Privacy policy

This policy describes how the operator of ilike2moveitmoveit.com, doing business as MoveIt (“MoveIt,” “we,” “us”) handles personal data when you use https://ilike2moveitmoveit.com, the MoveIt web app, and the Android app. Contact: support@ilike2moveitmoveit.com.

1. What we collect

• Account identity. Google Sign-In provides your Google user id, email, name, and avatar. We store those to create a session. We do not receive your Google password.
• Move and household data. Account name, move titles, origin and destination labels and optional street addresses, planned dates, rooms, and team invites (email + role).
• Inventory. Box contents, item names, categories, tags, notes, quantity, fragile/high-value flags, model and serial numbers, estimated values, purchase dates, warranties, keep/store/sell/donate status.
• Media. Item photographs, thumbnails, voice recordings, transcripts, condition photos, and insurance documents (receipts, warranties, manuals, appraisals).
• Operational events. Box lifecycle (sealed, loaded, delivered, unpacked), who marked a checkpoint, and security/audit events such as sign-in, export, billing, and deletion.
• Device data stored locally. Theme preference, active account/move ids, and an offline packing queue (IndexedDB) that can hold photos and voice until they sync.

We do not collect payment card numbers. Stripe processes cards on their pages. We do not store phone numbers or date of birth.

2. How we use it

To provide the product: inventory, labels, mover scan pages, search, Ask MoveIt, reports, billing, support, security, and to meet legal obligations. We do not sell personal data and we do not run advertising pixels.

3. Photos, voice, and AI

When cloud AI is enabled for an account, item photos and voice audio are sent to OpenAI (or a compatible hosted API you configure) to propose names, tags, OCR text, fragile flags, and transcripts. Packing does not wait on that result. You may disable cloud AI per account in Settings; jobs then stay on a local worker or a heuristic fallback. Optional browser speech-to-text (if you enable it) is processed by your browser vendor, not by MoveIt servers.

4. Public QR pages

Each box has a cryptographically random scan token. Anyone with the URL can see what that box’s visibility setting allows. The default is destination room only — not photos, OCR, or voice. Tokens in printed labels are secret; treat a printed sheet like a key. You can regenerate a token if a label is lost.

5. Storage and processors

Application data lives in PostgreSQL on Railway. Media objects live in Cloudflare R2 (or local disk in development). Object access in production uses short-lived signed URLs; the bucket is not world-readable. The web app is served by Vercel. Authentication uses Google. Payments use Stripe. Transactional email uses Resend or Postmark when configured. See subprocessors.

6. Cookies and similar tech

The HTTP-only movebox_session cookie is required to stay signed in (30 days, Secure on HTTPS, SameSite=Lax). Theme and offline queue are local to your device. Analytics, if enabled, is cookieless (Vercel Analytics or Plausible). Details: cookie notice.

7. Retention

We keep account and inventory data until you delete it or the account is unused and you ask us to erase it. Account deletion starts a 30-day grace window, then we hard-delete database rows and media objects we control. Backups roll off on the host’s backup cycle (typically ≤ 30 days). Audit events related to deletion may be kept up to 12 months. Invite emails we collected solely to match an accept are removed with the invite or the account.

8. Your rights

You can access and correct inventory in the app, export CSV/JSON or a full account archive from Settings, and delete your account at /delete-account or in Settings. If you are in the EEA/UK you may also request access, correction, deletion, portability, and restriction via support@ilike2moveitmoveit.com. We honor those requests with the tools above. We do not operate a paid data-selling business, so there is no “do not sell” opt-out beyond not selling.

9. Children

MoveIt is for adults organizing a household move. You must be 18 to create an account. We do not knowingly collect data from children under 13. Household inventory may include photos of a child’s belongings; that is your content, not a child profile.

10. International transfers

We and several processors are in the United States. If you access MoveIt from elsewhere, your data is processed in the US. Subprocessors publish their own transfer mechanisms (including SCCs where they offer them).

11. Changes

We will post an updated date on this page and, for material changes, prompt a new terms/privacy acceptance in the app (current terms version: 2026-08-31).