Privacy Policy — Mote

Last updated: 2026-08-12 · Effective date: 2026-05-06

1. Who we are

Mote is a mobile app for couples that helps share everyday moments of appreciation between partners. Privacy is the foundation of the product: data is end-to-end encrypted, the app is offline-first, and most content never leaves your device in a form readable by anyone other than you and your partner.

Data controller: Maciej Siemiński — the developer of Mote. Contact: mail@macsiem.dev

For the version of the app distributed via Google Play, the data controller is LICENCEPRO POLSKA Sp. z o.o., ul. Huculska 6, 00-730 Warszawa, Polska.

This Privacy Policy explains what personal data Mote processes, how, why, and what rights you have.

2. Plain-language summary

We do not store the content of your entries on our servers. Your messages, photos, voice notes, mood check-ins and tags are encrypted on your device and, when synced with your partner, end-to-end encrypted in transit. Mote can be used fully without creating an account; signing in with Apple or Google is optional and enables Premium entitlement sync and encrypted cloud-backup recovery across your devices — we never receive your cloud backup content unencrypted. We use Unity Ads for non-invasive banner ads on auxiliary screens and Apple/Google billing to process in-app purchases. Sentry is used only when explicitly enabled in a build to report crashes. You have full GDPR rights including access, deletion, and portability — most exercisable directly in the app.

3. Data we process

3.1 Local-only data

Entries, messages, tags, mood check-ins, photos and voice notes you add are stored locally on your device in encrypted form (MMKV with a device-derived key kept in Apple Keychain / Android Keystore). When synced with your paired partner's device, content is end-to-end encrypted using tweetnacl keys generated on each device — Mote's developer cannot read your entries.

3.2 Pairing relay (Cloudflare)

To pair two devices, Mote uses a 6-character invitation code or QR code. The pairing relay runs on a Cloudflare Worker + Durable Object (SQLite-backed) hosted by Cloudflare. The relay:

• holds an ephemeral, encrypted handshake message for at most 24 hours,
• handles real-time E2E encrypted message delivery between paired devices (the relay never sees plaintext),
• stores no user identity, no email, no phone number, no analytics.

When two devices are paired, they are linked by a random opaque identifier that does not identify a person.

3.3 Diagnostic data (Sentry)

Mote integrates Sentry (sentry.io) for crash and error reporting. Sentry collects:

• error stack traces (crash logs),
• device info (model, OS version, locale),
• app version and build number.

Sentry does not collect your content (entries, files, vaccination records, photos, archives), usernames, or other PII. Diagnostic data is retained by Sentry for up to 90 days. In some production builds Sentry is intentionally disabled (no DSN configured) — in that case no diagnostic data leaves your device.

3.4 Advertising (Unity Ads)

Mote shows non-invasive ads on Settings, Empty state, and Export. Ads are delivered by Unity Ads, whose SDK collects:

• the Advertising ID (Android Advertising ID / Apple IDFA), shared with Unity Ads to serve ads;
• diagnostic data (device model, country-level location, language).

Default mode is non-personalized ads. On iOS, the App Tracking Transparency (ATT) prompt asks for your consent before any tracking-grade identifier is used; on Android you control the Advertising ID under system Settings. Ads can be permanently disabled via the Lifetime / Premium IAP.

3.5 In-app purchases (IAP)

Mote offers paid features through Apple In-App Purchase (iOS) and Google Play Billing (Android). When you make a purchase:

• Apple / Google process all card and account data — we never see your card number, billing address, or full account information;
• Apple / Google return a purchase token / transaction receipt that Mote stores locally to validate entitlement;
• restore purchases re-fetches your existing entitlements from Apple / Google.

Available products: annual subscription, lifetime unlock, optional tip jar.

3.6 Device permissions

• Camera (CAMERA): take photos for entries (optional).
• Microphone (RECORD_AUDIO): record voice messages (optional).
• Photos / Media (READ_MEDIA_IMAGES / PHPhotoLibrary): add or process images from the gallery (optional unless required for app's core function).
• Notifications (POST_NOTIFICATIONS / UNUserNotificationCenter): reminders and operation status (optional).
• Vibrate (VIBRATE): haptic UI feedback (optional).

