Effective date: October 23, 2026

SportBoost AI Inc. (“SportBoost,” “we,” “us,” or “our”) built the MoveLock app as a commercial iOS application. This Privacy Policy explains how we collect, use, store, share, and delete personal information when you use MoveLock (the “Service”).

If you use the Service, you agree to this Privacy Policy. The terms used here have the same meaning as in the MoveLock Terms of Use, unless defined otherwise.

This policy is written for MoveLock specifically. It does not replace the Strava Privacy Policy (https://www.strava.com/legal/privacy). If this policy and Strava’s privacy policy conflict with respect to Strava’s handling of your Strava account data, the Strava Privacy Policy (https://www.strava.com/legal/privacy) controls.

1. Who we are

SportBoost AI Inc.
6650 Rue Saint-Urbain
Montréal, QC H2S 3H1
Canada

Email: info@sportboost.ai

MoveLock is provided by SportBoost AI Inc. We are a separate company from Strava, Inc. and Apple Inc. MoveLock is not affiliated with, endorsed by, or sponsored by Strava or Apple.

2. What MoveLock does

MoveLock helps you earn screen time from movement. After you connect Strava or Apple Health (HealthKit), we use your activity — Strava moving time, or Apple Health exercise minutes and steps — to calculate a daily allowance for apps you choose to restrict with Apple Screen Time. You can also connect one accountability buddy, request extra time, and subscribe for premium features.

MoveLock is a training and habit tool. It is not a medical device and does not provide medical, health, or professional advice.

3. Information we collect and how we collect it

We collect only what we need to operate MoveLock. We do not sell your information. We do not use your information for targeted advertising. We do not use Strava data or Apple Health (HealthKit) data to train, fine-tune, evaluate, or operate artificial-intelligence or machine-learning models.

3.1 Information you provide

Type Examples How collected Optional account Sign in with Apple user identifier; name and email if you share them with Apple; the buddy username you choose Only if you choose Sign in with Apple or enter a buddy username Buddy content Buddy invites, unlock-request minutes and optional reason, settings-change requests, app-removal requests You (and your buddy) create these in the app Feedback Messages you send us, plus optional device/app version details attached to feedback Email / in-app “Send Feedback” Purchase records Subscription or lifetime-unlock status associated with your Apple ID Apple App Store / StoreKit (Apple processes payment)

When you send certain accountability requests, MoveLock requires a short note and a live front-camera photo. The app compresses the photo and sends the photo and note to Firebase with the request so only you and your connected accountability buddy can review them. We use this content only to provide the accountability workflow. We do not use it for facial recognition, identity verification, advertising, analytics, or AI/ML training. It remains attached to the request until it is deleted under our retention practices or you delete your MoveLock account.

You do not need a MoveLock account to purchase or restore Premium or to use device-local Apple Health and Screen Time features. If you choose to sign in, we do not receive your Apple ID password. If you hide your email with Sign in with Apple, we receive Apple’s private relay address instead of your real email.

3.2 Strava information (only after you connect Strava)

Connecting Strava is optional. Without it, MoveLock can still run on your minimum daily allowance.

Before we access any Strava data, you must authenticate your Strava account and grant consent through Strava’s official authorization screen.

If you connect Strava, we collect:

• Athlete profile: Strava athlete ID, name / username, and granted OAuth scopes
• OAuth tokens: access token and refresh token, so we can keep the connection working
• Activity data needed to calculate your allowance: activity ID, sport type, name, moving time, elapsed time, distance, and start date/time

We request Strava scopes read and activity:read. We do not request write access. We do not upload activities to Strava. We do not access other athletes’ data, leaderboards, or maps for display to anyone but you.

How we collect Strava data:

• You tap Connect with Strava in MoveLock.
• You log in to Strava and approve access.
• Our servers exchange the authorization code for tokens (the Strava client secret is never stored in the iOS app).
• Strava may send our servers webhook events when your activities are created, updated, or deleted.
• We then fetch the specific activity details needed to compute daily moving-time totals.

Strava data provided by you is shown only to you in MoveLock. We do not display or disclose another person’s Strava data, even if that data is public on Strava.

Activity data you record with a watch or bike computer (for example Garmin or Apple Watch) may flow to Strava first. Those devices and Strava have their own privacy policies.

3.3 Apple Health (HealthKit)

Connecting Apple Health is optional. MoveLock uses Apple’s HealthKit framework only after you grant read permission on Apple’s Health access sheet. You can use MoveLock without Apple Health, and you do not need a MoveLock account to use Apple Health on this device.

