Privacy policy

Last updated: 11 August 2026

Who we are

The Motion app and the website motion-app.com are developed and operated by Always Together Limited, a company registered in England and Wales (company number 10678960) with its registered office at Pond House, 20 Village Way, Dulwich, London, SE21 7AN, United Kingdom. Where this policy says “we”, “us” or “Motion”, it means Always Together, which is the data controller responsible for your personal data under UK data protection law.

If you have any questions about this policy, or about deleting or correcting your personal data, please contact us at info@motion-app.com.

Your privacy is critically important to us. We have a few fundamental principles:

  • We don’t ask you for personal information unless we truly need it.
  • We don’t share your personal information with anyone except as described in this policy — and we never sell it.
  • We don’t keep personal information for longer than we need it to run the service.

The data we collect

Account data

When you create a Motion account you sign in with Sign in with Apple (on iOS) or Google Sign-In (on Android). We receive a unique account identifier from that provider and, depending on the choices you make there, the name and email address associated with your Apple or Google account. We also ask you to choose a display name. Accounts created before we retired phone-number signup can still sign in with a phone number, which we hold for as long as the account uses it (sign-in codes are sent via Amazon Web Services). You can also add optional profile details such as a photo. If you contact us or sign up for updates, we’ll hold the email address you give us.

Personal bio information

You can optionally enter the following in the app. It is used only to calculate your unique Motion score, is never shared with other users, and is not collected from Health Connect or any other connected health platform:

  • Height
  • Weight
  • Date of birth
  • Biological sex

Health and activity data

Motion works by reading activity data from the health platforms and devices you choose to connect (Apple Health, Health Connect, Google Fit, the Google Health API — including Fitbit devices — and Garmin). We access only the data required to operate features directly available to you:

Daily summary data

  • Steps — displayed to you, and used to calculate your unique score.
  • Active energy — used to calculate your unique score.
  • Distance — displayed to you, and used to calculate your unique score.

Workout data

  • Type, name and description — displayed to you.
  • Start and end time — displayed, and used to determine active duration.
  • Total calories burned — displayed, and used to calculate your unique score.
  • Laps — displayed for relevant activities like pool swimming and track running.
  • Total distance travelled — displayed for distance-based activities like running and cycling.

Technical and usage data

Like most internet services, we collect technical information that browsers, apps and servers typically make available, such as device and browser type, language preference, referring site, IP address, and the date and time of each request. We also collect information about how features in the app are used, via our own self-hosted analytics (see “How we share your data” below).

How we use your data

We use your data only to provide and improve Motion’s user-facing features. Specifically:

  • To provide the service — calculating your score, showing your activity history, and running features like teams, battles and challenges. Our legal basis is the performance of our contract with you.
  • Health and activity data — processed only with your explicit consent, which you give when you connect a health platform and grant its permissions. You can withdraw consent at any time by disconnecting the platform in the app or in the platform’s own settings.
  • To keep the service secure — preventing fraud and abuse (for example, protecting our sign-in flow from automated attacks). Our legal basis is our legitimate interest in keeping Motion safe.
  • To improve the app — understanding in aggregate how features are used. Our legal basis is our legitimate interest in improving the service.
  • To communicate with you — service messages about your account, and (only if you’ve opted in) occasional product updates you can unsubscribe from at any time.
  • To comply with the law — for example, keeping purchase records we’re legally required to retain.

We never:

  • sell or rent your personal data to anyone;
  • use your data for third-party or targeted advertising;
  • transfer your data to data brokers or information resellers, or use it to determine credit-worthiness or for lending purposes; or
  • use data obtained from Google APIs or any connected health platform to develop, improve, or train generalised (non-personalised) AI or machine-learning models.

Connected health platforms

Health platforms only share data with Motion when you explicitly connect them and grant permission, and you can disconnect them at any time. What we access and how we use it is described in “The data we collect” above; the platform-specific commitments below also apply.

Apple Health

With your permission, we read steps, active energy, distance and workout data from Apple Health (HealthKit). We do not use HealthKit data for advertising or marketing, and we do not share it with third parties except as described in this policy.

Health Connect

You can choose to connect and share your information with Health Connect, and your Health Connect information with Motion. Our use of information received from Health Connect will adhere to the Health Connect permissions policy, including the Limited Use requirements.

Google Fit

With your permission, we read your daily and weekly steps, distance, and workout sessions (including sessions added to Google Fit by other apps) so we can add them to your progress, as outlined above.

Google Health API (including Fitbit)

If you connect a Fitbit device or Google account, we access your daily summary and intraday activity data (steps, distance, and active energy) and your workout sessions through the Google Health API, and use them to display your activity and calculate your unique score, as outlined above. Motion’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Garmin

If you connect a Garmin account, we receive your activity and workout data through Garmin’s API with your authorisation, and use it in the same way as described above.

