Movo Privacy Policy
This is an English translation provided for convenience. If there is any difference, the Portuguese version prevails: Português.
Last updated: October 13, 2026 · Version 1.1
1. Who is responsible
Movo is operated by Andre Durso (an individual), who is the controller of the personal data processed in the app, under Brazil's General Data Protection Law (Lei Geral de Proteção de Dados, Lei 13.709/2018 — LGPD).
Contact for privacy matters and to exercise your rights (data protection officer, or DPO): contato@movoapp.com.br.
2. What data we collect
Data you provide:
- Account: email (used for login by link/code) and the display name you choose.
- Workout and health (sensitive): routines, exercises, weights, repetitions, sessions and dates, perceived effort, pain or limitations you report, goals, experience level, weekly schedule, runs and scheduled races, and sports activities.
- Phone number (optional): if you wish, you can enter a number with area code at sign-up or in My profile. We use it only so your coach can contact you, if you have one, and for notices about your account. Never for advertising, and we never share it with third parties. You can delete the number at any time.
- Coach mode (only if you use it): the link between coach and client, the permissions the client grants (workouts, weights, runs, effort and pain, and phone number, each turned on or off by the client), training weeks, and the comments exchanged. For coaches: professional profile, appointment schedule and availability hours, and the clients the coach adds to the schedule (name and, if the coach chooses, phone number and email), class packages, and attendance. Coaches should enter contact details only for people who agreed to be contacted.
- Social interactions: friendships, challenges and challenge check-ins, and reports you decide to share (including the recipient's email).
- Feedback: messages you send through the app.
Data from services you connect:
- Strava (only if you connect it): activities (type, date, distance, duration, pace, heart rate when available). We store the access token needed to sync, and you can disconnect at any time. Data from Strava is not sent to Movo's artificial intelligence features.
Technical data collected automatically:
- App open log (to know how many people use it).
- Technical app errors (error message and version), to fix faults.
- Log of AI feature use (type and date), to control limits and costs.
- IP address and browser data, handled by infrastructure providers in the normal operation of the connection.
The app also keeps a copy of your data on your device (the browser's local storage), so it can work without internet.
We do not collect GPS location, contacts, or photos, and we do not access the microphone or the camera.
3. What we use it for and the legal basis
| Purpose | Legal basis (LGPD) |
|---|---|
| Create and maintain your account, save and sync your workouts across devices | Performance of the service you requested (art. 7, V) |
| Process your health and fitness data to produce your progress, reports, and recommendations | Your specific and prominent consent (art. 11, I), given when you accept this policy at sign-up. You can withdraw it at any time by deleting your account |
| Generate workouts, plans, and adjustments with artificial intelligence (see section 5) | Your consent (art. 11, I), at the moment you use the feature |
| Optional phone number: contact from your coach (only if there is a link and you allow it) and notices about your account | Your consent (art. 7, I), when you fill in the field. You withdraw it by deleting the number |
| Coach mode: link, sharing of what you allow, and the coach's schedule and packages | Performance of the service and your consent (art. 7, V and I; art. 11, I for health data that you allow) |
| Friends, challenges, and sharing of reports | Performance of the service and your consent, only with whom you choose |
| Security, abuse prevention, error fixing, and general usage statistics | Legitimate interest (art. 7, IX), without using your workout data on an individual basis |
| Responding to feedback and requests | Legitimate interest and performance of the service |
| Complying with legal obligations and defending rights | Legal obligation and regular exercise of rights (art. 7, II and VI) |
4. Who we share it with
We do not sell or rent your data. We use providers that process data on our behalf (processors):
- Supabase — database, login, and server functions. Servers in the United States (us-west-2 region, Oregon).
- Anthropic — artificial intelligence (Claude models) that generates workouts, plans, and adjustments. United States.
- Resend — email delivery (for example, an internal notice of feedback received). United States.
- GitHub Pages — hosting of the app files. United States.
