What we keep, and why.

When you leave your email on the website to hear when something opens, we store:

• Your email address.
• The agent you use, if you pick one.
• What you're building, if you write something in that box (up to 280 characters).
• The source: the utm_source tag on the link you followed, or the name of the website that sent you here, if there was one.
• A salted hash of your IP address, used only to limit abuse (at most five sign-up attempts an hour from one connection). It is kept with your sign-up. We never store your raw IP address.
• The time you signed up.

When you create an account and use Motif, we store:

• Your email address, which is how you sign in and how we reach you about your account and billing.
• Sign-in codes, stored only as a keyed hash, with the IP address that requested them (used to stop abuse). Codes expire after 10 minutes and these records are deleted after 2 days.
• A sign-in cookie (motif_session) and two short-lived cookies used during sign-in and to show one-time messages. They are needed for the account pages to work; there are no tracking or advertising cookies.
• Agent tokens: the name you give each token, a keyed hash of it (never the token itself), when it was last used, and the name the agent reports (its user-agent, for example "claude-code").
• Connected apps, if you connect one by signing in (for example ChatGPT or Claude): the app's name and the address it registered, when it connected and was last used, and keyed hashes of its access and refresh tokens.
• Usage: how many content operations you used in each window, which premium guides you opened (by id), and a log of each MCP call's tool name, outcome and time. We don't store your search text or the facts you send for checks, beyond a hash used to recognise retries; a retry record holds the response for 24 hours.
• Project profiles: the briefs, platforms and decisions you or your agent save. They are private to your account and never shared with other customers.
• Billing, if you subscribe: your Stripe customer and subscription ids, plan status and billing periods. Stripe handles your card; we never see or store card numbers.
• A security log of account actions (sign-ins, tokens created or revoked, project changes), without IP addresses.

Our web server's access logs record IP addresses to protect the service and are deleted after 14 days.

Updates list: to send you one note when what you asked about opens, and essential product notices (for example, a change to this policy). The agent, the note and the source help us decide what to build first.

Accounts: to sign you in, deliver the service, enforce your plan's limits, bill you if you subscribe, keep the service secure and answer your questions. We don't send a newsletter, and we don't sell, rent or share your details for marketing.

The updates list is in a Cloudflare D1 database in the United States. Accounts, projects and usage are in a PostgreSQL database on a server we rent from Hetzner Online in Hillsboro, Oregon, in the United States. Cloudflare sits in front of every Motif address, so it processes your IP address to deliver and protect the service. Sign-in and billing emails are sent through Resend. Payments are processed by Stripe. The website loads its fonts from Google Fonts, so your browser also contacts Google's font servers.

Updates list: until 12 months after we send your note, or until you ask us to delete it, whichever comes first. The abuse-limit log of hashed attempts is cleared after about a day.

Accounts: while your account exists. When you delete it, your projects, decisions, tokens and sessions are deleted at once and your email is removed from the account; they leave our backups as the backups rotate, within 30 days. Billing records that tax and accounting law require are kept, without your email, for as long as that law says.

The public website uses Google Analytics 4 to understand aggregate visits and product paths. Analytics and advertising storage are denied before the Google tag loads, so this measurement does not set analytics or advertising cookies. Google still receives cookieless measurement pings containing technical and page information such as the page address, browser and device details, and an IP address used in transit. We do not use advertising or personalisation features. The account pages set only the sign-in cookies described above.

Account holders can download everything we hold and delete their account themselves under Plan & data on the account page. (If you have an active subscription, cancel it first.)

For the updates list, or if you'd rather ask, email SaltyEngineer@asv-labs.com from the address concerned. We'll remove your record and confirm by reply.

Motif is operated by ASV Labs (asv-labs.com). Questions about this page go to SaltyEngineer@asv-labs.com.