Privacy Policy

Motiv is operated by Northern Software Limited, a company registered in England and Wales under company number 17361376 (“we”, “us”, or “our”). We trade as Motiv and are the controller for the personal information described in this policy. Our registered office and geographic business contact details are provided in the Terms of Use.

You can contact us at hello@motiv.help.

Apple separately processes information for services such as the App Store, Apple Accounts, StoreKit, Maps, location services, notifications, and Screen Time under Apple’s Privacy Policy.

This policy applies to the Motiv app for iPhone and iPad, the website at motiv.help, and support or privacy correspondence. It does not cover third-party websites or services that publish their own privacy information.

• What you write in Motiv — your routines, tasks, blocks, saved places and Focus Score — is kept on your phone and stays there. There is no Motiv account, and no Motiv server to send it to.
• Your phone does the blocking. iOS runs Screen Time and watches the places you set. Apple sees a little when you use Apple Maps or buy a subscription.
• Two optional things can leave your phone: usage statistics and crash reports. Both start switched off, and we only offer them to people who say they are 18 or over.
• While they are off, nothing is sent — and nothing is saved up to send later.
• If you switch one on, Motiv writes a note on your phone of what you chose and when. You can read it under Settings → Your consent record. Switching one off stops it straight away.
• We never sell your information, show you adverts, or follow you around other apps.
• This website counts visits. It sets no cookies and keeps nothing on your device, and you can turn the counting off further down this page.

The rest of this policy is the detail behind those seven lines, in the order it happens: what stays on your phone, what your phone does, what the two optional things send, why we are allowed to do each of them, and what you can ask us for.

Motiv stores information needed to provide the app, including:

• routines, reminders, tasks, notes, schedules, and completion history;
• block profiles and rules;
• saved places, including names, coordinates, geofence radii, and the town or city name looked up for them;
• Focus Score, points, levels, and other progress information;
• permissions and privacy preferences;
• local event and audit records used for app functions, repair, and diagnostics;
• an append-only history of successfully recorded PostHog and Sentry choices, including whether you granted or withdrew consent, when and where you made the choice, the consent-notice and Privacy Policy versions shown, and the installation identifier to which the choice relates; and
• a randomly generated installation identifier and related technical timestamps.

We process most of this information to provide the app you request. We keep the consent history to manage your choices and comply with our legal obligation to demonstrate consent. The history is available under Settings → Your consent record. It is stored locally and is not part of the 90-day event-and-audit log.

A grant fails closed: PostHog or Sentry does not start if Motiv cannot save its receipt. A withdrawal is fail-safe: the provider is stopped first and stays off even if Motiv cannot save the attempted withdrawal receipt. In that unusual case the history may omit the withdrawal, so the current on/off status shown in the app is authoritative.

We do not receive this local information through a Motiv account or sync service. Local event and audit records are automatically pruned after 90 days. Other local information remains until you reset Motiv or uninstall the app, subject to the deletion detail below.

Blocking uses Apple’s Screen Time frameworks, including Family Controls and Device Activity. iOS represents selected apps, categories, and websites with privacy-preserving tokens, and those token values stay on your device.

The Motiv app itself never receives the ordinary names behind those tokens. Two small on-device extensions are given them by iOS so they can do their job: one labels the block screen you see when an app is blocked, and one draws your Screen Time report. Those names go on screen and are then discarded. They are never stored, written to a log, passed back to the Motiv app, or sent anywhere, and neither extension contains any analytics or crash-reporting code.

Apple may process information needed to provide its operating-system services under its own terms.

If you create a location-based block or routine, iOS uses your location to monitor the geofence you configure. Motiv stores the saved place name, coordinates, radius, and rule locally. Coordinates are not included in Motiv product-analytics events, crash reports, notifications, or Screen Time tokens.

Location is not completely offline. Apple MapKit may receive:

• the search terms you type, when you use the in-app map or place search;
• the device location you authorised Motiv to use;
• the map area or search region, the time of the request, and your Maps interactions;
• device, software, network, or performance information; and
• the coordinates of a saved place, when you open your saved places and Motiv has not yet looked up the area name for that place.

That last one happens without a map open. Motiv asks Apple for the town or city name so your saved places can be labelled, and stores the label it gets back on your device. Apple explains what it receives in Apple Maps & Privacy.

