Privacy Policy

Last updated: 19 October 2026

your.move (the "app") is a private messaging and game app for two consenting partners. This policy explains what we collect, why, and what we do not.

What we collect

• Account: there is no email, password, or social login. On first launch we create an anonymous account for you, handled by Supabase Auth. We do not ask for or store your name, email, or phone number to sign in.
• Couple link: a randomly generated game code that links your account to your partner's account. If one of you gets a new phone, the other sends a one-time link from their phone and confirms it before anything is shared.
• Profile and moods: your sex and relationship type, which the game needs to deal the right cards, plus an optional display name, profile photo and status line. When you invite your partner you can also enter their name. You can change all of these anytime. Your profile and the moods you share with your partner are stored without end-to-end encryption, so we could read them.
• Message and wishlist text: stored on our servers end-to-end encrypted. Only you and your partner hold the keys. We cannot read message contents or wishlist items. When you set up a new device, the encryption key is transferred directly from your partner's device to yours, encrypted so that our servers never hold a key that could read your messages.
• Invite treat: the treat you pick or write when creating an invite, including any photo, video, or voice note attached to it, is encrypted before it reaches our servers. That encryption uses a key generated from the invite code itself rather than a device-only secret, because your partner needs to unlock it before they even have an account. It is a weaker guarantee than messages get: the key comes from data we already store, so we could derive it ourselves. We do not, as a matter of policy, but you should know it is possible.
• Custom card text: the title and flavour text you write for your own task or reward card in your deck is stored on our servers as plain text, not encrypted. We can read this text, and may look at it internally to understand what couples create and to improve the game. We never sell it, publish it, or hand it to advertisers, and there is no name or email on your account to attach it to.
• Doodles: from version 1.12, a drawing you send with the Doodle card is stored on our servers as plain text (the lines of the drawing), not encrypted. That is what lets your partner's home screen widget show it even while the app is closed. We could see these drawings; we never sell, publish or share them. Doodles sent with earlier versions stay encrypted.
• Widget token: if you add the home screen widget, your phone creates a random token so the widget can fetch your partner's latest doodle. We store only a fingerprint of that token, and it is deleted when you sign out.
• Get Kinky: if you both turn on Get Kinky, the habits you add (including ones you write yourself), your daily check-ins and, if you use it, your Kink Compass answers are stored without end-to-end encryption so the game can run. Aftercare notes are end-to-end encrypted. The usage analytics below can show that you use Get Kinky and which of our ready-made habits you tap; what you write yourself never goes there.
• Gameplay metadata: to run the game we store some move data unencrypted: which card was played, its category, status, timestamps and deadlines. This lets us deliver and display moves, but it is not the private text you write.
• Custom photos / videos / voice notes: once you are linked, if you attach media to a move or to a custom card, the file is encrypted on your device before upload with your couple's own key. We store the encrypted bytes; we cannot decrypt them.
• Purchases: if you buy Plus, Apple or Google take the payment. We receive and keep the store's receipt (which product, when, the price and the transaction number) to unlock it for both of you. The purchase is also reported to our analytics and to Singular. We never see your card details.
• Push tokens: Apple / Google push tokens, which reach Apple and Google through Expo's push service, so we can deliver notifications. Notifications contain no message content, only a generic alert.
• Support chat: if you write to us from Help, your message, this phone's install identifier and the app's recent diagnostic log go to DonkeyCat's own support system, so we can answer and find the problem.
• Diagnostics and usage analytics: error and crash logs, plus a record of what you do in the app (screens opened, a move sent, a purchase attempted) so we can fix bugs and see which features get used. Events carry categories, counts and yes/no flags: for example, that a move in the heat category was sent. Never your card text, message text, wishlist wording or media. This runs through Google Analytics for Firebase, Firebase Crashlytics and DonkeyCat's own telemetry, tied to a random per-install identifier and your couple's random id, not to your name or email. On iOS that identifier survives reinstalling the app. Google Analytics also estimates your country and city from your network address.
• Tap trail: from version 1.12, DonkeyCat's own telemetry also records how you move through the app: each screen you open, and each tap, long press and swipe, with where on the screen it landed (a position, never a picture of the screen) and which button it hit. A button is named by the app's own label for it, such as “Cancel” or one of our ready-made options, never by anything you or your partner wrote, and nothing you type is recorded. It shows us which buttons people use and where they tap on things that are not buttons. It goes only to DonkeyCat's servers, tied to the same per-install identifier.
• Ad measurement: we use Singular to learn which of our ads led to an install. Singular receives your device's identifiers (on Android, including the advertising ID), its network address and model, and a few app events: first start, finishing the tutorial, linking with your partner, the first move and Plus purchases. To measure our ads on Facebook and Instagram, Singular passes installs and these events on to Meta. On iPhone the app never asks to track you, so your iPhone's advertising identifier is not read.

What we do not collect

• We cannot read your messages, your wishlist or the media you send each other.
• We do not sell your data and we show no ads. The only data that reaches an advertising company is the ad measurement described above, which Meta receives through Singular.
• We never send your private content (messages, wishlist items, invite treats, custom card text, doodles or media) to any analytics or advertising service. Messages, wishlist items, invite treats and media are encrypted before they leave your device, so we could not forward the originals even if we wanted to. Custom card text and doodles are simply never forwarded anywhere, by policy.
• We do not collect your contacts, your calendar or your precise location. The app uses the camera and microphone only when you take a photo or video or record a voice note to send.

Who has access

• You and your linked partner: full access to your shared content in the app.
• Our servers (hosted on Supabase) store your data. Message, wishlist and post-link media content is encrypted with a key we never hold; we cannot read it. Invite treats are encrypted too, but with a key we could derive ourselves, so we do not treat that as an absolute guarantee. Custom card text, doodles, your profile, moods and Get Kinky habits are stored as plain text and can be read by us.
• Expo, Apple and Google push services receive the push token and a generic alert.
• Google (Firebase Analytics and Crashlytics) and DonkeyCat's own telemetry and support system receive the usage events, tap trail and diagnostics described above, never your content.
• Singular, and through it Meta, receive the ad measurement data described above.
• No one else.

Data retention

Your data lives until you delete it. You can delete individual moves and rewards in the app. You can also delete your entire account in Settings → Account & safety → Delete my account. That removes your account, your messages, moves, rewards and profile from our live database at once, and from our backups within 7 days. A few things stay after that, such as stored files and the ended game record; the page below lists them, and we delete them within 30 days if you email us. Usage analytics, the tap trail and diagnostics are stored under the per-install identifier rather than your account, so deleting the account does not remove them. Email us and we will delete them.

The Delete your account page shows each step, how to ask without the app, and what is kept.

Children

your.move is intended for users aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has signed up, contact yourmove@donkeycat.com.

Your rights

Under GDPR / CCPA you have the right to access, correct, or delete your data, and to request a copy. Email yourmove@donkeycat.com and we'll respond within 30 days.

Changes

If we change this policy materially we will surface a notice in the app and update the date above. Continued use after a change means you accept the updated policy.

Contact

Questions? yourmove@donkeycat.com.