Privacy policy

1. What we process

• Email address: you give it to us when you sign in, and to Dodo Payments at checkout. We use it to send you sign-in codes, to find your plans and payments at Dodo Payments, and to email you about your account: the welcome email after checkout, a Business seat someone gave you, and the review of your sponsorship, job post, or submission. If you sign in with Google, Google shares your name, email address, and profile picture with us, and nothing else from your Google account.
• Payments: Dodo Payments holds your payments: what you bought, when, the amount, and your billing details. For plans, sponsorships, and job posts we keep a copy of what we need to give you access: the plan or tier, the billing option, the status, the renewal or end date, and the email and Dodo customer, subscription, or payment ID. To show regional pricing, we read the country of your IP address from Cloudflare and ask Dodo Payments which discount applies there; we don’t store it.
• Account: on your first sign-in we save your email address and when the account was created. We also store the name and profile picture you set or that Google shares, the items you bookmark, and the other ways you sign in, such as Google.
• Sign-in codes and sessions: each emailed code is single-use, works for 10 minutes and allows 5 tries; we store only a hash of it. Once you sign in, a session cookie keeps you signed in until 7 days pass without a visit. It is HttpOnly and Secure, so page scripts can’t read it and it only travels over HTTPS. Alongside the session we store the IP address and user agent it was opened from. Signing out ends the session. When you connect an MCP client, we also store that client’s registration, the access and refresh tokens we issue to it, and the consent you give it; if you allow it, the tokens carry your email address, name, and profile picture to the MotionVideo MCP server.
• GitHub username: connecting your GitHub account in the Dodo Payments customer portal shares your GitHub username with Dodo Payments and GitHub for the repository invite, and GitHub lists you as a collaborator on the private repository of the Pro agent skill (or of the Skill Bundle, if you bought it), where we can see it.
• Contact form messages: the name, email address, subject, and message you enter, sent to our inbox so we can answer you.
• Rate limits: to keep sign-in codes, the contact, feedback, and submission forms, and image uploads from being flooded, we count requests per IP address over one-minute windows.
• Analytics: we use PostHog to see which pages and features are used. It records page views and actions such as opening a video, copying a prompt, searching, or starting a checkout, with your browser, device type, approximate location from your IP address, and a random id stored in your browser. Inputs are never recorded, and events are not linked to your account. It is not used for advertising, and we don’t sell it. The sponsor page shows totals from it (visitors, page views, top countries, and referrers), which identify no one.
• Preferences in your browser: a cookie named INTLAYER_LOCALE remembers your language for a year, so an address without a language prefix opens in it. Your theme, sound, and live cursor settings, the template customizer’s fields, and the banners you dismissed stay in your browser’s localStorage and are not sent to us. Clearing your browser’s site data removes them.
• Product emails: now and then we email account holders about MotionVideo: new features, featured work, and offers. To send these, we add your email address and first name to our contact list at Resend. Every such email has a one-click unsubscribe link. Sign-in codes and emails about your account and purchases still reach you, since you need them to use the site.
• Community submissions: you submit while signed in, and the submission is filed under your account email. We store the category, the name you want credited, the title, public URL, description, optional video prompt, when you agreed to attribution, when you submitted, and the review status in Cloudflare D1. We use these to review your submission and to email you about it. Nothing is published automatically. If accepted, your submitted content and name may be public with your consent; your email stays private. Your dashboard shows each submission’s status.
• Business seats: when a Business owner invites you, we store your email address, when you were invited, and when you first signed in to take the seat, and we email you the invite. The owner sees which seats are taken and by which email address.
• Job posts and sponsor placements: the details you enter (for a job post: title, company, location, type, salary, description, and apply link; for a sponsorship: name, link, tagline, logo, and cover), the images you upload, our review decision and note, and the dates it runs. Uploaded images are stored in Cloudflare R2 with your account ID. Once approved, the post or placement and its images are public.
• Site feedback: when you send feedback, we store your message, the optional rating you picked, the page you sent it from, the time, and either your account email (if signed in) or the email you chose to add, in Cloudflare D1, and email a copy to our inbox. We use it only to improve the site and to reply if you asked.
• Live presence: While a page is open, your browser keeps an anonymous connection to count how many people are online. With Live cursors on (the default; switch it off in the account menu or with L), your pointer position on the current page is shared with other visitors on that page, shown as an unlabelled coloured cursor. It is tied to a random id that lasts only as long as the tab, and nothing is stored.

We use this data to give you the plan, sponsorship, or job post you paid for, run your account, reply when you write to us, review community submissions and credit accepted work, send the product emails described above, keep the site secure, understand which pages are read, and meet tax and accounting obligations through Dodo Payments. We do not use it for advertising tracking or marketing profiles.

2. Who else sees it

• Dodo Payments: the merchant of record. Payments, invoices, taxes, refunds, subscriptions, and GitHub repository invites happen there under Dodo Payments’ privacy policy.
• Cloudflare: hosts the site, our database (D1), the media and upload storage (R2) behind assets.motionvideo.xyz, live presence, DNS, email forwarding, and the Turnstile bot check shown before we send a sign-in code, and sees the IP address of every request, as any host does. It acts under Cloudflare’s privacy policy.
• PostHog: runs the analytics described above, in the United States, under PostHog’s privacy policy.
• Resend: delivers our emails, such as sign-in codes, welcome and review emails, and contact form messages, and keeps the contact list for product emails.
• Google: handles Google sign-in, if you use it, under Google’s privacy policy.
• GitHub: hosts the private repositories of the Pro agent skill and the Skill Bundle.

Apart from the providers above, we share no personal data unless the law requires it or you have consented to public attribution of an accepted submission. Submission email addresses are never published. These providers run infrastructure in several countries, so your data may be processed outside the country you live in; we rely on the transfer safeguards they offer. The full list, with where each provider processes data, is on our subprocessors page.

3. How long

• Sign-in codes: 10 minutes.
• Sessions: 7 days, or until you sign out.
• Rate limit counts: one minute.
• Your account, bookmarks, job posts, Business seat invites, and MCP connections: until you delete your account.
• Contact messages: in our inbox for as long as they help us support you, and deleted on request.
• Payments, subscriptions, and invoices: under Dodo Payments’ retention rules. Our copies of paid plans and sponsorships stay after you delete your account, for accounting, no longer linked to it. Analytics: under PostHog’s.
• Product email contact: until you delete your account or ask us to remove it. Unsubscribing stops the emails.
• Community submissions and attribution consent: while needed for moderation and attribution of accepted work, or until you request deletion using the contact address below.
• Site feedback: while it helps us improve the site, or until you request deletion using the contact address below.
• Uploaded images: while they are in use, or until you ask us to delete them.

4. Your rights

Depending on where you live, you may ask what we hold about you, ask us to correct it, or ask us to delete it. You can delete your account yourself from Settings in your dashboard: that removes your account, bookmarks, submissions, feedback, job posts, seat invites, and product email contact. A monthly or annual plan or sponsorship that is still set to renew has to be cancelled first. For anything else, write to hello@motionvideo.xyz from the email address you sign in with, so we can find the relevant record. For purchase-related requests, we also pass deletion requests on to Dodo Payments, where your payments live. You can complain to your local data protection authority. To keep your visits out of our analytics, block us.i.posthog.com in your browser or with a content blocker.

5. Children

This site is not intended for children under 13, and we do not knowingly process their data. If we learn that we have, we will delete it.

6. Changes to this policy

We may change this policy. The date at the top says when it last changed.

7. Contact

hello@motionvideo.xyz