You can control Motiv’s location permission in iOS Settings. Location-based features will not work reliably or at all without it.

If you actively enable Help improve Motiv, Motiv uses PostHog to receive pseudonymous, event-level usage information. “Pseudonymous” does not mean anonymous: a randomly generated identifier allows events from the same installation to be understood together.

The permitted events describe app launches, onboarding and permission outcomes, feature types and status changes, counts and durations, completion actions, Focus milestones, and limited paywall or membership outcomes. Some block lifecycle and bypass events include a one-way hashed reference so events about the same block profile can be grouped; this is not the block name or its content. Daily-task and Plan Ahead events may include a local calendar date. If you start a routine from one of Motiv’s built-in starter templates, the event records which template it was; this identifier is written by us and is never your own wording, and health-related templates are recorded only as a redacted value.

The PostHog code library inside the app also adds limited technical context to every event:

• the app’s name, version, build, and identifier;
• the operating-system name and version;
• the device manufacturer, model and type, and the screen dimensions;
• the library’s own name and version;
• your language, time zone, and connection type;
• whether the app is running on a Mac, and whether the build came from TestFlight, was sideloaded, or is running in a simulator;
• a rotating session identifier, so the events from a single session can be read together; and
• two flags recording that this installation is not linked to a person profile.

One of these fields is called “device name”, which sounds more revealing than it is: on iPhone and iPad it is the model class — the word “iPhone” or “iPad” — rather than the name you gave your device.

When the SDK starts it also requests its configuration from PostHog. PostHog necessarily observes network metadata, including the connection’s source IP address, while accepting that configuration request or an event.

Events do not include titles, notes, place names, saved coordinates, selected app or website names, payment-card details, or Apple transaction identifiers. PostHog person profiles, surveys, session recording, automatic screen, element and application-lifecycle capture, rage-click capture, automatic error capture, SDK logs, automatic feature-flag loading and feature-flag events, and server-side GeoIP enrichment are disabled. An app allowlist rejects every PostHog event name that Motiv has not reviewed.

Each analytics event also carries the consent-notice version and the date of the relevant grant, reduced to a UTC calendar day. These two fields let us relate retained events to the consent under which they were collected. Motiv does not send the full local consent history, the exact time of the decision, the decision surface, or the Privacy Policy version to PostHog.

Our lawful basis is your consent. Analytics remains off until you make an affirmative choice in the app, and the choice is offered only if you have declared you are 18 or over — see Intended audience and younger users. While analytics is off, analytics events are dropped rather than stored for later delivery. If you later enable analytics, only events created after that choice are eligible to be sent.

You may withdraw consent at any time under Settings → Privacy. This stops the PostHog SDK and deletes its unsent on-device queues and locally stored PostHog identifiers. A durable local deletion marker makes a later opt-in repeat that purge before PostHog can restart, and the exact time of the current grant is checked locally so an older app outbox or SDK record cannot be sent under a later grant. That exact time is not sent to PostHog.

While analytics is on, Settings → Your consent record shows the pseudonymous PostHog identifier your events are stored under, with a control to copy it. It is generated by the PostHog software, not by us, and it is not the installation identifier shown against your consent decisions — PostHog has never seen that one. Send us the analytics identifier and we can find, export, or delete the records it belongs to.

We do not keep a link between that identifier and your identity, and it changes whenever you reset Motiv or turn sharing off and on again. So if you ask after it has changed, we may be unable to identify the earlier records as yours. You may still contact us with any information available to you; we will make reasonable efforts without collecting extra identifying information merely to create a link that did not previously exist.

The production PostHog project uses PostHog Cloud EU in Frankfurt. PostHog’s current free plan guarantees at least one year of data retention and does not let us set a shorter period, so we cannot promise that analytics data is deleted at twelve months. We ask PostHog to delete records on request where you give us the identifier.

If you actively enable Crash reports, Motiv uses Sentry to receive crash and error information so we can diagnose faults. A report may contain an error code, stack trace, app version, operating-system and device information, timestamps, and limited technical tags.