If you connect Apple Health, MoveLock reads only these HealthKit data types:

• Apple Exercise Time: exercise minutes for a calendar day.
• Steps: step count for a calendar day.
• Workouts: start time, end time, and duration, and only to calculate exercise minutes when Apple Exercise Time has no samples for that day. We do not store workout names, routes, heart rate, or other workout details.

We read this data on your iPhone through HealthKit. We request read access only. We do not write, change, or delete anything in Apple Health. We do not read other HealthKit data, including heart rate, sleep, blood oxygen, clinical records, cycle tracking, body measurements, nutrition, mindfulness, or workout routes.

We use Apple Health data only to:

• Calculate your allowance. Exercise minutes and steps set your daily screen-time allowance. We use the larger of those two credits so the same walk is not counted twice.
• Show Progress. Recent exercise minutes and steps appear in MoveLock and on the Home Screen widgets.
• Keep the allowance current. HealthKit can wake MoveLock on your device when new samples arrive, including in the background, so newly earned time can apply without opening the app only to refresh.

We do not do any of the following with Apple Health data:

• Share it. We do not sell, rent, license, or share it with advertisers, data brokers, analytics networks, your accountability buddy, or any other third party.
• Advertise with it. We do not use it for advertising, marketing, or other use-based data mining.
• Train models with it. We do not use it to train, fine-tune, or evaluate artificial-intelligence or machine-learning models.
• Store it in the cloud. We do not store it in iCloud or CloudKit, and we do not upload raw HealthKit samples, workout records, or health identifiers to SportBoost servers.

Daily exercise-minute and step totals derived from those reads stay on your device, in storage shared with the MoveLock widgets, so the app can show your allowance and Progress. Disconnecting Apple Health stops new reads. Those on-device totals are removed when you use Reset All Data, delete your MoveLock account, or delete the app.

You can turn this access off at any time, as described in section 11.2.

3.4 Screen Time and on-device information

With your permission, Apple’s Family Controls / Screen Time APIs let MoveLock apply shields to apps you select. That selection lives on your device (and, if you ask a buddy to approve removing apps, a description of the requested change may be stored so your buddy can approve it).

We do not read the content of your messages, photos, or browsing. Restricted-app usage shown in Progress is based on Apple Device Activity thresholds (for example 50% / 75% / 90% / 100% of your allowance), not second-by-second tracking.

We never receive your biometric data.

3.5 Notifications

If you allow notifications, we store a push token so we can send:

• allowance / limit alerts
• buddy invite, unlock, settings, and app-removal requests
• optional local reminders you turn on in Settings (those are scheduled on-device)

You can change notification permission in iOS Settings at any time.

3.6 Diagnostics

If the app crashes, Firebase Crashlytics may collect device type, OS version, app version, stack traces, and similar log data so we can fix bugs. Crash reports are used for app functionality, not advertising.

3.7 Automatically collected technical data

When the app talks to our servers, standard server logs may include IP address, date/time, and request metadata needed to keep the Service secure and reliable.

4. How we use information

We use personal information to:

• create and secure an optional account when you request account-specific features
• calculate and enforce your daily allowance
• read the Apple Health (HealthKit) data you authorize, only to calculate that allowance and show Progress
• show you Progress (exercise minutes and restricted-app minutes)
• run buddy accountability (invites, approvals, unlocks)
• process and restore App Store purchases
• send the notifications you enabled
• provide support and respond to deletion / access requests
• keep the Service secure and debug crashes
• comply with law

We do not use Strava data or Apple Health (HealthKit) data for analytics products, advertising, resale, or AI training.

Strava API usage data. Strava may monitor and collect usage data about our access to the Strava API, and may use that usage data for any business purpose, including improving the Strava API or Strava platform, providing developer or user support, and ensuring compliance with the Strava API Agreement.

5. Legal bases (EEA, UK, and similar laws)

Where a legal basis is required, we rely on:

• Contract — to provide MoveLock and any optional account-specific features you request
• Consent — Strava connection, Screen Time, notifications, and optional buddy features. You can withdraw consent as described below
• Legitimate interests — security, fraud prevention, and crash diagnostics, in a way that does not override your rights
• Legal obligation — when we must keep or disclose information to comply with law

Fitness / activity data can be treated as sensitive in some jurisdictions. We process Strava activity data and Apple Health data only with your express consent when you connect that source, and only to operate MoveLock for you.

