Privacy

Next Move is operated by the Next Move operator. bino@nxtmov.app

• Account email. Used to create your account, sign you in, and contact you about your account.
• Encrypted check-in content. Your saved check-ins are stored as encrypted data. See “How your check-ins are protected” below.
• Authentication and session data. Used to keep you signed in and to keep your data scoped to your account.
• Operational logs. Technical logs used to run the service, diagnose errors, and protect against abuse. These do not contain your saved check-in content, your password, or your encryption keys.
• AI request data. When you choose to use an AI action, the text you select is sent for processing. See “How AI actions are different” below.
• Google Calendar event data. When you explicitly choose to add your next move to Google Calendar, your browser sends the event details directly to Google. See “How Google Calendar works” below.

The content of a saved check-in is encrypted in your browser before it is sent for storage. The stored data is unreadable without your encryption key, which is derived from your account password and is never stored on the server in a usable form.

In normal use, the creator of Next Move cannot read the content of your saved check-ins from the database. Each account can only read, write, and delete its own check-ins.

One tradeoff comes with this: if you lose your password, we cannot recover saved check-in content for you. You can create an optional recovery key in your profile; it is generated in your browser, we never see it, and it is then the only way to keep your check-ins after a lost password.

AI actions are optional and only run when you explicitly trigger them. When you do, the text you select is sent in plain form to our server and on to OpenAI for processing, and the result is returned to you.

This means AI processing is not end-to-end private. Next Move does not offer fully private, anonymous, or zero-knowledge AI. If you do not want a piece of text processed this way, do not use an AI action on it.

Adding an event to Google Calendar is optional and only happens when you explicitly click “Add to Google Calendar” and authorize the action with Google. Next Move then asks Google to create one event in your primary calendar using your next move as the event title and description, together with the date, time, duration, and device time zone you selected.

Google describes the required Calendar permission as permission to view and edit events because Google does not offer a create-only permission for events in a primary calendar. Next Move only uses that permission to create the event you explicitly request. It does not list, fetch, or read your existing events; check your availability; add attendees or send invitations; update or delete events; or access other calendars.

The Google access token stays in your browser memory for the event creation request and is not stored. The request goes directly from your browser to Google, not through our server. Our server and database do not receive the token, your existing calendar data, or the Google Calendar API response. Your browser uses the creation response only to confirm success and, when available, show a link to the event that was just created.

Next Move does not sell, transfer, or share Google Calendar event data with advertisers, data brokers, AI providers, or other third parties, and does not use it for advertising or model training. The selected start date, time, and duration can be saved as part of your Next Move check-in, but only through the normal browser-encrypted check-in path described above.

After creation, the event remains in your Google Calendar and is governed by your Google account settings and Google's terms and privacy policy. Deleting your Next Move account does not delete an event already created in Google Calendar. You can change or delete it in Google Calendar and manage Next Move's Google access from your Google account.

Next Move's use of information received from Google Workspace APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

• Supabase provides authentication, the database, and account metadata.
• Vercel provides hosting and runtime logging.
• OpenAI processes the text you select when you choose to use an AI action.
• Google handles authorization and creates the calendar event when you explicitly choose the Google Calendar action.

Plain check-in content exists in your browser while your workspace is unlocked. Only encrypted check-in content is stored in the database.

You can delete your account and your check-ins at any time from your profile settings.

If you have lost access to your account, email bino@nxtmov.appto request deletion.

If the data paths above change, this notice will be updated before the change is reflected in the product.