Motiv configures Sentry not to attach screenshots, view hierarchies, user identity or persistent app/device hashes, request details, automatic breadcrumbs, failed network requests, logs, performance traces or profiles, app-hang or watchdog reports, SDK metrics or client reports, or default personal information. Reports do not intentionally contain app content, saved places, coordinates, or Screen Time selections.

Sentry necessarily observes network metadata, including the connection’s source IP address, while accepting a report. The production Sentry project is configured to prevent storage of source IP addresses.

Reports also carry the consent-notice version and the date of the relevant grant, reduced to a UTC calendar day. Motiv does not send the full local consent history, the exact time of the decision, the decision surface, or the Privacy Policy version to Sentry.

Our lawful basis is your consent. Crash reporting remains off until you make an affirmative choice, and the choice is offered only if you have declared you are 18 or over — see Intended audience and younger users. You may withdraw consent at any time under Settings → Privacy. Motiv first clears the current grant, cancels and closes the main app’s Sentry transport, and deletes Sentry’s shared on-device queue. A Device Activity Monitor extension that was already running may not receive an immediate shutdown instruction and could still create a local diagnostic after that first deletion. A durable deletion marker causes another purge before any app or extension can restart Sentry, and the exact time of the current grant is checked locally before sending, so a report created before that grant is rejected rather than revived after re-consent. The exact grant time is not sent to Sentry. Contact us if you want us to try to locate and delete a report already received by Sentry.

The production Sentry project uses Sentry’s EU service in Germany. We keep crash and error event data in our project for no more than 30 days, using the default 30-day lookback on Sentry’s current free Developer plan. Sentry may retain limited service or security records, or isolate records it is legally required to keep, as permitted by its data-processing terms.

The website is a static site hosted using GitHub Pages. When you visit it, GitHub and network providers may process technical request information such as your IP address, browser or device information, requested page, and timestamp to deliver and secure the site. We rely on our legitimate interests in providing and protecting the website, balanced against your rights.

The website measures visits using Cloudflare Web Analytics. A small script records the page you requested, the referring site if you arrived from a link, and standard browser, device, and page-performance information. To do that it reads your browser’s user-agent string, the referring address, and the page-timing information your browser records. Cloudflare also receives your IP address as part of the request and derives an approximate country from it.

The script sets no cookies and writes nothing to your browser’s storage, it does not build a device fingerprint, and it does not follow you to other websites.

We rely on the statistical purposes exception in the Privacy and Electronic Communications Regulations, which covers measuring how a service is used in order to improve it. That exception requires us to give you a simple, free way to object, so you can turn this measurement off for your browser using the switch below. If your browser sends a Global Privacy Control signal we treat that as an objection too, and leave the switch alone rather than overriding you. Any browser setting or extension that blocks the script also works, and we do not try to defeat them.

Turning it off records one small item in your browser’s storage — the fact that you objected. We need that to remember your choice, and we use it for nothing else.

Our lawful basis for the measurement itself is our legitimate interests in understanding which pages are useful and whether the site performs well, balanced against your rights. Cloudflare keeps complete measurement data for 7 days. After that it keeps a sample of roughly 10% rather than the whole record, and we can view reports for up to six months.

The website is served without the Cloudflare proxy in front of it, so Cloudflare does not receive or inspect the ordinary traffic between you and GitHub Pages. It receives only what the measurement script sends.

If you contact us, we process your email address, message, attachments, and correspondence to answer the request. Our lawful basis is taking steps at your request, performing our contract with you, and our legitimate interests in supporting and improving Motiv. Please do not send sensitive information that is not needed to resolve the issue. We delete correspondence when it is no longer reasonably needed for the request or a related legal obligation.

Motiv Plus is sold through Apple’s App Store using StoreKit. Apple processes payment details, billing information, purchase history, refunds, and subscription management under its own privacy terms. We do not receive your full payment-card details.

Motiv receives and stores the StoreKit information needed to determine whether Plus is active. If product analytics is enabled, a limited paywall or membership outcome may also be sent to PostHog without an Apple transaction identifier.

Most of what Motiv does happens on your device to give you the app you asked for. This table names our lawful basis under UK data-protection law for each thing we do.

You do not have to give us any personal information to use Motiv. Some features need a permission from iOS — location, notifications, Screen Time — and will not work without it, but that information stays on your device.