How we share your data

With other users

Your activity data is shared with other Motion users only where you explicitly choose to share it — for example, by joining a team with friends, entering a battle, or appearing on a leaderboard. Your personal bio information is never shared with other users.

With service providers

We use a small number of service providers who process data on our behalf, under contracts that prevent them using it for their own purposes:

  • Amazon Web Services (AWS) — cloud infrastructure that hosts our servers, stores your data in encrypted form, and delivers sign-in SMS codes.
  • Apple and Google — process in-app and app store payments; we never see your payment card details.
  • Stripe — processes card payments for purchases made on our website, such as gift codes; we never see your full card details.
  • Vercel — hosts this website and provides aggregate, cookieless website analytics.

Apple, Google and Stripe handle payments only — none of them ever receive your health or activity data. Analytics for the Motion app run on our own self-hosted infrastructure — no third-party analytics service receives your app data.

When required by law

We may disclose personal data in response to a subpoena, court order or other lawful governmental request, or where we believe in good faith that disclosure is reasonably necessary to protect the rights, property or safety of Always Together, our users, or the public.

Business transfers

If Always Together, or substantially all of its assets, were acquired, or in the unlikely event that Always Together goes out of business or enters bankruptcy, user information would be one of the assets transferred to or acquired by a third party. Any successor would remain bound by this policy in respect of data collected under it, and we would notify you of any such change.

International transfers

Your data is hosted with AWS in the European Economic Area (Ireland, region eu-west-1). Transfers from the UK to the EEA are covered by UK adequacy regulations. If we ever transfer personal data outside the UK or EEA, we will only do so under appropriate safeguards such as the UK International Data Transfer Agreement or Standard Contractual Clauses.

How we protect your data

Your data is encrypted in transit (TLS) and at rest on our servers. Access to production systems is restricted to those who need it, protected by short-lived credentials, and monitored. No internet service can guarantee absolute security, but we review and improve our security practices on an ongoing basis.

How long we keep your data

We keep personal data only for as long as we need it to run Motion:

  • Account, bio, and health & activity data — kept while your account is active. When you delete your account, this data is deleted from our live systems within 30 days, and from encrypted backups within a further 60 days.
  • Disconnected health platforms — if you disconnect a platform, we immediately stop collecting new data from it. Activity already imported remains part of your account history until you delete your account, or you can ask us to remove it sooner.
  • Inactive accounts — if you haven’t used Motion for 24 months, we’ll email you a warning and then delete your account and its data 30 days later.
  • Server logs (including IP addresses) — kept for up to 90 days for security and troubleshooting.
  • Analytics events — held on our own infrastructure, keyed to your account, and deleted when your account is deleted. Fully aggregated, non-identifying statistics may be kept indefinitely.
  • Support correspondence — kept for up to 24 months after our last contact with you.
  • Purchase and tax records — kept for 6 years, as required by UK law.

Deleting your account

You can delete your account, and all personal data we hold with it, at any time from the Account section in the app — see how to delete my account. Deleting your account also revokes Motion’s access to any health platforms you connected. Deletion follows the timelines in the retention section above.

Your rights

Under UK data protection law, you have the right to:

  • access a copy of the personal data we hold about you;
  • have inaccurate data corrected;
  • have your data deleted;
  • restrict or object to our processing of your data, where those rights apply;
  • receive your data in a portable, machine-readable format; and
  • withdraw consent at any time, where processing is based on consent (such as health data), without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, email info@motion-app.com. You also have the right to complain to the UK’s supervisory authority, the Information Commissioner’s Office (ico.org.uk), though we’d appreciate the chance to resolve any concern with you first.

Children

Motion is not intended for children under 13, and our signup process does not allow accounts to be created for them. We do not knowingly collect personal data from children under 13; if you believe a child has created an account, please contact us and we will delete it.

Cookies and website analytics

Our website (motion-app.com) does not set advertising or tracking cookies, and does not use cross-site tracking pixels. That is why you will not see a cookie banner here: there is nothing to consent to.

To understand how the website is used, we rely on privacy-friendly, cookieless analytics:

  • Vercel Analytics counts page views in aggregate (pages visited, referring site, country, and device type). It sets no cookies and does not identify or track individual visitors across sites or sessions.
  • Google Analytics runs permanently in cookieless “consent mode”. It stores nothing on your device and receives only anonymous signals (such as the page URL, timestamp, and browser type), which Google uses to produce modelled, aggregate statistics. It does not build a profile of you and cannot follow you to other websites.

Strictly necessary storage may be used for site functionality (for example, remembering a checkout session while you pay for a gift code). This storage is not used for tracking or advertising.

Changes to this policy

We may update this policy from time to time. If we make a material change — in particular, any change to how we use data received from Google or another connected health platform — we will notify you in the app or by email before the change takes effect. The date at the top of this page shows when it was last updated.

Contacting us

If you have questions about this policy, please email us.