6. How we share information

We do not sell, rent, or license your personal information. We do not sell, rent, license, or share Apple Health (HealthKit) data, and we do not use it for advertising, marketing, or data mining.

We share information only as follows:

6.1 Service providers (subprocessors)

These providers process data on our behalf to run MoveLock:

Provider Role Typical location Apple Inc. Sign in with Apple, App Store billing, Screen Time / Device Activity, APNs push, on-device Face ID United States and other Apple regions Google LLC (Firebase) Authentication, Firestore database, Cloud Functions, Cloud Messaging, Crashlytics United States and other Google regions Strava, Inc. / Strava Ireland Limited Your Strava account and the Strava API (Strava is an independent controller of Strava account data) United States / Ireland

Each provider is bound by its own terms and privacy policy. We require subprocessors that handle MoveLock data to protect it no less carefully than we do.

6.2 Your accountability buddy

If you connect a buddy, that person can see your MoveLock username and the requests you send (for example extra minutes and an optional reason). Your buddy does not receive your Strava activity feed, GPS, or tokens, and does not receive your Apple Health or HealthKit data.

6.3 Legal and safety

We may disclose information if required by law, legal process, or to protect MoveLock, our users, or others from harm.

6.4 Business transfers

If SportBoost is involved in a merger, acquisition, or asset sale, personal information may transfer as part of that transaction, still subject to this policy.

We do not transfer Strava data to advertisers, data brokers, or AI providers — even if you would consent — because the Strava API Agreement forbids it.

7. Independent controllers (Strava)

SportBoost and Strava are separate, independent controllers of the personal data each of us processes. We are not joint controllers.

• SportBoost controls the MoveLock account, allowance, buddy features, and the copies of Strava-derived data we hold to run MoveLock.
• Strava controls your Strava account under the Strava Privacy Policy (https://www.strava.com/legal/privacy) and Strava Terms of Service (https://www.strava.com/legal/terms).

If you send us a request that should go to Strava (or the reverse), we will point you to the right party.

Open your Strava account anytime at strava.com (https://www.strava.com/) or manage connected apps at strava.com/settings/apps (https://www.strava.com/settings/apps).

8. Retention

Data How long we keep it MoveLock account, username, buddy relationship Until you delete your account / reset the app, or we close the Service Accountability requests, notes, and photos Until you delete your MoveLock account, unless removed earlier as part of routine service retention Strava tokens Only while Strava is connected Strava activity details (cache) No more than seven (7) days, in line with the Strava API Policy (https://www.strava.com/legal/api_policy). If an activity is no longer available from Strava, we remove it from our cache immediately Daily moving-time totals used for your allowance and Progress No more than seven (7) days Screen Time settings and restricted-app usage history on your device Until you reset the app or delete it (this is not Strava data) Crash logs For a limited diagnostic period Purchase status As long as needed to honor your subscription or lifetime unlock Free-trial record For guests, the original trial start date is stored locally on the device. For signed-in users, a keyed, one-way digest of the Sign in with Apple identifier and the original trial start date is retained while MoveLock enforces one trial per account

If you delete an activity on Strava, we stop using and displaying it in MoveLock as soon as practicable, and in all cases within 48 hours.

Apple Health (HealthKit). HealthKit samples are read on your device and are not uploaded to SportBoost servers. We do not keep them in iCloud or CloudKit. Daily exercise-minute and step totals used for your allowance and Progress stay on your device until you reset the app, delete your account, or delete MoveLock. Disconnecting Apple Health stops further collection.

9. Security

We use commercially reasonable administrative, technical, and organizational measures to protect personal information, including:

• Strava client secret stored only on our servers, not in the iOS app
• OAuth tokens in the iOS Keychain and in access-restricted server storage
• HTTPS for API traffic
• Firebase security rules that block client access to Strava token and webhook collections

No method of transmission or storage is 100% secure. You use the Service at your own risk.

10. International transfers

SportBoost is based in Québec, Canada. Our providers (including Apple, Google, and Strava) may process data in the United States and other countries. Those countries may not have the same privacy laws as your home country.

Where required (including transfers from the EEA, United Kingdom, or Switzerland), transfers rely on appropriate safeguards such as the European Commission Standard Contractual Clauses and the UK International Data Transfer Addendum, as used by us or by our providers.

