Privacy Policy

Last updated: 15 February 2026

This Privacy Policy explains how MoveTwo (“we”, “us”, “our”) collects, uses, and protects your personal data when you use the MoveTwo Chrome extension, web dashboard, and related services (the “Service”). We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data Controller

MoveTwo is the data controller for personal data processed through MoveTwo. You can contact us at:

MoveTwo
hello@movetwo.app

2. What Data We Collect

2.1 Account Data

When you create an account we collect:

Email address — used for authentication and account-related notifications.
Display name — shown to members of your search so they can identify you.

Authentication is handled by Amazon Cognito. We do not store your password; it is managed securely by Cognito.

2.2 Property Data

When you choose to save a property using the Chrome extension, we store:

Property listing URL
Property address (as displayed on the listing page)
Price or rent amount
Number of bedrooms, bathrooms, and property type (where available)
Listing site name (e.g. “Rightmove”, “Zoopla”)

This data is extracted from the property page you are viewing, only when you actively click the save button. MoveTwo does not crawl, index, or automatically collect data from any website.

2.3 User-Generated Content

Content you create within the Service, including:

Comments and notes on properties
Ratings (1–5 stars)
Property status updates (e.g. “viewing”, “applied”)
Photos uploaded to comments

2.4 Search & Location Data

Saved locations — addresses you enter for travel-time calculations (e.g. your workplace).
Travel times — calculated via third-party APIs (see Section 5).

We do not track your real-time location or browsing history.

2.5 Technical Data

We collect minimal technical data necessary to operate the Service:

API request logs (IP address, timestamp, endpoint) — retained for 30 days for security and debugging.
Error reports — to diagnose and fix issues.

3. How We Use Your Data

We use your data for the following purposes:

Purpose	Legal Basis (UK GDPR)
Providing the Service (saving properties, comments, ratings, travel times)	Performance of contract (Art. 6(1)(b))
Account authentication and security	Performance of contract (Art. 6(1)(b))
Sending account-related emails (invite links, site-request confirmations)	Performance of contract (Art. 6(1)(b))
Diagnosing errors and improving the Service	Legitimate interest (Art. 6(1)(f))
Responding to support requests	Legitimate interest (Art. 6(1)(f))

We do not use your data for advertising, profiling, or automated decision-making. We do not sell or rent your personal data to any third party.

4. Chrome Extension Permissions

The MoveTwo Chrome extension requests the following permissions:

Permission	Why We Need It
storage	Store your authentication token and extension settings locally in the browser.
activeTab	Read property details from the listing page you are currently viewing when you interact with the extension.
identity	Authenticate your account via OAuth.
Host permissions (property sites)	Inject the MoveTwo widget on supported property-listing pages so you can save properties and see travel times. The extension only activates on individual property-detail pages — never on search-results pages, homepages, or other sections of these sites.

The extension does not access your browsing history, read data from non-listed sites, or transmit any data except the specific property details you choose to save.

5. Third-Party Services

We use the following third-party services to operate MoveTwo:

Service	Provider	Purpose	Data Shared
Amazon Cognito	Amazon Web Services (AWS)	User authentication	Email, password (hashed)
Amazon DynamoDB	AWS	Data storage	All Service data (encrypted at rest)
Amazon SES	AWS	Transactional emails	Email address, email content
Amazon S3 / CloudFront	AWS	Image storage and delivery	Uploaded photos
Google Maps APIs	Google	Travel-time calculations and geocoding	Saved location addresses, property addresses
Google Analytics 4	Google	Marketing site analytics (with explicit consent only)	Anonymised usage data, page views

All AWS services are hosted in the EU (Ireland) region (eu-west-1). Google Maps API requests are subject to Google’s Privacy Policy.

6. Data Sharing

Your property data, comments, and ratings are shared only with the members of your search (the people you explicitly invite). We do not share your data with any other users or third parties, except:

With the third-party service providers listed in Section 5, solely to operate the Service.
If required by law, regulation, or legal process.
To protect the rights, safety, or property of MoveTwo, our users, or the public.

7. Data Retention

Account data — retained while your account is active. Deleted within 30 days of account deletion.
Property data and user content — retained while your account is active. When you archive a search, data is retained for 12 months then automatically deleted.
API logs — retained for 30 days, then automatically deleted.
Uploaded images — deleted when the associated comment or property is deleted, or within 30 days of account deletion.

8. Data Security

We take appropriate technical and organisational measures to protect your data, including:

Encryption in transit (TLS/HTTPS for all connections).
Encryption at rest (AWS-managed encryption for DynamoDB and S3).
Authentication via industry-standard OAuth 2.0 (Amazon Cognito).
Access controls limiting data access to authorised search members only.

If you discover a security vulnerability, please report it responsibly via our Security & Vulnerability Disclosure page.

9. Your Rights

Under the UK GDPR, you have the right to:

Access — request a copy of the personal data we hold about you.
Rectification — ask us to correct inaccurate data.
Erasure — ask us to delete your personal data (“right to be forgotten”).
Data portability — receive your data in a structured, machine-readable format.
Restriction — ask us to restrict processing of your data.
Objection — object to processing based on legitimate interest.

To exercise any of these rights, email us at hello@movetwo.app. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

10. Cookies

This section serves as our Cookie Policy.

The MoveTwo web dashboard uses essential cookies required for authentication (session tokens).

Our marketing site (movetwo.app) uses Google Analytics 4 to understand how visitors find and use the site. GA4 sets analytics cookies only if you explicitly click “Accept” on the cookie consent banner. If you decline, no analytics cookies are set and no data is sent to Google. You can change your preference at any time by clearing your browser’s local storage for movetwo.app.

We do not use advertising cookies or sell data to third parties.

The Chrome extension uses Chrome’s local storage API to store your authentication token and settings. This data never leaves your browser except when making authenticated API requests to our servers.

11. Children

MoveTwo is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

12. International Transfers

Your data is stored and processed in the EU (Ireland, eu-west-1). If data is transferred outside the UK/EEA (for example, via Google Maps API requests), it is protected by appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a new “Last updated” date. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.

14. Contact

If you have questions about this Privacy Policy or how we handle your data, contact us at:

MoveTwo
hello@movetwo.app