privacy

1. about this policy

This Privacy Policy describes how Movlee ("the Service," "we," "our") handles personal data of visitors and customers ("you"). It applies to your use of https://movlee.com/ and any related sub-pages or assets served from that domain.

The Service is operated from Singapore. We comply with the Personal Data Protection Act 2012 (Singapore) ("PDPA") and applicable subsidiary legislation.

2. data we collect

We collect only the minimum data needed to operate the Service:

(a) browser localStorage tokens

When you complete a "share-to-unlock" action, an anonymous token is written to your browser's localStorage. This token is stored only on your device and is never transmitted to any server, including ours. You may clear it at any time via your browser's settings (typically: Settings → Privacy → Clear browsing data → Site data).

(b) payment and transaction records

When you make a purchase, you are redirected to Lemon Squeezy's checkout. Lemon Squeezy collects and processes your name, email address, billing address, and payment method. We never see, store, or have access to your full payment details.

After a successful payment, Lemon Squeezy provides us with a transaction record containing: transaction ID, your email address, the items purchased, and the transaction date. We use this only to verify your purchase and authorize the corresponding download. We retain this data for as long as needed to support refund requests and comply with Singapore record-keeping laws (typically up to 5 years for financial records).

(c) server logs

Our hosting provider (Netlify) automatically logs IP addresses, user agents, and request metadata for security, abuse prevention, and rate limiting. These logs are retained per Netlify's standard retention policies and are not used by us for any other purpose.

(d) waitlist email (only if you opt in)

If you submit your email to our waitlist (shown when the first 20,000 share-unlocks have been claimed), we store that email address in our hosting provider's secure storage (Netlify Blobs). We use it for one purpose only: to notify you when the next round of share-unlocks opens. We do not use it for marketing, do not share it with third parties, and do not enrich it with other data. Submission is voluntary; you can decline and still use the Service in its free or paid forms.

To remove your email from the waitlist, contact me@zayedtalib.com and we will delete it within 30 days as required by the PDPA. We may later transfer waitlist emails to a third-party email service (such as Buttondown, ConvertKit, or MailerLite) for the purpose of sending the announcement; if we do, you will be notified before any message is sent.

3. data we do NOT collect

To be explicit:

• Your photo never leaves your browser. All image processing — including background removal (via the open-source @imgly/background-removal model that runs locally on your device using WebAssembly/WebGPU) and animation rendering — happens entirely on your device. We do not upload, view, or store your photo at any point.
• We do not use cookies for tracking or any other purpose. The only persistent client-side data is the localStorage entry described in section 2(a).
• We do not run analytics or telemetry (no Google Analytics, no Plausible, no Fathom, no Mixpanel, no other analytics services).
• We do not have user accounts, so we do not store passwords, names, contact details, or any identifying information beyond what is processed during a purchase.
• We do not sell, rent, or share your data with anyone for marketing purposes.

4. third-party services

To operate, the Service relies on the following third parties. When you use the Service, you may also become subject to their respective privacy policies:

• Lemon Squeezy — payment processor. Handles checkout, payment processing, transaction records, and receipts. Their privacy policy.
• Netlify — hosting provider. Serves the static files and runs the verify-purchase function. Their privacy policy.
• esm.sh — content delivery network for the open-source background-removal model and JavaScript libraries. Logs IP addresses for normal CDN operation.
• jsdelivr.net — content delivery network for the open-source GIF encoder library. Logs IP addresses for normal CDN operation.
• Google Fonts — content delivery network for the typeface used on this site. Google logs IP addresses to serve the font; Google's privacy policy.

We do not share any data with these services beyond what is technically necessary for them to provide their service (e.g., your IP address to fetch a font file from Google Fonts).

5. data retention

• localStorage tokens — persist on your device until you clear them. We have no remote control over them and cannot view, modify, or delete them.
• Transaction records received from Lemon Squeezy are retained for as long as needed to verify your purchase, support refund requests, and comply with applicable record-keeping obligations under Singapore law (typically 5 years for financial records).
• Server logs are retained per Netlify's standard log retention policies.

6. your rights under PDPA

Under the PDPA and applicable laws, you have the right to:

• Access. Request information about whether we hold any personal data about you.
• Correction. Request that we correct any inaccurate personal data we hold about you.
• Withdrawal of consent. Where your data was processed based on your consent, withdraw that consent at any time.
• Complaint. Make a complaint about our handling of your data.

To exercise any of these rights, email me@zayedtalib.com. We will respond within 30 days as required by the PDPA.

If you have purchased through Lemon Squeezy and want your transaction records modified or deleted at the source, you must also contact Lemon Squeezy directly — those records are held by them as the merchant of record.

7. children

The Service is not directed at, and not intended for use by, persons under the age of 13. We do not knowingly collect personal data from anyone under 13. If you become aware that a child under 13 has provided personal data through the Service, please contact me@zayedtalib.com so we can take appropriate action.

8. international users

The Service is operated from Singapore. By using the Service, regardless of where you are located, you consent to the transfer of your data (such as your IP address and any data you submit during checkout) to Singapore and to the third-party services listed in section 4, which may operate from various jurisdictions, including the United States, the European Union, and elsewhere.

9. security

We design the Service to minimize the data we hold, which is the strongest protection: data we never collect cannot be lost, stolen, or misused. For the limited data we do receive (transaction records from Lemon Squeezy), we rely on industry-standard transport-layer security (HTTPS) and on Lemon Squeezy's PCI-DSS-compliant payment infrastructure.

No system is perfectly secure. In the unlikely event of a security incident affecting your data, we will notify affected users and the Personal Data Protection Commission of Singapore as required by law.

10. changes to this policy

We may update this Privacy Policy from time to time as the Service evolves. Material changes will be reflected in the "last updated" date at the top of this page. Continued use of the Service after a change constitutes acceptance of the updated policy.

11. contact

For privacy-related questions, requests, or complaints:

Email: me@zayedtalib.com

If you are dissatisfied with our response, you may also lodge a complaint with the Personal Data Protection Commission of Singapore (PDPC): https://www.pdpc.gov.sg/.