Legal
Security
Last updated August 31, 2026
- Sessions are HTTP-only cookies (web) or bearer JWTs in OS secure storage (native). JWTs identify a user id, not an email.
- Media in production is private object storage with short-lived signed URLs. Deleting an item deletes the object.
- Public scan tokens are 256-bit URL-safe random values. Invite tokens are similar.
- State-changing API calls from browsers must present an allowed Origin. Stripe webhooks verify a signature.
- Auth, scan, upload, and Ask MoveIt endpoints are rate limited.
- Household password login is disabled in production unless explicitly enabled, and it is not a super-admin backdoor.
- Audit events record logins, exports, billing changes, and deletions.
- Report vulnerabilities to support@ilike2moveitmoveit.com.
These pages are written to match the product as shipped. They are not a substitute for advice from your own counsel. Request a review before you rely on them as a filed contract or DPA.