Depending on the features you use, information may be processed by:

• Apple, for the App Store, StoreKit, MapKit, location permissions, notifications, and Screen Time frameworks;
• PostHog, for optional product analytics;
• Sentry, for optional crash and error reporting;
• GitHub, for static website hosting;
• Cloudflare, for cookieless website measurement; and
• our email provider, for support and privacy correspondence.

We do not sell personal information or share it for advertising or cross-app tracking. We may disclose limited information where the law requires it, to protect legal rights or safety, or as part of a genuine business reorganisation with appropriate safeguards.

Before we allow a service provider acting for us to receive personal information, we require it to provide the same or equal protection of that information as this policy and Apple’s App Review Guidelines require. We use contractual terms and proportionate technical and organisational checks to support that requirement, and we remain responsible for selecting and configuring our providers appropriately.

The production PostHog and Sentry projects are hosted in the European Economic Area. UK adequacy regulations allow personal information to flow from the UK to the EEA. Those providers and their subprocessors may make further transfers under their data-processing terms and appropriate safeguards.

GitHub, Cloudflare, our email provider, or another independent Apple service may process information outside the UK. Where we are responsible for a restricted transfer, we use an applicable adequacy regulation or contractual safeguard such as the UK International Data Transfer Agreement or UK Addendum. Email privacy@motiv.help and we will send you a copy of the safeguard relevant to your information.

Different information has different retention periods:

• local app content remains until you delete it or uninstall Motiv;
• local event and audit records are kept for up to 90 days;
• local consent records remain until you uninstall the app — they survive Reset Motiv, because we must be able to demonstrate your consent for as long as a provider still holds data collected under it;
• PostHog analytics data is retained for at least one year, which is the shortest period its current free plan allows us to set;
• Sentry crash and error event data is kept in our project for up to 30 days;
• Cloudflare website measurement data is kept in detail for 7 days and in aggregated form for up to six months; and
• support and privacy correspondence is kept only while reasonably needed for the request or a related legal obligation.

Reset Motiv removes user-created database records, settings, notifications, Screen Time monitoring, locally stored secrets, local analytics events, and the provider-facing consent fields stored in the app group. It keeps your consent record. A provider may still hold data collected under a consent you gave — PostHog for at least a year — and we are required to be able to demonstrate that consent for as long as processing under it continues, so destroying the evidence while the data survives would leave us unable to answer for it. We keep it under our legal obligation rather than your consent, which is why the erasure right does not extend to it. It stays on your device, is never sent anywhere, and is deleted with everything else when you uninstall Motiv. You can read it at any time under Settings → Your consent record. If analytics or crash reporting is active, reset stops that provider in the main app and purges its on-device queue and identifiers. It currently preserves a technical installation record containing an installation identifier, app-instance identifier, and timestamps so the running app can continue to save data correctly, together with a small amount of technical bookkeeping: the database’s own schema state, the address our crash reports would be sent to, and the markers that force analytics and crash reporting to purge again before either could restart. That bookkeeping exists to protect a withdrawal rather than to record anything about you. Nothing preserved contains routines, blocks, usage events, locations, or consent choices.

Resetting Motiv does not delete information already received by Apple, PostHog, Sentry, GitHub, Cloudflare, or an email provider. Provider data already sent remains subject to the retention periods and rights process described in this policy.

Deleting the app removes its app-container data from that device, subject to iOS behaviour. It does not cancel a subscription or automatically erase information already held by a service provider.

Where we rely on legitimate interests, we have carried out a balancing assessment weighing our interests against your rights, and we will provide a summary of it on request.

Under UK data-protection law you have the right to:

• be told how your information is used — this policy;
• ask for a copy of the information we hold about you;
• ask us to correct information that is wrong;
• ask us to delete information, or to restrict how we use it;
• object to anything we do on the basis of our legitimate interests;
• receive information in a portable format;
• withdraw either consent, at any time, under Settings → Privacy;
• not be subject to a solely automated decision with legal or similar effects; and
• complain, both to us and to the Information Commissioner’s Office.

Your right to object. Where we rely on legitimate interests — website hosting and security, website measurement, keeping support correspondence, and the local records that keep the app working — you can object at any time. We will stop unless we can show compelling legitimate grounds that override your interests, and we will explain our reasoning either way.

