Privacy policy

1. What we process

• Email address: you give it to Dodo Payments at checkout, and to us when you sign in. We use it to find your orders at Dodo Payments, to send you a sign-in code, and to email you about delivery of your purchase. If you sign in with Google, Google shares your name, email address, and profile picture with us, and nothing else from your Google account. Sign-in remains limited to paid customers. Buying, sponsoring, or submitting work does not subscribe you to our newsletter; only submitting the newsletter signup form does.
• Order details: Dodo Payments holds your orders and sponsorship payments: what you bought, when, the amount, and your billing details. Orders stay with Dodo Payments; we read them when needed. For sponsorships we keep a copy of the subscription's status, tier, renewal date, and the Dodo customer email and ID, plus the placement details you submit (name, link, tagline, logo and cover URLs) and our review decision.
• User record: on your first sign-in we save your email address and the time the record was created.
• Sign-in codes and sessions: each emailed code is single-use, works for 10 minutes and allows 5 tries; we store only a hash of it. Once you sign in, a session cookie keeps you signed in for 7 days. It is HttpOnly and Secure, so page scripts can’t read it and it only travels over HTTPS. Alongside the session we store the IP address and user agent it was opened from. Signing out ends the session.
• GitHub username: connecting your GitHub account in the Dodo Payments customer portal shares your GitHub username with Dodo Payments and GitHub for the repository invite, and GitHub lists you as a collaborator on our private repository, where we can see it.
• Contact form messages: the name, email address, subject, and message you enter, sent to our inbox so we can answer you.
• Rate limits: to keep the contact, newsletter, and submission forms from being flooded, we count their requests per IP address using a shared one-minute limit.
• Analytics: we use PostHog to see which pages and features are used. It records page views and actions such as opening a video, copying a prompt, searching, or starting a checkout, with your browser, device type, approximate location from your IP address, and a random id stored in your browser. Inputs are never recorded. It is not used for advertising, and we don’t sell it.
• Language preference: we store your selected language only in your browser’s localStorage under the key motionvideo-locale. No cookie is used for this preference. It stays until you clear your browser’s site data or choose another language.
• Newsletter opt-in: only when you submit the signup form, we store your normalized email address, the time you opted in, and the record’s creation time in our Cloudflare D1 database for MotionVideo updates. Signing up stores your opt-in; it does not send an email. A repeat signup does not create a duplicate.
• Community submissions: we store the category, name, email, title, public URL, description, optional video prompt, attribution consent time, creation time, and pending moderation status in Cloudflare D1. We use these to review your submission and contact you about it if needed. Nothing is automatically published. If accepted, your submitted content and name may be public with your consent; your email stays private. Submitting does not sign you in or join the newsletter.
• Site feedback: when you send feedback, we store your message, the optional rating you picked, the page you sent it from, the time, and either your account email (if signed in) or the email you chose to add, in Cloudflare D1, and email a copy to our inbox. We use it only to improve the site and to reply if you asked.

We use this data to carry out the purchase or sponsorship you asked for, reply when you write to us, maintain the newsletter list you opted into, review community submissions and attribute accepted work, keep the site secure, understand which pages are read, and meet tax and accounting obligations through Dodo Payments. We do not use it for advertising tracking or marketing profiles.

2. Who else sees it

• Dodo Payments: the merchant of record. Payments, invoices, taxes, refunds, sponsorship subscriptions, and GitHub repository invites happen there under Dodo Payments’ privacy policy.
• Cloudflare: hosts the site, our database (D1), the media storage (R2) behind assets.motionvideo.xyz, DNS, email forwarding, and the Turnstile bot check shown before we send a sign-in code, and sees the IP address of every request, as any host does. PostHog runs the analytics described above. Both act under Cloudflare’s privacy policy.
• Resend: delivers our emails, such as sign-in codes, purchase delivery emails, and contact form messages.
• GitHub: hosts the private repository that contains the pack.

Apart from the providers above, we share no personal data unless the law requires it or you have consented to public attribution of an accepted submission. Submission email addresses are never published. These providers run infrastructure in several countries, so your data may be processed outside the country you live in; we rely on the transfer safeguards they offer.

3. How long

• Sign-in codes: 10 minutes.
• Sessions: 7 days, or until you sign out.
• Rate limit counts: one minute.
• User record: until you ask us to delete it.
• Contact messages: in our inbox for as long as they help us support you, and deleted on request.
• Orders, subscriptions, and invoices: under Dodo Payments’ retention rules. Analytics: under PostHog’s.
• Newsletter email and opt-in timestamps: until you withdraw consent or ask us to delete the record by contacting us at the address below.
• Community submissions and attribution consent: while needed for moderation and attribution of accepted work, or until you request deletion using the contact address below.
• Site feedback: while it helps us improve the site, or until you request deletion using the contact address below.

4. Your rights

Depending on where you live, you may ask what we hold about you, ask us to correct it, or ask us to delete it. Write to hello@motionvideo.xyz from the email address you used for your purchase, sponsorship, newsletter signup, or submission so we can find the relevant record. You can withdraw newsletter consent or ask to remove your submission the same way. For purchase-related requests, we also pass deletion requests on to Dodo Payments, where your orders live. You can complain to your local data protection authority. To keep your visits out of our analytics, block us.i.posthog.com in your browser or with a content blocker.

Live presence

While a page is open, your browser keeps an anonymous connection to count how many people are online. With Live cursors on (the default; switch it off in the account menu or with L), your pointer position on the current page is shared with other visitors on that page, shown as an unlabelled coloured cursor. It is tied to a random id that lasts only as long as the tab, and nothing is stored.

5. Children

This site is not intended for children under 13, and we do not knowingly process their data. If we learn that we have, we will delete it.

6. Changes to this policy

We may change this policy. The date at the top says when it last changed.

7. Contact

hello@motionvideo.xyz