Each permission is requested contextually. You can deny any permission and still use the core features (where applicable).

3.7 What we do NOT collect

• Your name, phone number, or address — no account is required for core use. If you choose to sign in with Apple or Google, the provider may share an email address with us; see section 3.8.
• Contacts list, calendar, SMS, call logs.
• Precise location.
• Browsing history outside the app.
• Biometric data (Face ID / Touch ID is used only as a system-level lock and never leaves your device).
• Health, financial, or payment card data.

3.8 Optional account and sign-in (Apple / Google)

Mote can be used without creating or signing in to an account. Pairing and the core appreciation flow remain available anonymously. Signing in is optional and is used for Premium entitlement sync and encrypted cloud-backup recovery across devices.

When you choose Sign in with Apple or Sign in with Google:

• Apple or Google authenticates you and sends Mote an identity token;
• the Mote service verifies that token and creates an internal user ID;
• the provider may supply your email address. With Apple this can be an Apple private-relay address if you selected Hide My Email;
• Mote returns a signed session JWT. The app stores the token in the operating system's secure storage and uses it only for authenticated Mote requests.

The session JWT is valid for 30 days and may be refreshed during its final seven days. Signing out removes the session stored on the device. Signing out does not delete the server-side account record or encrypted cloud backup.

Mote does not receive your Apple or Google password.

3.9 Encrypted cloud backup (Premium)

Cloud backup is optional and requires an eligible Premium entitlement, sign-in, pairing and an acknowledged recovery phrase. Before upload, the app encrypts the backup on the device using a key derived from the recovery phrase. The service receives ciphertext associated with the internal Mote user ID; it does not receive the recovery phrase or plaintext backup.

The encrypted cloud backup can contain the pairing recovery material needed to restore the pair, the display name used inside Mote and encrypted key material. It does not contain your Apple or Google password. A new upload replaces the current backup for that Mote account.

Keep the recovery phrase safe. The encrypted cloud backup cannot be restored without it.

3.10 Sign out vs. account deletion

The local session JWT expires after 30 days unless refreshed and is removed from the device when you sign out. The provider link, internal user record, entitlement record and current encrypted cloud backup are retained until you use Delete account or ask support to delete them.

Sign out only removes the local session and disables cloud backup on that device. It is not an account-deletion action.

Delete account, used while online, sends an authenticated deletion request to the Mote service and then clears the local account, encryption material and app data. If the device was offline or the request could not be confirmed, contact mail@macsiem.dev to confirm server-side deletion.

Uninstalling the app removes app-local data according to the operating system, but does not by itself guarantee deletion of a signed-in server account or encrypted backup.

4. Why we process this data (purposes)

• Run the app on your device — local storage and (where present) encryption let your data persist between sessions.
• Sync with your partner — pairing relay enables real-time E2E delivery of your encrypted content.
• Improve stability — Sentry diagnostics help fix crashes that affect your usage.
• Sustain the free tier — Unity Ads delivers non-invasive ads to fund users who do not buy premium.
• Process purchases — Apple / Google billing fulfils premium entitlements you choose to buy.
• Sync entitlement and cloud backup across devices — for users who choose to sign in, Premium entitlement sync and optional encrypted cloud-backup recovery let you restore your pairing and settings on a new device.

5. Legal basis (GDPR Article 6)

For users in the European Economic Area, United Kingdom, and Switzerland:

• Performance of a contract (Art. 6(1)(b)) — running the app, syncing with your partner, processing your purchases.
• Legitimate interest (Art. 6(1)(f)) — Sentry diagnostics, fraud / abuse prevention, non-personalized advertising. Our interest is improving stability and sustaining the free tier; this does not override your fundamental rights.
• Consent (Art. 6(1)(a)) — personalized advertising, where you grant consent via the ATT prompt (iOS) or in-app preference. You may withdraw consent at any time without affecting prior processing.
• Consent / contractual choice for optional features (Art. 6(1)(a) and (b)) — signing in with Apple or Google and using encrypted cloud backup are optional actions you choose to take. The related processing is based on the resulting contract for the feature you selected, or your consent; you can withdraw at any time by signing out or deleting your account.
• Legal obligation (Art. 6(1)(c)) — only when we must respond to a lawful request from authorities.

