Last updated: 7 October 2026

Privacy Policy

Movepost (“we”, “us”) helps you update your mailing address across your accounts. This policy explains what data we use, who receives it, and your choices.

1. What we collect and why

• Your Movepost account: you sign in with Google. We keep your email address, the basic profile Google shares at sign-in (name, profile photo, and account ID), and Movepost sign-in tokens so you can access your saved work and receive receipts and service messages. Signing in never gives us access to your Gmail.
• Your move: your old and new addresses, the services on your list, and your progress. We use these to fill address forms and save your checklist.
• Payments: Stripe processes your payment. We do not receive or store your card number.
• Website usage: requests, errors, counts of steps completed, campaign labels, and broad device and browser categories help us operate and improve the service. Our own funnel records do not include full landing URLs, referrers, or identifiers that track a visitor across events. Reddit measurement is separate and described below.
• Extension reliability: for services in our public registry, we collect the service name, extension version, general page type, and whether finding or filling the address form worked. These reports include no visited URLs, page contents, form values, or user or account identifiers.

2. What the extension can do

You sign in on each service’s own website using your browser or password manager. On the exact sign-in page it opened, the extension can check whether Chrome has filled a saved login and press that form’s sign-in button once, only while it is still managing that tab. It never reads or stores credential values. Otherwise you sign in manually. You handle two-factor prompts and save each address change yourself.

The extension fills your new address and tracks your progress. It does not collect your passwords, account numbers, card numbers, or browsing history.

3. Optional email discovery

You can link your Gmail account to help find accounts you may need to update, or build your list manually. Access is read-only: we cannot send, change, delete, or label your mail. We search senders to identify services and do not store messages or message bodies.

We store your connected email address, connection details, and discovery results. To help identify services, we send sender domains, display names from email headers, and counts of matching emails to Anthropic’s Claude. Message bodies are not sent. We use this information for account discovery, not to train models.

• Connecting through Truto: our integration partner Truto appears on Google’s consent screen and holds your read-only authorization. We store a reference to it. Disconnecting revokes that connection at Truto and removes our connection record.
• Connecting directly: Google’s consent screen names Movepost. We store a short-lived access token and your connected email address, but no refresh token. You must reconnect after the token expires. Disconnecting deletes our stored connection and token.

Neither method gives us your Google password, and Google access tokens are never sent to the extension. You can also revoke access in yourGoogle Account connections.

Movepost’s use of information received from Google APIs adheres to theGoogle API Services User Data Policy, including the Limited Use requirements.

4. Who receives your data

We use Cloudflare for hosting, Supabase for sign-in and data storage, Stripe for payments, and Resend for service emails. Optional email discovery uses Truto and Anthropicas described above. Reddit receives advertising measurement data as described below. We may also disclose data when required by law.

We do not sell your personal information or give advertisers your addresses, checklist, account list, mailbox data, or payment-card details.

Muse, when you connect it: creating a Muse connection key lets Meta’s Muse read service names, categories, progress, and update times from your current move, and record status changes you confirm. We do not send your street addresses, mailbox contents, passwords, sign-in tokens, or payment details through this connector. We keep a hash of the key, its creation and expiration times, and the move it covers. The key expires after 30 days; you can replace or revoke it at Connect Muse. Deleting your Movepost data removes it. Data already received by Meta is governed byMuse’s privacy policy; disconnecting stops future access.

5. Advertising measurement and your controls

Reddit’s tracking script runs only on our /start page, never in the extension or on your account providers’ websites. It measures visits, checkout starts, and purchases. If you are signed in, we may send your Movepost email and user ID for ad matching. Reddit can also receive the page URL, referrer, cookies, ad-click information, IP address, browser information, screen size, and public page details. This data is not anonymous.

After a successful $19 Move Pass purchase, our server may also send Reddit the purchase time and amount, a random purchase identifier, our fixed start-page URL, your Movepost user ID, and a Reddit ad-click ID when available. This server report does not include your email, phone number, IP address, browser details, or payment-card data. If you buy as a guest after a Reddit ad click, we also attach that click ID to your Stripe checkout.

Your browser controls: Global Privacy Control or Do Not Track prevents Reddit’s script from loading and stops us from collecting or keeping its ad-click ID. This also prevents browser-based email and user-ID matching. It cannot undo data already sent. It does not stop the server purchase report, which still includes your Movepost user ID.

Advertising measurement may count as “sharing” personal information under laws such as California’s CCPA/CPRA. To request an opt-out or ask about your data, email[email protected]. Reddit handles information it receives under its ownprivacy policy.

6. Data location, security, and retention

Movepost is operated by X1 Consulting LLC, headquartered in the United States, and is offered to US customers. Our primary Supabase database is hosted in Canada. Information stored there includes your Movepost account, saved move, account list, and progress. Using a US-only product does not mean your data is stored only in the US.

Our service providers may also process data in the United States and other countries. Cloudflare uses a global network, so Canadian primary database storage does not mean all processing takes place in Canada. Data may be subject to the laws of the countries where it is processed. Contact us at [email protected]with questions about data locations or deletion.

We restrict access so users cannot access one another’s data and encrypt data in transit. Stored email access tokens are encrypted and stay on our servers.

• Your checklist: kept while your account is active, potentially for more than 12 months, and deleted on request or within a reasonable time after account closure.
• Extension reliability reports: deleted within 30 days, usually sooner after being combined into service-level statistics with no user identifiers or visited URLs.
• Advertising records: a Reddit click ID stays in the browser tab until you close it or clear site storage. Purchase-reporting records are kept to retry delivery and prevent duplicates, and are deleted with your account. We do not send purchases older than seven days. We do not keep copies of Reddit’s browser events; Reddit and Stripe apply their own retention rules to data they receive.

7. Your rights and contact

Depending on where you live, you may have rights to access, correct, export, or delete your data, or opt out of its sale or sharing. We honor applicable requests. Contact[email protected] to make a request or ask a question.

Movepost is not directed to children under 16, and we do not knowingly collect their data. We will post policy changes here and update the date above.