Privacy Policy for Moti

Last Updated: December 29, 2025

Version: v1.1

1. Introduction

Moti ("we," "our," or "us") is committed to safeguarding your privacy while delivering a secure, anonymous social video platform. Moti is not designed for, marketed to, or intentionally used by minors. This Privacy Policy governs all data practices across our mobile application ("App"), including data collection, processing, storage, and sharing. By accessing or using Moti, you acknowledge and consent to the practices described herein. Continued use of the App constitutes acceptance of future revisions to this policy.

2. Scope & Policy Updates

2.1 Effective Date

This policy takes effect on May 08, 2025.

2.2 Modifications

We may update this policy to reflect technological advancements, legal requirements, or operational changes. Material revisions will be communicated via:

• In-app Notifications: Send message reminders to users through the official account within the app.

• Public Archives: Version-controlled updates at here, with prior versions retained for 5 years

3. Data Collection & Processing

3.1 Account System

Device-Generated Accounts

• Upon first use on the device, the application will create a permanent account using the following method:

  • Device Identifier: UUID or IMEI hashed via SHA-256 with per-device salt

  • Randomized Profile: System-generated username and default avatar

• Modifications: Users may reset their username/avatar infinitely without historical tracking

3.2 Data Categories

3.2.1 Purposes of Processing Personal Data

We process the categories of personal data listed in the table above solely for the following limited purposes:

• To create and bind a device-generated account using the hashed device identifier (for service access and continuity across sessions).

• To prevent fraud and abuse (e.g., detecting anomalous device behavior).

• To optimize App performance and diagnose technical issues (e.g., analyzing crash reports and latency metrics).

• To deliver core functionality, including displaying, storing (temporarily), and transmitting user-generated content (videos, pictures, messages).

• To diagnose and improve network connectivity (using IP address and SSID temporarily).

All processing is necessary for the provision of the App's core services, security, and performance improvements. We do not process personal data for marketing, advertising, profiling, or any secondary purposes.

3.3 Explicit Exclusions

We strictly maintain a policy of NOT collecting identifying personal identifiers. Specifically,

• We DO NOT collect phone numbers or email addresses

• We DO NOT collect government-issued IDs or sensitive identity documents

• We DO NOT collect biometric data (e.g., facial recognition, voiceprints)

• We DO NOT collect precise geolocation (GPS, Wi-Fi triangulation)

4. Permissions & Controls

4.1 Required Permissions

4.2 Optional Permissions

5. Security & Encryption

5.1 Technical Safeguards

• Data Transmission: TLS 1.3 with P-384 elliptic curve encryption

• At-Rest Encryption: AES-256-GCM for stored device IDs and user content

• Media Handling: Stripped of EXIF metadata (images) and encrypted audio streams (Opus codec, 128-bit key)

5.2 Operational Protocols

• Incident Response: 72-hour breach notification commitment per GDPR Article 33

6. User Rights & Requests

6.1 Core Rights

• Right to Data Access & Portability: You have the right to request a summary of information associated with your device account. Requests will be fulfilled within 30 days and include a report of the device ID hash, registration date, and active content archive (where applicable).

• Right to Deletion: You have the right to permanently erase all content and device identifiers from our systems via the "Delete Account" function in the App settings.

• Right to Correction: You have the right to edit or reset your profile details (such as username and avatar) at any time through the App settings without justification.

6.2 Request Processing

1. Email MgodinTeam@outlook.com with subject line "CCPA/GDPR Access Request"

2. Include User ID (found in Settings > ID) for verification

3. Fulfillment Timeline:

   • Access: Completed within 30 days

   • Complaints/Deletion: Investigated by human moderators within 72 hours

6.3 Your Privacy Rights under U.S. State Laws (including CCPA/CPRA and VCDPA)

We do not "sell" personal data as defined under applicable U.S. state privacy laws (e.g., CCPA/CPRA, VCDPA), nor do we "share" personal data for cross-contextual behavioral advertising purposes. You have the right to know whether we sell or share your personal data (we do not), and consequently, there is no need to opt out of sale or sharing. We disclose limited personal data to third-party service providers (Agora and RongCloud) strictly for service delivery purposes as described in Section 7. These providers act as our processors/service providers and are contractually prohibited from using the data for any other purpose. For Virginia residents: This policy incorporates your rights under the Virginia Consumer Data Protection Act (VCDPA), including the rights to access, correct, delete, and opt out of sale/sharing as described in this Section 6.