Withdrawing a consent does not make our earlier use of that information unlawful. It stops the processing from that point on.

Motiv does not use personal information to make solely automated decisions with legal or similarly significant effects. Motiv does analyse your own activity to work out your Focus Score, points and level. That is a form of profiling, but it happens only on your device, we never see it, and it makes no decision about you.

To exercise a right, email privacy@motiv.help. We will respond within one month. If your request is complex or you have made several, we may extend that by up to two further months, and we will tell you within the first month if we do. We may need enough information to locate the relevant record and verify that the request relates to you. Because Motiv has no account and intentionally does not know your identity, we may be unable to identify a pseudonymous vendor record without an identifier or other details from your device.

Settings → Data → Export writes everything Motiv holds on your device to a file you can save or send elsewhere. It is the quickest way to get a portable copy, and it runs entirely on your device.

Your consent record is a convenient view of the decisions stored on your device; it is not a substitute for a statutory access request and does not display information already held by PostHog or Sentry.

Motiv is designed and marketed as a productivity tool for adults. It is not directed at children. The App Store’s 4+ rating describes the suitability of the app’s content; it does not identify the intended audience, verify age, or decide whether children’s privacy rules apply.

We do not ask for a date of birth or profile people by age. We have assessed whether children are likely to access Motiv, looking at the nature and presentation of the service, evidence about how it is actually used, and comparable services — and we have not concluded that they are unlikely to. Until better evidence supports a different answer, we apply the ICO’s Children’s Code proportionately.

High-privacy defaults apply to everyone: optional analytics and crash reporting are off until you turn them on, location is used only for a feature you choose and only after you grant the iOS permission, and personal information is never used for advertising or cross-app profiling.

Optional data sharing is offered only to adults

Consent needs capacity as well as a clear choice. A child under 13 cannot give consent for this kind of service on their own — UK law requires a parent or guardian to give or authorise it — and we cannot rule out that under-18s use Motiv. Rather than ask everyone how old they are, we gate the offer.

The consent screen shown when you first set Motiv up carries a declaration, I’m 18 or over, above the two sharing controls. Until you turn it on, those controls are inactive and neither analytics nor crash reporting can be enabled — during setup, from Settings → Privacy, or by any other route in the app. Leaving it off is the ordinary path: you are not asked anything further, nothing is shared, and every other feature works exactly as it does for anyone else.

You can change the declaration at any time under Settings → Privacy → Data sharing. Turning it off stops both channels immediately, and where a channel was on, records the withdrawal in Settings → Your consent record — so a mis-tap during setup, or a birthday, is always recoverable.

This is a self-declaration. We do not verify it, and we do not collect a date of birth or any other age information to check it — for processing at this level of risk the ICO accepts self-declaration, and asking for proof would mean collecting more personal information about children than the problem warrants. What the declaration gives us is the ability to decline a consent we should not accept, and a record that we asked.

If you believe a child’s information was transmitted without valid authorisation, contact us so we can investigate and delete it where possible.

We use data minimisation, allowlisted analytics fields, Apple platform protections, restricted provider access, and transport encryption where applicable. No system is completely secure. If we discover a personal-data breach, we will assess it and notify affected people and the Information Commissioner’s Office where the law requires.

You have the right to complain to us if you believe we have not handled your personal information in line with data-protection law. To make that straightforward, this link opens an email with the subject line and a short template already filled in:

Make a data-protection complaint

If you would rather not use that link, write to privacy@motiv.help with the subject Privacy complaint, or post to the address given in the Terms of Use. Please tell us what happened, roughly when, and what you would like us to do. You do not need to use any particular format, and we will not reject a complaint for being in the wrong one.

We will acknowledge your complaint within 30 days of receiving it, take appropriate steps to investigate and respond without undue delay, keep you informed as appropriate, and tell you the outcome and any action taken.

You can also complain to the Information Commissioner’s Office, the UK supervisory authority, and you may do so at any point. Raising it with us first is usually quicker, but it is not a condition of going to the ICO.

We may update this policy when Motiv, our providers, or the law changes. We will update the date above and provide additional notice in the app where a change is material. If a change affects consent-based processing, we will ask for a new choice where required.