6. Recipients (with whom we share data)

We do not sell personal data. The categories of recipients are limited to providers strictly required to run the app:

Recipient	Purpose	Data category	Privacy policy
Cloudflare, Inc.	Pairing relay; optional account/session service; entitlement sync; encrypted cloud-backup storage	Random pair ID, encrypted blob, session identifier, encrypted backup ciphertext (only if you sign in and use cloud backup)	https://www.cloudflare.com/privacypolicy/
Apple Inc. (Sign in with Apple)	Optional account authentication	Identity token, email address (may be an Apple private-relay address)	https://www.apple.com/legal/privacy/
Google LLC (Google Sign-In)	Optional account authentication	Identity token, email address	https://policies.google.com/privacy
Unity Technologies (Unity Ads)	Serve ads	Advertising ID, device & ad metrics	https://unity.com/legal/privacy-policy
Functional Software Inc. (Sentry)	Crash reporting	Stack traces, device metadata	https://sentry.io/privacy/
Apple Inc. (App Store / IAP)	In-app purchase processing on iOS	Purchase token, account-level entitlement	https://www.apple.com/legal/privacy/
Google LLC (Play Billing)	In-app purchase processing on Android	Purchase token, account-level entitlement	https://policies.google.com/privacy

We may disclose data if required by a valid court order or other binding legal process, after verifying the request and notifying you where lawful.

7. International transfers

Some of the recipients above are located outside the European Economic Area (mainly in the United States). Where transfers occur, they are protected by:

• the European Commission's adequacy decision (EU-US Data Privacy Framework) for providers certified under the Framework, including Google LLC, Cloudflare, Inc.;
• Standard Contractual Clauses (SCCs) as adopted by the European Commission, supplemented by additional safeguards where applicable;
• the recipients' own published transfer mechanisms (e.g. Apple's binding corporate privacy commitments).

You can request a copy of the relevant safeguards by writing to mail@macsiem.dev.

8. Retention

Data	Where it lives	How long
Your in-app data	Your device only (encrypted)	Until you delete it, uninstall the app, or wipe app data
Pair handshake blob	Cloudflare relay (encrypted)	Up to 24 hours, then automatically expired
Real-time E2E messages	Cloudflare relay (encrypted)	Stored only until delivered to the paired device, then deleted
Random pair ID	Both devices + relay	Until you unpair or delete app data
Advertising ID	Unity Ads systems	Per Unity's retention policy
Sentry crash data	Sentry systems	Up to 90 days from the event
IAP purchase token / receipt	Your device + Apple / Google	Until you uninstall; Apple / Google keep transaction records per their own policies
Session JWT	Your device (secure storage)	Up to 30 days, refreshable during the final 7 days; removed when you sign out
Provider link, internal account record, entitlement record	Mote backend (Cloudflare)	Until you use Delete account or ask support to delete it
Encrypted cloud backup	Mote backend (Cloudflare)	Until you delete your account, request deletion, or a new backup replaces it

9. Your rights (GDPR Art. 15–22)

You have the following rights regarding your personal data:

