Scope and operator
This policy applies to the Three Moves website, free tools, account, planning system, community features, public Builder Cards, Proof Board, guest tests, and related support. Three Moves is the operator and controller of account data processed for the hosted service. The operator address is Somewhere in the jungle. Costa Rica.. Contact hey@threemoves.app for privacy requests.
A separately self-hosted installation may have a different controller: the person or organization operating that installation. Their hosting, provider, and retention choices may differ from this policy.
Data we collect
We collect data from you, people responding to tests you create, connected providers, product usage, and public pages you ask us to inspect.
| Category | Examples |
|---|---|
| Account and preferences | Email, display name, timezone, reminder settings, public-profile choices, authentication sessions, and magic-link records. |
| Product and market context | Product name and URL, buyer, problem, offer, price, channel, budget, strategy, plans, drafts, contacts, buyer language, experiment results, and outcome reports. |
| Community and guest content | Feedback requests and responses, reports, accountability nudges, public Builder Card fields, proof you publish, and guest-test names, optional emails, and answers. |
| Usage and security | Feature events, timestamps, referral and attribution codes, aggregate tracked-link clicks, delivery status, browser-stored tool history, and short-lived hashed rate-limit identifiers derived from request addresses. |
| Commerce and integrations | Purchase amount and status, Creem customer/order identifiers, refund status, AI-credit ledger, and an optional read-only connected Stripe account identifier. |
| AI metadata | Purpose, configured provider and model, token counts, cost, generation identifier, and success status. Generated plans or analyses are stored where needed to provide the feature. |
Do not enter sensitive data. Three Moves is not designed for passwords, API keys, payment-card numbers, government identifiers, health information, or confidential buyer data you are not allowed to process.
Why we use data
| Purpose | Typical basis |
|---|---|
| Provide accounts, plans, tools, reminders, integrations, purchases, support, exports, and deletion. | Perform the service you requested or take steps at your request. |
| Protect accounts, rate-limit public endpoints, prevent fraud and abuse, debug failures, and maintain service reliability. | Legitimate operational and security interests. |
| Measure activation and improve the product using first-party events and aggregate trends. | Legitimate product-improvement interests. |
| Publish a Builder Card, proof, or buyer objection; send an optional reminder; or enable optional sharing. | Your affirmative choice or consent, which you can withdraw. |
| Maintain payment, tax, dispute, and legally required records. | Legal obligations and legitimate claims-management interests. |
Three Moves does not make decisions that produce legal or similarly significant effects about you. AI suggestions remain recommendations; you decide whether to accept a strategy, send a message, publish proof, or change the product.
Providers and disclosure
We disclose only the data reasonably needed to operate a feature:
- Creem acts as merchant of record for checkout, payment processing, tax handling, receipts, disputes, and refunds. Three Moves does not store full payment-card details.
- Stripe is an optional, read-only outcome-verification integration for a builder’s own product revenue. It does not process Three Moves purchases.
- Resend or the configured email provider delivers magic links, reminders, and operational emails.
- OpenRouter or a configured AI provider processes prompts for enabled AI features.
- Hosting, database, backup, and security providers process service data as infrastructure.
- Authorities or advisers may receive information when required by law or reasonably necessary to protect rights, safety, users, or the service.
No data brokerage. We do not sell or rent personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the preceding twelve months.
If the business is reorganized, financed, acquired, or sold, service data may transfer as part of that transaction subject to appropriate notice and the protections required by law.
AI and public URL inspection
When you use an AI-powered feature, Three Moves sends the configured provider the relevant product, buyer, offer, channel, constraint, or message context needed for that request. Provider and model names may vary by task and deployment. Their handling is also governed by their own terms and privacy documentation.
We store generated plans, analyses, or replies when needed in your workspace and store usage metadata for credits, cost control, reliability, and support. Do not paste secrets or sensitive personal information into prompts, buyer notes, or Marketing Inbox items.
The landing-page grader requests only the public HTTPS page you submit, processes its public HTML in memory, and does not receive source code, private deployment access, or credentials. During signed-in onboarding, when AI is enabled, a bounded excerpt of that public page copy may be sent to the configured AI provider to draft product, buyer, problem, offer, channel, and proof-target assumptions for you to review. Only submit URLs you are permitted to inspect.
Community, guest tests, and public proof
Feedback requests show the product context needed to perform the requested test. Buyer objections are shared only after explicit consent. Feedback responses and reports are visible to the relevant builder and, where needed, the founder operating moderation.
Builder Cards are private by default. Proof is also private until you publish it. If you publish a Builder Card, the handle, bio, product details, selected contact link, and any stats or active experiment you enable become public. Proof reaches the Proof Board only when the required public settings are on and you explicitly add it. Turning your Builder Card off removes your proofs from the board.
Guest testers can answer without an account. Their name, optional email, and answers are shown to the builder who created the test. Marketing Inbox items, buyer records, private notes, revenue details, and follower counts are not made public by default.
Unpublishing removes content from Three Moves public surfaces. Copies someone already saved, search-engine caches, or third-party shares may remain outside our control.
Retention, security, and international processing
- Workspace and account data is generally kept while the account is active and removed when you use account deletion, subject to legal, fraud-prevention, dispute, and backup exceptions.
- Magic links expire after 15 minutes and hosted sessions after 30 days. Expiration prevents use; limited records may remain for security and support.
- Reminder and delivery records may remain after sending or cancellation for operations, abuse prevention, and support.
- Payment and refund records may be retained by Creem and, where required, by the operator for tax, accounting, fraud, or dispute purposes. Optional imported revenue evidence may also remain subject to Stripe’s retention terms.
- Deleted data may remain in restricted backups until those backups are overwritten under the operator’s backup schedule.
We use access controls, expiring authentication, hashed session tokens, rate limits, signed payment webhooks, and other safeguards described on the Security page. No online service can guarantee absolute security.
Three Moves and its providers may process data in countries other than yours. Where transfer safeguards are legally required, the operator relies on the applicable provider terms and legally recognized transfer mechanisms. Contact us for information relevant to your location.
Your choices and privacy rights
Settings lets you change sharing, reminders, public-profile fields, and proof visibility; download an account export; and delete account and project data. You can also ask us to access, correct, delete, restrict, object to, or provide a portable copy of personal data where those rights apply.
Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. You may also complain to the data-protection authority where you live. We will not discriminate against you for exercising applicable privacy rights.
California residents may, where applicable, request categories or specific pieces of personal information, correction, deletion, and information about disclosure. Because Three Moves does not sell personal information or share it for cross-context behavioral advertising, there is no sale or advertising-share opt-out to process. An authorized agent may submit a request where permitted, but we may verify authority and identity.
Submit a request to hey@threemoves.app. We may ask for information needed to verify the account and will respond within the period required by applicable law.
Children, policy changes, and contact
Three Moves is a business product for adults and is not directed to children. You must be at least 18, or the age of legal majority where you live, to create an account. If we learn that a child provided personal information, contact us so it can be reviewed and deleted as required.
We may update this policy when the product, providers, or law changes. Material changes will be posted here with a new effective date and, when appropriate, communicated through the service or by email.
Privacy questions and requests: hey@threemoves.app. Postal contact: Somewhere in the jungle. Costa Rica.. For service rules, read the Terms.