Privacy Policy
Effective 21 October 2026 · applies to motion.gift, vault.motion.gift, the motion iOS and Android apps and the Motion browser extension
motion is a non-custodial trading terminal. Your private keys are created, stored and used in your own browser. This policy explains the little we do keep on our servers, why, and who else is involved.
In short
- We never receive your private keys, seed phrases or passwords, and we never sign transactions for you.
- We keep what an account needs to work: your login identity, your wallet addresses, an encrypted backup we cannot open, and the settings you choose.
- We do not sell your data, show ads or use third-party trackers.
- You can delete your account in the app (Settings → Account → Delete account) or by e-mail.
1. What we collect
- Account. You sign in through Privy, our login provider. We receive your Privy user ID, the login method you chose (an email address, a social account identifier or a wallet address) and the address of your login wallet.
- Wallet addresses. The public addresses of your motion trading wallets, so we can show balances, positions, trade history and PnL, and run features such as the Road to Albania competition. Your trades themselves are public blockchain data.
- Encrypted account backup. Your vault wallets, sealed in your browser under a key derived from your login wallet's signature. We store the encrypted file; we cannot decrypt it.
- Two-factor authentication. If you turn it on: an encrypted authenticator secret and hashed recovery codes.
- Trade source. When you trade from the extension, the panel sends us the transaction hash with the tag "extension". We use it only to show, in our public analytics, how much volume goes through the extension versus the website.
- What you post. Roadmap suggestions, votes and callouts you publish on the site.
- Reports. When you report a post, callout, thesis, X post or profile, we store the item’s id, its author’s id, the kind of item, where it came from, the reason you picked and the time. A report does not carry your account, wallet or e-mail; your IP address is used only in memory, scrambled, to limit how many reports one sender can make, and is not stored with the report. We keep reports as long as we need them for moderation.
- Technical data and server logs. Our web servers log each request: your IP address, the time, the address (URL) that was requested, the answer’s status and your browser type. Those URLs can contain public wallet addresses and token addresses (for example when you open or track a wallet or check balances) and the text you type into search. We also keep short-lived rate limits in memory that protect the service from abuse. Server logs are deleted after 14 days.
- Error reports from the website. When a page of the website or of the phone web app crashes, it sends us the error message and stack, the page path, the build and your browser type, so we can fix it. They are kept in the server logs (14 days).
2. What stays in your browser
Your vault (the encrypted private keys of your trading wallets), your trading settings (slippage, gas, presets, selected wallets), your theme and language choices. These live in your browser's storage on your device. Clearing your browser data removes them; keep a backup.
3. The Motion browser extension
- It runs only on
gmgn.ai,axiom.tradeandfomo.family. There it reads the token address in the page URL (and the token symbol shown on the page) to know which token you are looking at, and adds a "Trade in Motion" button. - It opens the motion trade ticket in Chrome's side panel. The ticket is loaded from motion.gift and talks to your motion vault; the extension itself holds no keys.
- It saves its own settings in
chrome.storageon your device. - It does not read other websites, your browsing history, your keystrokes or the content of pages beyond the token address and symbol above.
4. The motion iOS and Android app
- Market data. The app reads public market data (boards, token pages, charts, prices, holders, public profiles and posts) from motion.gift’s servers. These requests carry no account.
- Wallet addresses. When you look at a wallet, track one, or see your own balances and history, its public address is part of the request URL to our servers and of the balance and history queries sent to public blockchain nodes (RPC). Like every request, these appear in the server logs described in section 1.
- Clipboard. The app reads your clipboard only when you tap Paste CA (to paste a token’s contract address), and writes to it only when you tap a copy button. It never reads the clipboard in the background.
- No ads, no tracking. The app shows no ads, does not use the advertising identifier (IDFA / Android advertising ID), contains no analytics or tracking SDK and shares no data with data brokers. The native app sends no crash reports; only the website and the phone web app send the error reports described in section 1.
- On your device. Your settings, watchlist, tracked wallets, hidden authors and recent searches stay in the app’s storage on your device. Wallet keys, where the app offers wallets, are created and kept on your device and never sent to us. If you sign in, the account data in section 1 applies, as on the website.
5. How we use data
To run your account and the terminal (balances, positions, trade history, analytics), to secure sign-in and sensitive actions, to prevent abuse and spam, and to publish aggregated, non-personal statistics. We do not use your data for advertising, profiling or credit decisions.
6. Who else is involved
- Privy handles sign-in and your login wallet. Its own privacy policy applies to the data you give it.
- Blockchain nodes. Your browser sends signed transactions and balance queries to public RPC nodes of Robinhood Chain, BNB Chain and Solana. Like any website, those nodes see your IP address. Everything recorded on a blockchain is public and permanent.
- Relay (relay.link) processes a cross-chain deposit only if you choose to make one.
- Market data providers (for example DexScreener and GeckoTerminal) are queried by our servers for prices and charts; no personal data is sent to them.
- We may disclose data if the law requires it. We do not sell or rent personal data to anyone.
7. How long we keep it, and deleting your account
Account data stays while your account exists. Server logs are kept for 14 days. Public blockchain data cannot be deleted by anyone.
- Delete in the app. Settings → Account → Delete account. You confirm by typing DELETE, plus your two-factor code if 2FA is on, or a sign-in from the last 10 minutes if it is not. It deletes at once, from our servers: your account profile (login wallet address, wallet names, the encrypted backup and its recovery copy), your 2FA data, the callouts you posted from your login wallet or imported wallets, your roadmap ideas (hidden, text erased) and votes, and the Road to Albania enrolment of those wallets. You are then logged out.
- What stays. Your trades and transfers on the blockchain; the wallet keys on your device (export them first, then remove the app or clear the site data to erase them); competition payout records, which we keep as financial records; server logs until they expire (14 days); your sign-in record at Privy, which we delete on request. Callouts posted from a vault trading wallet that is not listed in your profile are not linked to your account on our server: e-mail us the wallet address and we remove them.
- Delete by e-mail. Without the app, write to the contact below from the address you sign in with (or from your X account). We delete your account and its data within 30 days.
8. Your choices
- Export your private keys at any time from Wallets and use them in any other wallet.
- Delete your account in the app, or ask for a copy of your data or for deletion by writing to the contact below from your login email or X account.
- Hide authors you do not want to see (⋯ → Hide this author; undo in Settings → Hidden authors). This stays on your device.
- Uninstalling the extension removes its local settings; removing the app removes its local data.
9. Security
How keys are protected, and how you can check it yourself, is described in the Security Center. The vault engine and the extension are open source at github.com/motiongift.
10. Children
motion is not intended for anyone under 18.
11. Changes
If this policy changes, we will update this page and its effective date. Material changes will also be announced on @motiongift.