Privacy Policy

Account information may include your name, email address, sign-in identifier, profile image and profile details. We handle uploaded text, images, audio or video; captions; message dates; sharing settings; and activity such as reactions or project participation.

When you save recipients, we handle the names, email addresses and relationship labels you supply, invitation or confirmation status, and message access or notification records. A recipient’s information may come from the sender before that recipient has an MOT account.

If you add a place to a public moment or participate in a location-based feature, we handle the location or map coordinates you select. Public location information can reveal where you were. Technical records may include IP addresses, browser or device information, errors and security logs.

For Paddle purchases, we may receive transaction references, purchase status and the information needed to match a purchase to your account. Card details are entered through Paddle and its payment providers; MOT’s pricing page does not collect card numbers.

We use information to authenticate accounts; store and process content; implement sharing and release instructions; send service emails; operate public community features; match and support purchases; prevent abuse; troubleshoot problems; and meet legal obligations.

Where applicable law requires a legal basis, these activities rely on providing the requested service, legitimate interests in secure and reliable operation, legal obligations, or consent where required. Consent to an optional use can be withdrawn without changing processing already lawfully completed.

Private messages are intended for the people selected in your sharing settings. Public moments, published advice and public participation information are visible to others and may include your profile, content, reactions, date and chosen location.

Do not publish another person’s personal information without the necessary permission. Public content can be copied outside the service. Support staff or authorised service providers may access information where needed for support, processing, security, moderation or legal obligations; we do not describe the service as end-to-end encrypted.

Our service uses Vercel for hosting, Supabase for authentication and data services, Mux for video processing and playback, Resend for service emails, and Paddle for checkout and transactions. Google is used when you choose Google sign-in. Providers receive information relevant to their role, such as a recipient email address for an email or a video file for video processing.

Paddle handles checkout information under its own privacy policy and acts as an independent party for payment and transaction processing. We may also disclose necessary information to comply with lawful requests, protect rights or investigate fraud. A business transfer involving personal information would be subject to applicable legal protections and notice requirements.

Service providers may process information in countries outside your country, including the United States. Where applicable law requires safeguards for international transfers, those transfers must use the protections required by that law. Contact support for information about the processing relevant to your account.

Content is retained to provide the storage and sharing service described for the message or package. Launch storage expiry and deletion controls are being finalised; the proposed free twelve-month limit is not a representation that automatic deletion already operates for current uploads.

Account, recipient and support information is retained while needed to operate the service and address requests. Security and transaction records may be retained longer where required for legal obligations, fraud prevention or disputes. Deletion from active systems may not immediately remove protected backup copies, and copies made by recipients or public viewers are outside our control.

You can request deletion or account closure by contacting support. We may need to verify your identity and explain information that must be retained before completing the request.

The website and sign-in services use cookies or browser storage where necessary to maintain sessions and operate the service. Paddle’s checkout may use its own cookies and storage. Browser controls let you restrict cookies or clear storage, but doing so may prevent sign-in or checkout from working. Optional non-essential tracking requires consent where applicable law requires it.

Depending on the law that applies, you may request access, correction, deletion, restriction, objection or a portable copy of your personal information. You may also withdraw consent for optional processing and raise a complaint with the relevant privacy regulator. Requests are subject to identity checks and applicable legal exceptions.

Recipients who were added by someone else can contact support to correct their details or request that future contact stop. Use support@messageovertime.com and provide enough information to identify the relevant account or invitation; do not send passwords or card details.

MOT accounts and purchases are intended for adults. An adult may name a child as a future recipient or upload family content only with the authority and permissions required by applicable law. Contact support about content or information concerning a child that should not be stored or published.

We use account access controls and security features provided by our hosting and data services. No online system can promise perfect security; protect your sign-in access and report suspected unauthorised access promptly.

We may update this policy as features and processing change. The date above identifies the current version. We will give notice of material changes where required. Provider privacy notices are available on the official Vercel, Supabase, Mux, Resend, Google and Paddle websites.