• Right of access (Art. 15) — confirmation whether we process your data and a copy of it. Most of your data is already on your device; export from the app or write to us for the rest.
• Right to rectification (Art. 16) — correct inaccurate data. Edit data directly in the app.
• Right to erasure / "right to be forgotten" (Art. 17) — delete all data via Settings → "Erase all data", or by uninstalling the app. Pair relay data expires automatically. If you have an optional account (signed in with Apple or Google), use Settings → "Delete account" to remove your provider link, internal account record, entitlement record and encrypted cloud backup from our servers as well as local data — this is distinct from "Sign out", which only clears the local session. If the deletion request cannot be confirmed while offline, contact mail@macsiem.dev to confirm server-side deletion.
• Right to restrict processing (Art. 18) — request a temporary halt; write to us.
• Right to data portability (Art. 20) — Settings → "Export data" produces a JSON / Markdown bundle.
• Right to object (Art. 21) — object to processing based on legitimate interest, especially profiling-style ads. Disable personalized ads in app settings or via system controls.
• Right not to be subject to automated decisions (Art. 22) — Mote does not make automated decisions with legal or similarly significant effect about you.

To exercise any right, write to mail@macsiem.dev. We respond within 30 days (extendable by 60 days for complex requests, with notice).

10. Right to lodge a complaint (GDPR Art. 77)

If you believe we are processing your data unlawfully, you may file a complaint with a supervisory authority. For Polish residents:

Prezes Urzędu Ochrony Danych Osobowych (PUODO) ul. Stawki 2, 00-193 Warszawa, Poland https://uodo.gov.pl

You may also file a complaint with the supervisory authority of your habitual residence, place of work, or place of the alleged infringement in another EEA country.

11. Children's privacy

Mote is not directed at children under 13 (under 16 where applicable per local law). We do not knowingly collect personal data from children under that age. If you believe a child has provided us personal data without parental consent, contact us at mail@macsiem.dev and we will delete it promptly.

The "Designed for Families" / "Ages 5+" Apple / Google flags are not set on Mote — the app is rated for general audiences 13+.

12. Security

• Local encryption at rest — entries stored in MMKV with a device-derived key kept in Apple Keychain (iOS) / Android Keystore (Android). The key never leaves your device.
• End-to-end encryption in transit — pair-to-pair messages use tweetnacl (X25519 + XSalsa20-Poly1305). Each device generates its own key pair; private keys never leave the device.
• Transport security — all network calls use HTTPS / TLS 1.2+.
• Minimization — we collect only what is required for the listed purposes.
• Backups — your entries are not backed up to Mote infrastructure by default. If you sign in and hold an eligible Premium entitlement, you can optionally enable encrypted cloud backup (see section 3.9); the app encrypts the backup on your device before upload, and Mote cannot read its content. Optional system-level backups (iCloud Backup on iOS, Auto Backup on Android) remain entirely under your control regardless.

No system is 100% secure; please keep your device updated and use strong device locks.

13. App Tracking Transparency (iOS) and Advertising ID

On iOS, before any tracking-grade identifier is used by Unity Ads, Mote shows the system App Tracking Transparency prompt. If you decline, Mote serves only non-personalized ads.

On Android, you can reset or limit your Advertising ID under Settings → Google → Ads. Choosing "Delete advertising ID" stops Unity Ads from using a personal identifier; non-personalized ads continue to be shown.

14. In-app purchases

Mote offers the following in-app products through Apple App Store and Google Play: annual subscription, lifetime unlock, optional tip jar.

All payment data is handled by Apple Inc. (App Store / iTunes account) or Google LLC (Play Billing). We never see your card number, your billing address, or your full Apple ID / Google account. Apple and Google return only an opaque purchase token and entitlement metadata that we use to unlock features. Subscriptions can be cancelled at any time in iOS Settings → Apple ID → Subscriptions or in the Google Play app → Subscriptions; cancellation rules are governed by Apple / Google.

15. Changes to this policy

We may update this policy as the app, third-party SDKs, or applicable law change. Material changes will be announced in-app and the "Last updated" date at the top will change. Continuing to use Mote after a change constitutes acceptance of the updated policy.

16. Contact

For privacy questions, exercise of rights, or concerns about this policy:

Maciej Siemiński Email: mail@macsiem.dev

Canonical version of this policy: https://macsiem.github.io/mote-privacy/ Source: https://github.com/MacSiem/mote-privacy