Pre-release test terms — not the terms Motive 8 will launch with

MV8 — app.mv8.life

Privacy notice

Last updated 1 October 2026 · Version 2026-10-01-prerelease

Pre-release — written in plain language while the new Motive 8 app is tested. It will be reviewed by legal counsel and replaced, as a new version, before the first live member.

Motive 8 is a rewards programme for kindness: people are thanked for good they do, the thanks is recorded, and it carries Hearts they can pass on or use with participating merchants. It is run by MV8 Pty Ltd (ACN 699 779 087), an Australian company based in Perth — 'we', 'us' and 'our' in this notice.

Motive 8 is used around the world, and this one notice applies wherever you live. It explains what personal information the app at app.mv8.life collects, why, who else handles it, what other people can see, and the choices you have.

We collect deliberately little. Hearts are earned and never bought, so we don't need — and don't ask for — identity documents, your date of birth, your home address or any payment card.

A separate notice at www.mv8.life/privacy covers our public website, which collects only anonymous analytics.

1. Who we are and how to reach us

MV8 Pty Ltd is responsible for your personal information under this notice. For any privacy question, request or complaint, email privacy@mv8.life. We aim to acknowledge you within 7 days and respond within 30 days.

2. What we collect

2.1 Your account

A first and last name — the name you are known by, which need not be your legal name. If you change it, earlier names are kept in our records but never shown publicly.
A handle made from your name with a random number, used for your profile address.
An email address, if you give one or join with Google or Apple. We use it for account messages and to help you back into your account. Apple may give us a private relay address.
If you choose, the town your Prosperity Tree is planted in, and the country you joined from. We suggest the town from your connection's approximate location; we don't store your IP address to do it.
Which version of the terms and this notice you accepted, when, and for which country.

2.2 Your phone number

When Hearts first move to you, we ask for a mobile number and confirm it — by a WhatsApp message you send us, or by a one-time code sent by text. This makes sure Hearts reach a real person and limits duplicate accounts. Your number is stored encrypted.

2.3 Your passkeys and your Hearts

You sign in with a passkey. We keep its public details — an identifier, a public key, and whether it syncs between your devices. The private part never leaves your device or password manager.
Your Hearts are recorded on a public blockchain under an address that only you control. The key to that address is made on your device. We store copies of it locked under your passkeys, which we cannot open, and we never receive the key itself or the 24 words it is made from.
Your Hearts are backed up automatically when your account is set up. The key is split into two pieces: we hold one, which opens nothing on its own, and the other is emailed to you once as your Restore link and is not kept by us.

2.4 The good you do

Acts of kindness, thank-yous and gifts — who they were from and for, the message, the occasion, where the thanks was sent from, and who confirmed the act.
Missions and causes you start, join or support, and photos you add to them.
Receipts you choose to forward as evidence of giving. They are kept privately, only as long as needed to confirm the act, and never appear on a tree.
Hearts you receive, give and use, always recorded in Hearts.
Rewards you claim and redeem with participating merchants, and where and when; and, if you pair one, an NFC fob's identifier and where and when it was paired.
Your profile settings and notification preferences.

2.5 Technical information

Standard request information — IP address, browser and device type — handled by our hosting provider to deliver the app and protect it.
Sign-in records, which keep only the network part of your IP address, never the full address.
App and security logs. Personal details are masked before they are written; one-time codes and keys never are.

2.6 What we never collect

Identity documents, your date of birth, your home address or payment card details.
Your mailbox. We never connect to your email to look for receipts — you forward the ones you choose.

3. Why we use it

To run your account — let you join, sign in and get back in, and show you your Hearts, your tree and your record.
To record and deliver what you do — thank-yous, gifts, missions, confirmed acts, and rewards claimed and redeemed.
To keep Motive 8 fair and safe — confirm phone numbers, limit duplicate accounts, and detect fraud and abuse.
To check names against government sanctions lists, which every business must do.
To contact you — one-time codes, account and recovery messages, and notifications you have turned on.
To keep the records described in section 7, and to meet legal obligations.

3.1 Legal bases in the European Union and United Kingdom

If you are in the European Union or the United Kingdom, we rely on: providing the service you joined (contract); keeping it fair, safe and accountable (our legitimate interests); anything optional you switch on, such as a public tree or notifications (consent, which you can withdraw at any time); and legal obligations.

4. What other people can see

You decide what is public. Unless you change it:

Your Prosperity Tree is private. You can make it public, or hide it entirely, at any time.
Your acts, Standing, tree town and credentials are private. You choose which to show.
Your name is shown to the person on the other side of each thank-you or gift — the one thing you can't hide, because a thank-you from nobody means nothing.
A hidden tree still counts, anonymously, in public totals such as a mission's progress.
Participating merchants see what they need to honour a reward you redeem with them.
Verified organisations' trees are public in full, so their impact can be trusted.

