, we'll update the "last updated" date at the top of this page.

Questions about privacy, or want to exercise your rights? Email privacy@movingmon.cloud.

Curious how we keep your data safe? Read our Security overview.