- Google Fonts — loading of text fonts; Google receives your IP and browser data in this request.
- Strava — only if you connect your account; Strava's policy also applies.
With other people: only what you decide. Friends see what the app shows in the social features (for example, rankings and challenge check-ins, and scheduled races according to your privacy settings). Reports are seen only by those you invite, and you can revoke access.
Your coach (if you have one) sees only what you allow when you accept the invitation, and you can change or turn this off at any time in My coach. Your phone number is shown to the coach only if you have filled it in and left that permission turned on.
We may also disclose data if there is a court order or legal obligation.
5. Artificial intelligence
When you use an AI feature (generating workouts, a running plan, importing history, adjusting the week), the app sends the AI service only the information needed for that request, such as goal, level, available days, equipment, limitations you reported, and recent workout data. We do not send your email to the AI.
In the import history feature, the text or images you submit (for example, an exported conversation) are sent to the AI only to extract the workouts, and we do not keep the original file, only the workouts you accept to import. If the conversation contains messages from other people, submit only what is yours.
According to Anthropic's commercial terms for API use, data sent is not used to train its models. These terms may change, and its policy also applies to the processing.
The AI's suggestions are generated automatically, may contain errors, and do not replace the guidance of a doctor, physical therapist, or physical education professional. You can review, edit, and reject any suggestion. No decision with legal effect is made about you through automated means alone.
6. International transfer
Because the providers above are located in the United States, your data is transferred outside Brazil. We do this on the basis of your consent and the performance of the service, and we choose vendors that adopt security measures and data protection contractual clauses.
7. How long we keep it
- Account and workout data: for as long as the account exists.
- When you delete the account: we then delete your data from the database, including workouts, activities, check-ins, friendships, feedback, and the Strava connection. The provider's backups may retain the data for up to about 30 days until they are overwritten.
- Error and app open logs: kept for a limited time and removed along with the account when associated with you.
- We may keep the minimum necessary for a legally required period, if the law requires it.
Note about Strava: when you delete your account, the authorization on Strava's side is not revoked automatically. To cancel it, remove Movo in Strava → Settings → My Apps.
8. Your rights
Under the LGPD you can, at any time: confirm that we process your data; access it; correct it; anonymize, block, or delete unnecessary data; request portability; find out with whom we share it; withdraw consent; and object to processing.
- Download your data: Settings → Your data → Download my data.
- Delete the account and data: Settings → Your data → Delete my account.
- Other requests: write to contato@movoapp.com.br. We respond within 15 days.
If you believe your rights have not been honored, you can file a complaint with Brazil's National Data Protection Authority (Autoridade Nacional de Proteção de Dados, ANPD) — gov.br/anpd.
9. Security
We use an encrypted connection (HTTPS), per-account access control in the database (each person can access only their own data), server functions with restricted permissions, and passwordless login by link or code sent to your email. No system is 100% secure. If there is an incident that may pose a significant risk to you, we will notify you and the ANPD, as required by law.
10. Children and teenagers
Movo is intended for people 18 years of age or older. We do not knowingly collect data from minors. If you notice that a minor has created an account, write to us and we will delete it.
11. Cookies and local storage
The app uses browser storage (localStorage and cache) to keep you logged in, store your data on your device, and work offline. We do not use advertising cookies or third-party tracking tools for ads.
Marketing website (movoapp.com.br). Movo's presentation page stores only aggregated, anonymous daily counters, such as the number of visits, clicks on buttons, and videos played, and the source given in the link (for example, instagram). We do not use cookies, we do not identify the person, we do not record IP or device data, and we respect the browser's "Do Not Track" signal. We do not use Google Analytics, Meta Pixel, or similar tools.
12. Changes to this policy
We may update this policy. For significant changes, we will notify you within the app before they take effect, and we will ask for new consent when the law requires it. The date at the top shows the current version.
Movo — Andre Durso. Questions: contato@movoapp.com.br.