7. Third-Party Integrations & SDK Management

7.1 Core Functional SDKs

To enable real-time interactions, we integrate the following third-party SDKs after rigorous vendor assessments:

Key Disclosures:

1. Agora Media Processing:

   • Temporary stream data cached on edge nodes ≤72 hours

   • End-to-end encryption via AES-128-GCM with DTLS 1.2 key exchange

   • Data processing ceases immediately upon camera/microphone permission revocation

2. RongCloud Messaging:

   • All messages use TLS 1.3 encryption in transit

   • Message retention: Message content is stored exclusively during transmission and the configured retention period, with complete cryptographic erasure from all server nodes upon expiration. Auto-deleted after 14 days by default (configurable to 1-30 days)

7.2 User Control Mechanisms

Operational Controls

1. Regional Compliance Assurance:

   • All data processing adheres to jurisdictional requirements through:

     • EU/UK Users: Storage and transit within EEA-based infrastructure

     • Global Default: Encrypted transfer via ISO 27001-certified networks

2. Data Flow Restrictions:

   • Service traffic automatically routes to geographically appropriate nodes based on:

     • User IP address (non-persistent geolocation lookup)

     • Legal entity registration country

Technical Safeguards

• Agora Streams: Terminated immediately upon camera/mic permission revocation

• RongCloud Messages:

  • End-to-encrypted content never persists beyond configurable retention window (1-30 days)

  • Metadata anonymized using differential privacy techniques

Advanced Requests

Submit via MgodinTeam@outlook.com with subject line "PRIVACY REQUEST":

• Permanent Agora stream deletion (processed within 7days)

• RongCloud message purge (full thread history removal)

7.3 Compliance Safeguards

• Third-Party Audits:

  • Agora: Annual SOC2 Type II reports (link)

  • RongCloud: Independent GDPR audit reports available upon request

• Contractual Obligations:

  • Both providers contractually prohibited from: ▶️ Secondary data use (profiling, advertising, AI training) ▶️ Data transfers to high-risk jurisdictions ▶️ Retention beyond service delivery requirements

8. Age Restrictions & Protections

8.1 Age Gate

• Moti is not designed for, marketed to, or intentionally used by minors.

• Content Moderation:

  • AI Filtering: Custom ML model trained to detect underage users

  • Human Review: Escalated reports reviewed within 2 hours by trained moderators

8.2 Child Privacy Protections

We do not knowingly collect, store, or process data from minors. When potential child-related content is identified:

• Data Handling Protocol:

  • Content Erasure: All associated media files purged within 24 hours

  • Identifier Sanitization: Device ID hashed with SHA-3 (irreversible) and decoupled from usage history

  • Blacklisting: Banned device identifiers added to global shared anti-abuse database

• Parental Coordination: Legal guardians may request data audits via MgodinTeam@outlook.com with:

  • Notarized proof of parental authority

  • Suspected minor’s device ID (from device settings)

8.3 Children’s Safety Protocol

Our enhanced child protection framework is detailed in: Moti Child Safety Protocol

9. International Data Transfers

We operate globally and may process data in locations outside your jurisdiction:

• EU Data Transfers:

  • Rely on GDPR Article 46 safeguards (Standard Contractual Clauses) for transfers to non-EEA countries like Singapore.

• Technical Safeguards:

  • All cross-border transfers enforce AES-256 encryption during transmission and at rest.

• Vendor Management:

  • Third-party processors (e.g., Agora) are contractually bound to equivalent data protection standards.

10. Contact & Dispute Resolution

10.1 General Inquiries

Primary Contact Methods：

• Data Controller: MGODIN LLC, 157 Comanche AveLake George CO 80827, USA

• Data Protection Officer(DPO): Dr. Laura Mitchell

• Email: MgodinTeam@outlook.com

• Postal Correspondence: MGODIN LLC Attn: Privacy Office 157 Comanche AveLake George CO 80827, USA

10.2 Arbitration

Disputes resolved via binding arbitration under AAA(American Arbitration Association) rules, except for small claims (<$10,000).

Archive of Previous Versions:

Initial Privacy Policy (v1.0) in effect May 08, 2025. Archived versions available at here upon updates.