11. Your choices, consent, and deletion

11.1 Access the data you generated

You can see your allowance, Progress, buddy status, and connected-Strava athlete name in the app. You may also email info@sportboost.ai to request a copy of personal information we hold about you.

Your own Strava data can also be exported from Strava, free of charge, using Strava’s Bulk Data Export tool.

11.2 Withdraw Apple Health (HealthKit) consent

You can withdraw consent and stop MoveLock from reading HealthKit at any time by:

• In MoveLock: tap Disconnect next to Apple Health in Settings.
• In the Health app: open Sharing, or Data Access & Devices, then turn off MoveLock.
• In iOS Settings: open Privacy & Security, then Health, then turn off MoveLock.

After you withdraw permission, MoveLock stops reading Apple Health. Daily totals already stored on your device remain until you use Reset All Data, delete your MoveLock account, or delete the app. Turning off Health access does not delete an optional MoveLock account and does not cancel an App Store subscription.

11.3 Withdraw Strava consent

You can withdraw consent and stop MoveLock’s access to Strava at any time by:

• tapping Disconnect next to Strava in MoveLock Settings, or
• revoking MoveLock at strava.com/settings/apps (https://www.strava.com/settings/apps)

After withdrawal, we stop accessing your Strava account.

11.4 Delete your data

You can request deletion by:

• using Delete Account in MoveLock Settings, and/or
• emailing info@sportboost.ai with the subject MoveLock data deletion

We will delete, from systems we control:

• MoveLock account information we stored
• buddy requests associated with you (to the extent they are not still needed for the other person’s account integrity)
• all Strava data and personal data derived from Strava data relating to you

We do this promptly, and in any event within 30 days, unless a longer legal retention period applies. When deletion completes, MoveLock shows a written confirmation in the app with a confirmation ID. Save that ID. Email info@sportboost.ai quoting the ID if you want a copy sent to you.

Deletion also happens when you revoke MoveLock’s Strava authorization, delete your Strava account, or we stop using the Strava API.

Reset All Data or deleting MoveLock from your iPhone removes on-device settings, tokens, and local history but does not delete an optional account you created. If you created one, Delete Account removes the account and MoveLock-controlled server data, except for a minimal free-trial prevention record. That record contains only a server-keyed, one-way digest of your Sign in with Apple identifier and the date your trial originally began. We cannot use the digest to recover your Apple identifier, and we use it only to prevent repeated free trials—not for advertising, analytics, or profiling. To also remove Apple’s Sign in with Apple authorization for MoveLock, use iOS Settings → [your name] → Sign in with Apple.

Deleting your MoveLock account does not cancel an active App Store subscription. You can view or cancel subscriptions in your Apple ID subscription settings.

11.5 Other rights

Depending on where you live (including Québec Law 25, PIPEDA, GDPR, and UK GDPR), you may also have the right to:

• correct inaccurate information
• withdraw consent
• restrict or object to certain processing
• data portability
• lodge a complaint with a supervisory authority (in Québec: the Commission d’accès à l’information; in the EEA/UK: your local data protection authority)

To exercise these rights, email info@sportboost.ai. We may need to verify it is you.

12. Children’s privacy

MoveLock is not directed to children under 13 (or the higher age required in your country). We do not knowingly collect personal information from children under 13. If we learn that we have, we will delete it. Parents or guardians who believe a child provided information should contact us at info@sportboost.ai.

13. Cookies

MoveLock is an iOS app and does not use browser cookies itself. Our website, sportboost.ai, and some third-party libraries (including Google/Firebase) may use cookies or similar identifiers as described in those parties’ policies. You can control website cookies in your browser.

14. Links to other sites

MoveLock and sportboost.ai may link to Strava, Apple, or other sites we do not operate. Their privacy practices are their own. Review those policies before you provide information there.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the new policy on this page and update the effective date. If we change the type of Strava data or Apple Health (HealthKit) data we collect, we will notify you and obtain your consent before collecting the new category.

Your continued use of MoveLock after a posted update means you accept the revised policy. If you do not agree, disconnect Strava, stop using the Service, and request deletion.

16. Contact us

Questions, access requests, deletion requests, or privacy complaints:

SportBoost AI Inc.
6650 Rue Saint-Urbain
Montréal, QC H2S 3H1
Canada

info@sportboost.ai

Please put MoveLock in the subject line so we can route it quickly.

This policy is effective as of October 23, 2026.