4.1 What goes on the public blockchain

Movements of Hearts, and a fingerprint of each act in your record, are written to a public blockchain so that nobody can take your good away or fake theirs. Those entries carry addresses and reference codes — never your name, your contact details or what the act was. The details stay in our records, and if they are deleted the fingerprint that remains can no longer be linked to anything. Blockchain entries themselves can't be changed or removed by anyone, including us.

5. Who else handles it

We use a small number of service providers, each under an agreement to protect personal information. Each receives only what it needs to do its job for us.

5.1 Service providers

Supabase — our database and sign-in service, where your account records are kept.
Vercel — hosts the app and handles requests to it.
Microsoft — sends our emails, such as join codes, account messages and your Restore link.
Twilio — sends text-message codes to confirm your phone number.
WhatsApp (Meta) — receives the message you send us if you confirm your phone by WhatsApp.
Google and Apple — only if you choose to join or sign in with them. They open your account, never your Hearts.
Anthropic — its AI helps you write a gift message or frame a mission when you ask it to, and gives mission text and shared links a first check for scams. It receives only the text involved, never your contact details, and a person always reviews anything it blocks.
Photon (OpenStreetMap) — receives only the letters you type when you search for your tree's town, sent from our servers without your IP address.
Helius and Solana network providers — read the public blockchain to keep your Hearts balance accurate.
Your browser's push service (Apple, Google or Mozilla) — delivers notifications you have turned on.

5.2 When the law requires it

We disclose personal information to regulators, law enforcement or courts only when the law requires it — for example under a court order, warrant or subpoena.

5.3 What we never do

We don't sell or rent your personal information, or share it with anyone for their own marketing.
We don't run advertising, behavioural targeting or cross-site tracking in the app.
We don't use your personal information to train AI models.

6. Where it is processed

Our providers process information in Australia and in other countries, mainly the United States and the European Union. Before information goes overseas we take reasonable steps — through contracts and our providers' own security and privacy commitments — to make sure it is protected to the standard this notice describes.

7. How long we keep it

While your account is open, we keep what we need to run it.
Records of Hearts issued, given and redeemed are kept for seven years with your details removed, because they are the evidence of how Motive 8 works if that is ever questioned.
When you close your account, your name and contact details are deleted after the waiting period, unless the law requires us to keep them.
Records of who accessed personal information inside MV8 are kept for seven years; other security logs for at least twelve months.
Receipts you forward are kept only until the act they support is confirmed.
Everything else is kept only as long as it is needed for the purpose it was collected for, then securely deleted or made anonymous.

8. Your rights

Wherever you live, you can:

Get a copy of the personal information we hold about you.
Correct anything that is wrong — your name and profile you can change yourself in the app.
Close your account and have your personal information deleted. After a short waiting period, in which you can change your mind, your name, contact details and profile are erased. The records described in section 7 are kept with your details removed, and we tell you exactly what was deleted and what was kept.
Make your tree and profile private, or switch off anything optional, at any time.

8.1 How to ask, and how to complain

Use the controls in the app, or email privacy@mv8.life. We may need to confirm it's you before acting on a request. If you're unhappy with how we've handled your information, tell us first and we'll try to put it right.

In Australia you can also complain to the Office of the Australian Information Commissioner at oaic.gov.au. In the European Union or the United Kingdom you also have the rights to object to or restrict how we use your information and to receive it in a portable form, and you can complain to your local data protection authority.

9. Cookies and device storage

The app uses the cookies and browser storage it needs to work — keeping you signed in, protecting sign-ups from abuse, and remembering small choices such as prompts you've dismissed. We don't use advertising cookies. Anything optional, such as product analytics, is off unless you turn it on, with no pre-ticked boxes, and you can change your choice at any time in the app.

10. Security

You sign in with a passkey rather than a password, and the key to your Hearts stays in your hands. Information is encrypted in transit and at rest, phone numbers are encrypted again on top, and the database lets each member reach only their own records. Nobody at MV8 has standing access to members' personal information: access is granted only when needed, for a recorded reason, and every access is logged and reviewed.

If a data breach is likely to cause you serious harm, we will tell you and the relevant regulator as soon as practicable, as Australian law and the law where you live require.

11. If you represent a merchant

When a business joins as a participating merchant, we verify it as any business partner would: its registration and address, the people who own or control it, and the bank account we settle to. That information is used to run the merchant relationship, checked against sanctions lists, and kept for seven years after the relationship ends.

12. Changes to this notice

When we make a material change — a new kind of information, a new provider, or a change in how long we keep things — we'll publish a new version and ask you to accept it the next time you sign in. Smaller corrections update the date at the top of this page. We keep a record of the version you accepted, so it is always clear which notice applied.

13. Effective date and version

Effective 1 October 2026. Version 2026-10-01-prerelease. This is a pre-release notice for testing; a reviewed notice replaces it before the first live member. Our website's notice at www.mv8.life/privacy is maintained separately.